diff --git a/CHANGELOG.md b/CHANGELOG.md
index 151bec686ea..e207212ee96 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,7 @@ CHANGELOG
 =========
 
 ## HEAD (Unreleased)
-_(none)_
+* Upgrade to v3.67.0 of the AWS Terraform Provider
 
 ---
 
diff --git a/provider/cmd/pulumi-resource-aws/schema.json b/provider/cmd/pulumi-resource-aws/schema.json
index 81c797cfc42..76a57d7e5fc 100644
--- a/provider/cmd/pulumi-resource-aws/schema.json
+++ b/provider/cmd/pulumi-resource-aws/schema.json
@@ -11309,10 +11309,7 @@
                     }
                 }
             },
-            "type": "object",
-            "required": [
-                "instanceRoleArn"
-            ]
+            "type": "object"
         },
         "aws:apprunner/ServiceSourceConfiguration:ServiceSourceConfiguration": {
             "properties": {
@@ -12412,6 +12409,15 @@
                         }
                     }
                 },
+                "engineVersion": {
+                    "$ref": "#/types/aws:athena/WorkgroupConfigurationEngineVersion:WorkgroupConfigurationEngineVersion",
+                    "description": "Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "publishCloudwatchMetricsEnabled": {
                     "type": "boolean",
                     "description": "Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.\n",
@@ -12442,6 +12448,36 @@
             },
             "type": "object"
         },
+        "aws:athena/WorkgroupConfigurationEngineVersion:WorkgroupConfigurationEngineVersion": {
+            "properties": {
+                "effectiveEngineVersion": {
+                    "type": "string",
+                    "description": "The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "selectedEngineVersion": {
+                    "type": "string",
+                    "description": "The requested engine version. Defaults to `AUTO`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "language": {
+                "nodejs": {
+                    "requiredOutputs": [
+                        "effectiveEngineVersion"
+                    ]
+                }
+            }
+        },
         "aws:athena/WorkgroupConfigurationResultConfiguration:WorkgroupConfigurationResultConfiguration": {
             "properties": {
                 "encryptionConfiguration": {
@@ -15177,11 +15213,48 @@
             },
             "type": "object"
         },
+        "aws:cfg/RemediationConfigurationExecutionControls:RemediationConfigurationExecutionControls": {
+            "properties": {
+                "ssmControls": {
+                    "$ref": "#/types/aws:cfg/RemediationConfigurationExecutionControlsSsmControls:RemediationConfigurationExecutionControlsSsmControls",
+                    "description": "Configuration block for SSM controls. See below.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object"
+        },
+        "aws:cfg/RemediationConfigurationExecutionControlsSsmControls:RemediationConfigurationExecutionControlsSsmControls": {
+            "properties": {
+                "concurrentExecutionRatePercentage": {
+                    "type": "integer",
+                    "description": "Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "errorPercentage": {
+                    "type": "integer",
+                    "description": "Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object"
+        },
         "aws:cfg/RemediationConfigurationParameter:RemediationConfigurationParameter": {
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the attribute.\n",
+                    "description": "Name of the attribute.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -15190,7 +15263,7 @@
                 },
                 "resourceValue": {
                     "type": "string",
-                    "description": "The value is dynamic and changes at run-time.\n",
+                    "description": "Value is dynamic and changes at run-time.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -15199,7 +15272,7 @@
                 },
                 "staticValue": {
                     "type": "string",
-                    "description": "The value is static and does not change at run-time.\n",
+                    "description": "Value is static and does not change at run-time.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -19188,9 +19261,21 @@
                         }
                     }
                 },
+                "excludeManagementEventSources": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "includeManagementEvents": {
                     "type": "boolean",
-                    "description": "Whether to include management events for your trail.\n",
+                    "description": "Whether to include management events for your trail. Defaults to `true`.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -23613,6 +23698,9 @@
                 "accessanalyzer": {
                     "type": "string"
                 },
+                "account": {
+                    "type": "string"
+                },
                 "acm": {
                     "type": "string"
                 },
@@ -25191,7 +25279,7 @@
             "properties": {
                 "copyTags": {
                     "type": "boolean",
-                    "description": "Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.\n",
+                    "description": "Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -25207,6 +25295,18 @@
                         }
                     }
                 },
+                "crossRegionCopyRules": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:dlm/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule:LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule"
+                    },
+                    "description": "See the `cross_region_copy_rule` block. Max of 3 per schedule.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "name": {
                     "type": "string",
                     "description": "A name for the schedule.\n",
@@ -25218,7 +25318,7 @@
                 },
                 "retainRule": {
                     "$ref": "#/types/aws:dlm/LifecyclePolicyPolicyDetailsScheduleRetainRule:LifecyclePolicyPolicyDetailsScheduleRetainRule",
-                    "description": "See the `retain_rule` block. Max of 1 per schedule.\n",
+                    "description": "The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -25259,7 +25359,7 @@
             "properties": {
                 "interval": {
                     "type": "integer",
-                    "description": "How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.\n",
+                    "description": "The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -25268,7 +25368,7 @@
                 },
                 "intervalUnit": {
                     "type": "string",
-                    "description": "The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.\n",
+                    "description": "The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -25298,6 +25398,123 @@
                 }
             }
         },
+        "aws:dlm/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule:LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule": {
+            "properties": {
+                "cmkArn": {
+                    "type": "string",
+                    "description": "The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "copyTags": {
+                    "type": "boolean",
+                    "description": "Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "deprecateRule": {
+                    "$ref": "#/types/aws:dlm/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule:LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule",
+                    "description": "The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecate_rule` block.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "encrypted": {
+                    "type": "boolean",
+                    "description": "To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "retainRule": {
+                    "$ref": "#/types/aws:dlm/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule:LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule",
+                    "description": "The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "target": {
+                    "type": "string",
+                    "description": "The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "encrypted",
+                "target"
+            ]
+        },
+        "aws:dlm/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule:LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule": {
+            "properties": {
+                "interval": {
+                    "type": "integer",
+                    "description": "The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "intervalUnit": {
+                    "type": "string",
+                    "description": "The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "interval",
+                "intervalUnit"
+            ]
+        },
+        "aws:dlm/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule:LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule": {
+            "properties": {
+                "interval": {
+                    "type": "integer",
+                    "description": "The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "intervalUnit": {
+                    "type": "string",
+                    "description": "The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "interval",
+                "intervalUnit"
+            ]
+        },
         "aws:dlm/LifecyclePolicyPolicyDetailsScheduleRetainRule:LifecyclePolicyPolicyDetailsScheduleRetainRule": {
             "properties": {
                 "count": {
@@ -33717,6 +33934,36 @@
                 "values"
             ]
         },
+        "aws:ec2/getInstanceTypesFilter:getInstanceTypesFilter": {
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "description": "Name of the filter.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "values": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "List of one or more values for the filter.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "name",
+                "values"
+            ]
+        },
         "aws:ec2/getInstancesFilter:getInstancesFilter": {
             "properties": {
                 "name": {
@@ -45483,6 +45730,323 @@
                 }
             }
         },
+        "aws:fsx/OntapStorageVirtualMachineActiveDirectoryConfiguration:OntapStorageVirtualMachineActiveDirectoryConfiguration": {
+            "properties": {
+                "netbiosName": {
+                    "type": "string",
+                    "description": "The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "selfManagedActiveDirectoryConfiguration": {
+                    "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration:OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object"
+        },
+        "aws:fsx/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration:OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration": {
+            "properties": {
+                "dnsIps": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "domainName": {
+                    "type": "string",
+                    "description": "The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "fileSystemAdministratorsGroup": {
+                    "type": "string",
+                    "description": "The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "organizationalUnitDistinguidshedName": {
+                    "type": "string",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "password": {
+                    "type": "string",
+                    "description": "The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "username": {
+                    "type": "string",
+                    "description": "The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "dnsIps",
+                "domainName",
+                "password",
+                "username"
+            ]
+        },
+        "aws:fsx/OntapStorageVirtualMachineEndpoint:OntapStorageVirtualMachineEndpoint": {
+            "properties": {
+                "iscses": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineEndpointIscse:OntapStorageVirtualMachineEndpointIscse"
+                    },
+                    "description": "An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "managements": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineEndpointManagement:OntapStorageVirtualMachineEndpointManagement"
+                    },
+                    "description": "An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "nfs": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineEndpointNf:OntapStorageVirtualMachineEndpointNf"
+                    },
+                    "description": "An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "smbs": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineEndpointSmb:OntapStorageVirtualMachineEndpointSmb"
+                    },
+                    "description": "An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See Endpoint.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "language": {
+                "nodejs": {
+                    "requiredOutputs": [
+                        "iscses",
+                        "managements",
+                        "nfs",
+                        "smbs"
+                    ]
+                }
+            }
+        },
+        "aws:fsx/OntapStorageVirtualMachineEndpointIscse:OntapStorageVirtualMachineEndpointIscse": {
+            "properties": {
+                "dnsName": {
+                    "type": "string",
+                    "description": "The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "ipAddresses": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "IP addresses of the storage virtual machine endpoint.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "language": {
+                "nodejs": {
+                    "requiredOutputs": [
+                        "dnsName",
+                        "ipAddresses"
+                    ]
+                }
+            }
+        },
+        "aws:fsx/OntapStorageVirtualMachineEndpointManagement:OntapStorageVirtualMachineEndpointManagement": {
+            "properties": {
+                "dnsName": {
+                    "type": "string",
+                    "description": "The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "ipAddresses": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "IP addresses of the storage virtual machine endpoint.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "language": {
+                "nodejs": {
+                    "requiredOutputs": [
+                        "dnsName",
+                        "ipAddresses"
+                    ]
+                }
+            }
+        },
+        "aws:fsx/OntapStorageVirtualMachineEndpointNf:OntapStorageVirtualMachineEndpointNf": {
+            "properties": {
+                "dnsName": {
+                    "type": "string",
+                    "description": "The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "ipAddresses": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "IP addresses of the storage virtual machine endpoint.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "language": {
+                "nodejs": {
+                    "requiredOutputs": [
+                        "dnsName",
+                        "ipAddresses"
+                    ]
+                }
+            }
+        },
+        "aws:fsx/OntapStorageVirtualMachineEndpointSmb:OntapStorageVirtualMachineEndpointSmb": {
+            "properties": {
+                "dnsName": {
+                    "type": "string",
+                    "description": "The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "ipAddresses": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "IP addresses of the storage virtual machine endpoint.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "language": {
+                "nodejs": {
+                    "requiredOutputs": [
+                        "dnsName",
+                        "ipAddresses"
+                    ]
+                }
+            }
+        },
+        "aws:fsx/OntapVolumeTieringPolicy:OntapVolumeTieringPolicy": {
+            "properties": {
+                "coolingPeriod": {
+                    "type": "integer",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "name": {
+                    "type": "string",
+                    "description": "Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "language": {
+                "nodejs": {
+                    "requiredOutputs": [
+                        "name"
+                    ]
+                }
+            }
+        },
         "aws:fsx/WindowsFileSystemAuditLogConfiguration:WindowsFileSystemAuditLogConfiguration": {
             "properties": {
                 "auditLogDestination": {
@@ -50754,6 +51318,36 @@
                 }
             }
         },
+        "aws:imagebuilder/getImageRecipesFilter:getImageRecipesFilter": {
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "description": "The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "values": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Set of values that are accepted for the given filter field. Results will be selected if any given value matches.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "name",
+                "values"
+            ]
+        },
         "aws:imagebuilder/getInfrastructureConfigurationLogging:getInfrastructureConfigurationLogging": {
             "properties": {
                 "s3Logs": {
@@ -50915,6 +51509,14 @@
                         }
                     }
                 },
+                "account": {
+                    "type": "string",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "acm": {
                     "type": "string",
                     "language": {
@@ -82393,6 +82995,15 @@
                             "mapCase": false
                         }
                     }
+                },
+                "s3Region": {
+                    "type": "string",
+                    "description": "The S3 bucket region.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
                 }
             },
             "type": "object",
@@ -85093,6 +85704,43 @@
                 "regexString"
             ]
         },
+        "aws:wafv2/RuleGroupCustomResponseBody:RuleGroupCustomResponseBody": {
+            "properties": {
+                "content": {
+                    "type": "string",
+                    "description": "The payload of the custom response.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "contentType": {
+                    "type": "string",
+                    "description": "The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "key": {
+                    "type": "string",
+                    "description": "A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "content",
+                "contentType",
+                "key"
+            ]
+        },
         "aws:wafv2/RuleGroupRule:RuleGroupRule": {
             "properties": {
                 "action": {
@@ -85122,6 +85770,18 @@
                         }
                     }
                 },
+                "ruleLabels": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:wafv2/RuleGroupRuleRuleLabel:RuleGroupRuleRuleLabel"
+                    },
+                    "description": "Labels to apply to web requests that match the rule match statement. See Rule Label below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "statement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatement:RuleGroupRuleStatement",
                     "description": "The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.\n",
@@ -85220,7 +85880,7 @@
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n",
+                    "description": "The label string.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -85259,6 +85919,15 @@
         },
         "aws:wafv2/RuleGroupRuleActionBlockCustomResponse:RuleGroupRuleActionBlockCustomResponse": {
             "properties": {
+                "customResponseBodyKey": {
+                    "type": "string",
+                    "description": "References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "responseCode": {
                     "type": "integer",
                     "description": "The HTTP status code to return to the client.\n",
@@ -85290,7 +85959,7 @@
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n",
+                    "description": "The label string.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -85351,7 +86020,7 @@
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n",
+                    "description": "The label string.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -85374,6 +86043,23 @@
                 "value"
             ]
         },
+        "aws:wafv2/RuleGroupRuleRuleLabel:RuleGroupRuleRuleLabel": {
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "description": "The label string.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "name"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatement:RuleGroupRuleStatement": {
             "properties": {
                 "andStatement": {
@@ -85412,6 +86098,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementLabelMatchStatement:RuleGroupRuleStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatement:RuleGroupRuleStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -85527,6 +86222,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementAndStatementStatementLabelMatchStatement:RuleGroupRuleStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementAndStatementStatementNotStatement:RuleGroupRuleStatementAndStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -85633,6 +86337,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement:RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -85984,6 +86697,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement:RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -87018,6 +87758,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementAndStatementStatementLabelMatchStatement:RuleGroupRuleStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementAndStatementStatementNotStatement:RuleGroupRuleStatementAndStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -87067,6 +87834,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement:RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -87418,6 +88194,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement:RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -88189,6 +88992,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement:RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -88540,6 +89352,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement:RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -90296,6 +91135,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementLabelMatchStatement:RuleGroupRuleStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementNotStatement:RuleGroupRuleStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -90354,6 +91220,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatementStatementLabelMatchStatement:RuleGroupRuleStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatementStatementNotStatement:RuleGroupRuleStatementNotStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -90460,6 +91335,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement:RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -90811,6 +91695,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement:RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -91845,6 +92756,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementNotStatementStatementLabelMatchStatement:RuleGroupRuleStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementNotStatementStatementNotStatement:RuleGroupRuleStatementNotStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -91894,6 +92832,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement:RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -92245,6 +93192,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement:RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -93016,6 +93990,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement:RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -93367,6 +94350,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement:RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -94869,6 +95879,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementOrStatementStatementLabelMatchStatement:RuleGroupRuleStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementOrStatementStatementNotStatement:RuleGroupRuleStatementOrStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -94975,6 +95994,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement:RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -95326,6 +96354,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement:RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -96360,6 +97415,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementOrStatementStatementLabelMatchStatement:RuleGroupRuleStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementOrStatementStatementNotStatement:RuleGroupRuleStatementOrStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -96409,6 +97491,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement:RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -96760,6 +97851,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement:RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -97531,6 +98649,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement:RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -97882,6 +99009,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement:RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -100122,6 +101276,43 @@
                 "sampledRequestsEnabled"
             ]
         },
+        "aws:wafv2/WebAclCustomResponseBody:WebAclCustomResponseBody": {
+            "properties": {
+                "content": {
+                    "type": "string",
+                    "description": "The payload of the custom response.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "contentType": {
+                    "type": "string",
+                    "description": "The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "key": {
+                    "type": "string",
+                    "description": "A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "content",
+                "contentType",
+                "key"
+            ]
+        },
         "aws:wafv2/WebAclDefaultAction:WebAclDefaultAction": {
             "properties": {
                 "allow": {
@@ -100183,7 +101374,7 @@
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n",
+                    "description": "The label string.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -100222,6 +101413,15 @@
         },
         "aws:wafv2/WebAclDefaultActionBlockCustomResponse:WebAclDefaultActionBlockCustomResponse": {
             "properties": {
+                "customResponseBodyKey": {
+                    "type": "string",
+                    "description": "References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "responseCode": {
                     "type": "integer",
                     "description": "The HTTP status code to return to the client.\n",
@@ -100253,7 +101453,7 @@
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n",
+                    "description": "The label string.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -100562,6 +101762,18 @@
                         }
                     }
                 },
+                "ruleLabels": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:wafv2/WebAclRuleRuleLabel:WebAclRuleRuleLabel"
+                    },
+                    "description": "Labels to apply to web requests that match the rule match statement. See Rule Label below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "statement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatement:WebAclRuleStatement",
                     "description": "The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.\n",
@@ -100659,7 +101871,7 @@
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n",
+                    "description": "The label string.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -100698,6 +101910,15 @@
         },
         "aws:wafv2/WebAclRuleActionBlockCustomResponse:WebAclRuleActionBlockCustomResponse": {
             "properties": {
+                "customResponseBodyKey": {
+                    "type": "string",
+                    "description": "References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "responseCode": {
                     "type": "integer",
                     "description": "The HTTP status code to return to the client.\n",
@@ -100729,7 +101950,7 @@
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n",
+                    "description": "The label string.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -100790,7 +102011,7 @@
             "properties": {
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n",
+                    "description": "The label string.\n",
                     "language": {
                         "python": {
                             "mapCase": false
@@ -100842,6 +102063,23 @@
         "aws:wafv2/WebAclRuleOverrideActionNone:WebAclRuleOverrideActionNone": {
             "type": "object"
         },
+        "aws:wafv2/WebAclRuleRuleLabel:WebAclRuleRuleLabel": {
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "description": "The label string.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "name"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatement:WebAclRuleStatement": {
             "properties": {
                 "andStatement": {
@@ -100880,6 +102118,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementLabelMatchStatement:WebAclRuleStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "managedRuleGroupStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatement:WebAclRuleStatementManagedRuleGroupStatement",
                     "description": "A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.\n",
@@ -101022,6 +102269,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatement:WebAclRuleStatementAndStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -101137,6 +102393,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -101243,6 +102508,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -101594,6 +102868,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -102628,6 +103929,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -102677,6 +104005,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -103028,6 +104365,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -103799,6 +105163,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -104150,6 +105523,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -105906,6 +107306,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatement:WebAclRuleStatementAndStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -105964,6 +107391,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -106070,6 +107506,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -106421,6 +107866,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -107455,6 +108927,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -107504,6 +109003,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -107855,6 +109363,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -108626,6 +110161,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -108977,6 +110521,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -110479,6 +112050,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -110585,6 +112165,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -110936,6 +112525,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -111970,6 +113586,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -112019,6 +113662,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -112370,6 +114022,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -113141,6 +114820,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -113492,6 +115180,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -115970,6 +117685,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementLabelMatchStatement:WebAclRuleStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatement:WebAclRuleStatementManagedRuleGroupStatement": {
             "properties": {
                 "excludedRules": {
@@ -116073,6 +117815,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -116188,6 +117939,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -116294,6 +118054,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -116645,6 +118414,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -117679,6 +119475,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -117728,6 +119551,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -118079,6 +119911,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -118850,6 +120709,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -119201,6 +121069,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -120957,6 +122852,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -121015,6 +122937,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -121121,6 +123052,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -121472,6 +123412,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -122506,6 +124473,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -122555,6 +124549,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -122906,6 +124909,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -123677,6 +125707,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -124028,6 +126067,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -125530,6 +127596,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -125636,6 +127711,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -125987,6 +128071,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -127021,6 +129132,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -127070,6 +129208,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -127421,6 +129568,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -128192,6 +130366,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -128543,6 +130726,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -130767,6 +132977,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatement:WebAclRuleStatementNotStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -130882,6 +133101,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -130988,6 +133216,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -131339,6 +133576,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -132373,6 +134637,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -132422,6 +134713,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -132773,6 +135073,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -133544,6 +135871,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -133895,6 +136231,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -135651,6 +138014,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatement:WebAclRuleStatementNotStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -135709,6 +138099,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -135815,6 +138214,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -136166,6 +138574,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -137200,6 +139635,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -137249,6 +139711,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -137600,6 +140071,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -138371,6 +140869,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -138722,6 +141229,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -140224,6 +142758,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -140330,6 +142873,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -140681,6 +143233,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -141715,6 +144294,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -141764,6 +144370,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -142115,6 +144730,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -142886,6 +145528,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -143237,6 +145888,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -145461,6 +148139,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatement:WebAclRuleStatementOrStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -145576,6 +148263,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -145682,6 +148378,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -146033,6 +148738,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -147067,6 +149799,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -147116,6 +149875,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -147467,6 +150235,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -148238,6 +151033,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -148589,6 +151393,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -150345,6 +153176,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatement:WebAclRuleStatementOrStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -150403,6 +153261,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -150509,6 +153376,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -150860,6 +153736,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -151894,6 +154797,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -151943,6 +154873,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -152294,6 +155233,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -153065,6 +156031,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -153416,6 +156391,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -154918,6 +157920,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -155024,6 +158035,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -155375,6 +158395,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -156409,6 +159456,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -156458,6 +159532,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -156809,6 +159892,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -157580,6 +160690,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -157931,6 +161050,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -160206,6 +163352,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -160321,6 +163476,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -160427,6 +163591,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -160778,6 +163951,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -161812,6 +165012,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -161861,6 +165088,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -162212,6 +165448,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -162983,6 +166246,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -163334,6 +166606,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -165090,6 +168389,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -165148,6 +168474,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -165254,6 +168589,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -165605,6 +168949,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -166639,6 +170010,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -166688,6 +170086,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -167039,6 +170446,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -167810,6 +171244,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -168161,6 +171604,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -169663,6 +173133,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "notStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement",
                     "description": "A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.\n",
@@ -169769,6 +173248,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -170120,6 +173608,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -171154,6 +174669,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement": {
             "properties": {
                 "statements": {
@@ -171203,6 +174745,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -171554,6 +175105,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -172325,6 +175903,15 @@
                         }
                     }
                 },
+                "labelMatchStatement": {
+                    "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement",
+                    "description": "A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
                 "regexPatternSetReferenceStatement": {
                     "$ref": "#/types/aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement",
                     "description": "A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.\n",
@@ -172676,6 +176263,33 @@
                 "position"
             ]
         },
+        "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement": {
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "description": "The string to match against.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                },
+                "scope": {
+                    "type": "string",
+                    "description": "Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.\n",
+                    "language": {
+                        "python": {
+                            "mapCase": false
+                        }
+                    }
+                }
+            },
+            "type": "object",
+            "required": [
+                "key",
+                "scope"
+            ]
+        },
         "aws:wafv2/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement:WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement": {
             "properties": {
                 "arn": {
@@ -176668,6 +180282,92 @@
                 "type": "object"
             }
         },
+        "aws:account/alternativeContact:AlternativeContact": {
+            "description": "Manages the specified alternate contact attached to an AWS Account.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst operations = new aws.account.AlternativeContact(\"operations\", {\n    alternateContactType: \"OPERATIONS\",\n    emailAddress: \"test@example.com\",\n    phoneNumber: \"+1234567890\",\n    title: \"Example\",\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\noperations = aws.account.AlternativeContact(\"operations\",\n    alternate_contact_type=\"OPERATIONS\",\n    email_address=\"test@example.com\",\n    phone_number=\"+1234567890\",\n    title=\"Example\")\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var operations = new Aws.Account.AlternativeContact(\"operations\", new Aws.Account.AlternativeContactArgs\n        {\n            AlternateContactType = \"OPERATIONS\",\n            EmailAddress = \"test@example.com\",\n            PhoneNumber = \"+1234567890\",\n            Title = \"Example\",\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/account\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := account.NewAlternativeContact(ctx, \"operations\", \u0026account.AlternativeContactArgs{\n\t\t\tAlternateContactType: pulumi.String(\"OPERATIONS\"),\n\t\t\tEmailAddress:         pulumi.String(\"test@example.com\"),\n\t\t\tPhoneNumber:          pulumi.String(\"+1234567890\"),\n\t\t\tTitle:                pulumi.String(\"Example\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nThe current Alternate Contact can be imported using the `alternate_contact_type`, e.g.,\n\n```sh\n $ pulumi import aws:account/alternativeContact:AlternativeContact operations OPERATIONS\n```\n\n ",
+            "properties": {
+                "alternateContactType": {
+                    "type": "string",
+                    "description": "The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.\n"
+                },
+                "emailAddress": {
+                    "type": "string",
+                    "description": "An email address for the alternate contact.\n"
+                },
+                "name": {
+                    "type": "string",
+                    "description": "The name of the alternate contact.\n"
+                },
+                "phoneNumber": {
+                    "type": "string",
+                    "description": "A phone number for the alternate contact.\n"
+                },
+                "title": {
+                    "type": "string",
+                    "description": "A title for the alternate contact.\n"
+                }
+            },
+            "required": [
+                "alternateContactType",
+                "emailAddress",
+                "name",
+                "phoneNumber",
+                "title"
+            ],
+            "inputProperties": {
+                "alternateContactType": {
+                    "type": "string",
+                    "description": "The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.\n"
+                },
+                "emailAddress": {
+                    "type": "string",
+                    "description": "An email address for the alternate contact.\n"
+                },
+                "name": {
+                    "type": "string",
+                    "description": "The name of the alternate contact.\n"
+                },
+                "phoneNumber": {
+                    "type": "string",
+                    "description": "A phone number for the alternate contact.\n"
+                },
+                "title": {
+                    "type": "string",
+                    "description": "A title for the alternate contact.\n"
+                }
+            },
+            "requiredInputs": [
+                "alternateContactType",
+                "emailAddress",
+                "phoneNumber",
+                "title"
+            ],
+            "stateInputs": {
+                "description": "Input properties used for looking up and filtering AlternativeContact resources.\n",
+                "properties": {
+                    "alternateContactType": {
+                        "type": "string",
+                        "description": "The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.\n"
+                    },
+                    "emailAddress": {
+                        "type": "string",
+                        "description": "An email address for the alternate contact.\n"
+                    },
+                    "name": {
+                        "type": "string",
+                        "description": "The name of the alternate contact.\n"
+                    },
+                    "phoneNumber": {
+                        "type": "string",
+                        "description": "A phone number for the alternate contact.\n"
+                    },
+                    "title": {
+                        "type": "string",
+                        "description": "A title for the alternate contact.\n"
+                    }
+                },
+                "type": "object"
+            }
+        },
         "aws:acm/certificate:Certificate": {
             "description": "The ACM certificate resource allows requesting and management of certificates\nfrom the Amazon Certificate Manager.\n\nIt deals with requesting certificates and managing their attributes and life-cycle.\nThis resource does not deal with validation of a certificate but can provide inputs\nfor other resources implementing the validation. It does not wait for a certificate to be issued.\nUse a `aws.acm.CertificateValidation` resource for this.\n\nMost commonly, this resource is used together with `aws.route53.Record` and\n`aws.acm.CertificateValidation` to request a DNS validated certificate,\ndeploy the required validation records and wait for validation to complete.\n\nDomain validation through E-Mail is also supported but should be avoided as it requires a manual step outside\nof this provider.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n### Create Certificate\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst cert = new aws.acm.Certificate(\"cert\", {\n    domainName: \"example.com\",\n    tags: {\n        Environment: \"test\",\n    },\n    validationMethod: \"DNS\",\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ncert = aws.acm.Certificate(\"cert\",\n    domain_name=\"example.com\",\n    tags={\n        \"Environment\": \"test\",\n    },\n    validation_method=\"DNS\")\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var cert = new Aws.Acm.Certificate(\"cert\", new Aws.Acm.CertificateArgs\n        {\n            DomainName = \"example.com\",\n            Tags = \n            {\n                { \"Environment\", \"test\" },\n            },\n            ValidationMethod = \"DNS\",\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/acm\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := acm.NewCertificate(ctx, \"cert\", \u0026acm.CertificateArgs{\n\t\t\tDomainName: pulumi.String(\"example.com\"),\n\t\t\tTags: pulumi.StringMap{\n\t\t\t\t\"Environment\": pulumi.String(\"test\"),\n\t\t\t},\n\t\t\tValidationMethod: pulumi.String(\"DNS\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Existing Certificate Body Import\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport * as tls from \"@pulumi/tls\";\n\nconst examplePrivateKey = new tls.PrivateKey(\"examplePrivateKey\", {algorithm: \"RSA\"});\nconst exampleSelfSignedCert = new tls.SelfSignedCert(\"exampleSelfSignedCert\", {\n    keyAlgorithm: \"RSA\",\n    privateKeyPem: examplePrivateKey.privateKeyPem,\n    subjects: [{\n        commonName: \"example.com\",\n        organization: \"ACME Examples, Inc\",\n    }],\n    validityPeriodHours: 12,\n    allowedUses: [\n        \"key_encipherment\",\n        \"digital_signature\",\n        \"server_auth\",\n    ],\n});\nconst cert = new aws.acm.Certificate(\"cert\", {\n    privateKey: examplePrivateKey.privateKeyPem,\n    certificateBody: exampleSelfSignedCert.certPem,\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\nimport pulumi_tls as tls\n\nexample_private_key = tls.PrivateKey(\"examplePrivateKey\", algorithm=\"RSA\")\nexample_self_signed_cert = tls.SelfSignedCert(\"exampleSelfSignedCert\",\n    key_algorithm=\"RSA\",\n    private_key_pem=example_private_key.private_key_pem,\n    subjects=[tls.SelfSignedCertSubjectArgs(\n        common_name=\"example.com\",\n        organization=\"ACME Examples, Inc\",\n    )],\n    validity_period_hours=12,\n    allowed_uses=[\n        \"key_encipherment\",\n        \"digital_signature\",\n        \"server_auth\",\n    ])\ncert = aws.acm.Certificate(\"cert\",\n    private_key=example_private_key.private_key_pem,\n    certificate_body=example_self_signed_cert.cert_pem)\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\nusing Tls = Pulumi.Tls;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var examplePrivateKey = new Tls.PrivateKey(\"examplePrivateKey\", new Tls.PrivateKeyArgs\n        {\n            Algorithm = \"RSA\",\n        });\n        var exampleSelfSignedCert = new Tls.SelfSignedCert(\"exampleSelfSignedCert\", new Tls.SelfSignedCertArgs\n        {\n            KeyAlgorithm = \"RSA\",\n            PrivateKeyPem = examplePrivateKey.PrivateKeyPem,\n            Subjects = \n            {\n                new Tls.Inputs.SelfSignedCertSubjectArgs\n                {\n                    CommonName = \"example.com\",\n                    Organization = \"ACME Examples, Inc\",\n                },\n            },\n            ValidityPeriodHours = 12,\n            AllowedUses = \n            {\n                \"key_encipherment\",\n                \"digital_signature\",\n                \"server_auth\",\n            },\n        });\n        var cert = new Aws.Acm.Certificate(\"cert\", new Aws.Acm.CertificateArgs\n        {\n            PrivateKey = examplePrivateKey.PrivateKeyPem,\n            CertificateBody = exampleSelfSignedCert.CertPem,\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/acm\"\n\t\"github.com/pulumi/pulumi-tls/sdk/v4/go/tls\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texamplePrivateKey, err := tls.NewPrivateKey(ctx, \"examplePrivateKey\", \u0026tls.PrivateKeyArgs{\n\t\t\tAlgorithm: pulumi.String(\"RSA\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSelfSignedCert, err := tls.NewSelfSignedCert(ctx, \"exampleSelfSignedCert\", \u0026tls.SelfSignedCertArgs{\n\t\t\tKeyAlgorithm:  pulumi.String(\"RSA\"),\n\t\t\tPrivateKeyPem: examplePrivateKey.PrivateKeyPem,\n\t\t\tSubjects: SelfSignedCertSubjectArray{\n\t\t\t\t\u0026SelfSignedCertSubjectArgs{\n\t\t\t\t\tCommonName:   pulumi.String(\"example.com\"),\n\t\t\t\t\tOrganization: pulumi.String(\"ACME Examples, Inc\"),\n\t\t\t\t},\n\t\t\t},\n\t\t\tValidityPeriodHours: pulumi.Int(12),\n\t\t\tAllowedUses: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"key_encipherment\"),\n\t\t\t\tpulumi.String(\"digital_signature\"),\n\t\t\t\tpulumi.String(\"server_auth\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = acm.NewCertificate(ctx, \"cert\", \u0026acm.CertificateArgs{\n\t\t\tPrivateKey:      examplePrivateKey.PrivateKeyPem,\n\t\t\tCertificateBody: exampleSelfSignedCert.CertPem,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Referencing domain_validation_options With for_each Based Resources\n\nSee the `aws.acm.CertificateValidation` resource for a full example of performing DNS validation.\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example: aws.route53.Record[];\nfor (const range of Object.entries(.reduce((__obj, dvo) =\u003e { ...__obj, [dvo.domainName]: {\n    name: dvo.resourceRecordName,\n    record: dvo.resourceRecordValue,\n    type: dvo.resourceRecordType,\n} })).map(([k, v]) =\u003e {key: k, value: v})) {\n    example.push(new aws.route53.Record(`example-${range.key}`, {\n        allowOverwrite: true,\n        name: range.value.name,\n        records: [range.value.record],\n        ttl: 60,\n        type: range.value.type,\n        zoneId: aws_route53_zone.example.zone_id,\n    }));\n}\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = []\nfor range in [{\"key\": k, \"value\": v} for [k, v] in enumerate({dvo.domainName: {\n    name: dvo.resourceRecordName,\n    record: dvo.resourceRecordValue,\n    type: dvo.resourceRecordType,\n} for dvo in aws_acm_certificate.example.domain_validation_options})]:\n    example.append(aws.route53.Record(f\"example-{range['key']}\",\n        allow_overwrite=True,\n        name=range[\"value\"][\"name\"],\n        records=[range[\"value\"][\"record\"]],\n        ttl=60,\n        type=range[\"value\"][\"type\"],\n        zone_id=aws_route53_zone[\"example\"][\"zone_id\"]))\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nCertificates can be imported using their ARN, e.g.,\n\n```sh\n $ pulumi import aws:acm/certificate:Certificate cert arn:aws:acm:eu-central-1:123456789012:certificate/7e7a28d2-163f-4b8f-b9cd-822f96c08d6a\n```\n\n ",
             "properties": {
@@ -177668,6 +181368,10 @@
                     "type": "string",
                     "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dnsName": {
                     "type": "string",
                     "description": "The DNS name of the load balancer.\n"
@@ -177688,6 +181392,10 @@
                     "type": "boolean",
                     "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                 },
+                "enableWafFailOpen": {
+                    "type": "boolean",
+                    "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                },
                 "idleTimeout": {
                     "type": "integer",
                     "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -177740,7 +181448,7 @@
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 },
                 "tagsAll": {
                     "type": "object",
@@ -177780,6 +181488,10 @@
                     "type": "string",
                     "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dropInvalidHeaderFields": {
                     "type": "boolean",
                     "description": "Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.\n"
@@ -177796,6 +181508,10 @@
                     "type": "boolean",
                     "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                 },
+                "enableWafFailOpen": {
+                    "type": "boolean",
+                    "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                },
                 "idleTimeout": {
                     "type": "integer",
                     "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -177848,7 +181564,7 @@
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 }
             },
             "stateInputs": {
@@ -177870,6 +181586,10 @@
                         "type": "string",
                         "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string",
+                        "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                    },
                     "dnsName": {
                         "type": "string",
                         "description": "The DNS name of the load balancer.\n"
@@ -177890,6 +181610,10 @@
                         "type": "boolean",
                         "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                     },
+                    "enableWafFailOpen": {
+                        "type": "boolean",
+                        "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                    },
                     "idleTimeout": {
                         "type": "integer",
                         "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -177942,7 +181666,7 @@
                         "additionalProperties": {
                             "type": "string"
                         },
-                        "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                        "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                     },
                     "tagsAll": {
                         "type": "object",
@@ -185734,6 +189458,10 @@
                     "type": "string",
                     "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dnsName": {
                     "type": "string",
                     "description": "The DNS name of the load balancer.\n"
@@ -185754,6 +189482,10 @@
                     "type": "boolean",
                     "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                 },
+                "enableWafFailOpen": {
+                    "type": "boolean",
+                    "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                },
                 "idleTimeout": {
                     "type": "integer",
                     "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -185806,7 +189538,7 @@
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 },
                 "tagsAll": {
                     "type": "object",
@@ -185846,6 +189578,10 @@
                     "type": "string",
                     "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dropInvalidHeaderFields": {
                     "type": "boolean",
                     "description": "Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.\n"
@@ -185862,6 +189598,10 @@
                     "type": "boolean",
                     "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                 },
+                "enableWafFailOpen": {
+                    "type": "boolean",
+                    "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                },
                 "idleTimeout": {
                     "type": "integer",
                     "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -185914,7 +189654,7 @@
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 }
             },
             "stateInputs": {
@@ -185936,6 +189676,10 @@
                         "type": "string",
                         "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string",
+                        "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                    },
                     "dnsName": {
                         "type": "string",
                         "description": "The DNS name of the load balancer.\n"
@@ -185956,6 +189700,10 @@
                         "type": "boolean",
                         "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                     },
+                    "enableWafFailOpen": {
+                        "type": "boolean",
+                        "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                    },
                     "idleTimeout": {
                         "type": "integer",
                         "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -186008,7 +189756,7 @@
                         "additionalProperties": {
                             "type": "string"
                         },
-                        "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                        "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                     },
                     "tagsAll": {
                         "type": "object",
@@ -188222,6 +191970,51 @@
                 "type": "object"
             }
         },
+        "aws:appstream/fleetStackAssociation:FleetStackAssociation": {
+            "description": "Manages an AppStream Fleet Stack association.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst exampleFleet = new aws.appstream.Fleet(\"exampleFleet\", {\n    imageName: \"Amazon-AppStream2-Sample-Image-02-04-2019\",\n    instanceType: \"stream.standard.small\",\n    computeCapacity: {\n        desiredInstances: 1,\n    },\n});\nconst exampleStack = new aws.appstream.Stack(\"exampleStack\", {});\nconst exampleFleetStackAssociation = new aws.appstream.FleetStackAssociation(\"exampleFleetStackAssociation\", {\n    fleetName: exampleFleet.name,\n    stackName: exampleStack.name,\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample_fleet = aws.appstream.Fleet(\"exampleFleet\",\n    image_name=\"Amazon-AppStream2-Sample-Image-02-04-2019\",\n    instance_type=\"stream.standard.small\",\n    compute_capacity=aws.appstream.FleetComputeCapacityArgs(\n        desired_instances=1,\n    ))\nexample_stack = aws.appstream.Stack(\"exampleStack\")\nexample_fleet_stack_association = aws.appstream.FleetStackAssociation(\"exampleFleetStackAssociation\",\n    fleet_name=example_fleet.name,\n    stack_name=example_stack.name)\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var exampleFleet = new Aws.AppStream.Fleet(\"exampleFleet\", new Aws.AppStream.FleetArgs\n        {\n            ImageName = \"Amazon-AppStream2-Sample-Image-02-04-2019\",\n            InstanceType = \"stream.standard.small\",\n            ComputeCapacity = new Aws.AppStream.Inputs.FleetComputeCapacityArgs\n            {\n                DesiredInstances = 1,\n            },\n        });\n        var exampleStack = new Aws.AppStream.Stack(\"exampleStack\", new Aws.AppStream.StackArgs\n        {\n        });\n        var exampleFleetStackAssociation = new Aws.AppStream.FleetStackAssociation(\"exampleFleetStackAssociation\", new Aws.AppStream.FleetStackAssociationArgs\n        {\n            FleetName = exampleFleet.Name,\n            StackName = exampleStack.Name,\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/appstream\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texampleFleet, err := appstream.NewFleet(ctx, \"exampleFleet\", \u0026appstream.FleetArgs{\n\t\t\tImageName:    pulumi.String(\"Amazon-AppStream2-Sample-Image-02-04-2019\"),\n\t\t\tInstanceType: pulumi.String(\"stream.standard.small\"),\n\t\t\tComputeCapacity: \u0026appstream.FleetComputeCapacityArgs{\n\t\t\t\tDesiredInstances: pulumi.Int(1),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleStack, err := appstream.NewStack(ctx, \"exampleStack\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = appstream.NewFleetStackAssociation(ctx, \"exampleFleetStackAssociation\", \u0026appstream.FleetStackAssociationArgs{\n\t\t\tFleetName: exampleFleet.Name,\n\t\t\tStackName: exampleStack.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nAppStream Stack Fleet Association can be imported by using the `fleet_name` and `stack_name` separated by a slash (`/`), e.g.,\n\n```sh\n $ pulumi import aws:appstream/fleetStackAssociation:FleetStackAssociation example fleetName/stackName\n```\n\n ",
+            "properties": {
+                "fleetName": {
+                    "type": "string",
+                    "description": "Name of the fleet.\n"
+                },
+                "stackName": {
+                    "type": "string",
+                    "description": "Name of the stack.\n"
+                }
+            },
+            "required": [
+                "fleetName",
+                "stackName"
+            ],
+            "inputProperties": {
+                "fleetName": {
+                    "type": "string",
+                    "description": "Name of the fleet.\n"
+                },
+                "stackName": {
+                    "type": "string",
+                    "description": "Name of the stack.\n"
+                }
+            },
+            "requiredInputs": [
+                "fleetName",
+                "stackName"
+            ],
+            "stateInputs": {
+                "description": "Input properties used for looking up and filtering FleetStackAssociation resources.\n",
+                "properties": {
+                    "fleetName": {
+                        "type": "string",
+                        "description": "Name of the fleet.\n"
+                    },
+                    "stackName": {
+                        "type": "string",
+                        "description": "Name of the stack.\n"
+                    }
+                },
+                "type": "object"
+            }
+        },
         "aws:appstream/imageBuilder:ImageBuilder": {
             "description": "Provides an AppStream image builder.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst testFleet = new aws.appstream.ImageBuilder(\"testFleet\", {\n    description: \"Description of a ImageBuilder\",\n    displayName: \"Display name of a ImageBuilder\",\n    enableDefaultInternetAccess: false,\n    imageName: \"AppStream-WinServer2012R2-07-19-2021\",\n    instanceType: \"stream.standard.large\",\n    vpcConfig: {\n        subnetIds: [aws_subnet.example.id],\n    },\n    tags: {\n        Name: \"Example Image Builder\",\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ntest_fleet = aws.appstream.ImageBuilder(\"testFleet\",\n    description=\"Description of a ImageBuilder\",\n    display_name=\"Display name of a ImageBuilder\",\n    enable_default_internet_access=False,\n    image_name=\"AppStream-WinServer2012R2-07-19-2021\",\n    instance_type=\"stream.standard.large\",\n    vpc_config=aws.appstream.ImageBuilderVpcConfigArgs(\n        subnet_ids=[aws_subnet[\"example\"][\"id\"]],\n    ),\n    tags={\n        \"Name\": \"Example Image Builder\",\n    })\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var testFleet = new Aws.AppStream.ImageBuilder(\"testFleet\", new Aws.AppStream.ImageBuilderArgs\n        {\n            Description = \"Description of a ImageBuilder\",\n            DisplayName = \"Display name of a ImageBuilder\",\n            EnableDefaultInternetAccess = false,\n            ImageName = \"AppStream-WinServer2012R2-07-19-2021\",\n            InstanceType = \"stream.standard.large\",\n            VpcConfig = new Aws.AppStream.Inputs.ImageBuilderVpcConfigArgs\n            {\n                SubnetIds = \n                {\n                    aws_subnet.Example.Id,\n                },\n            },\n            Tags = \n            {\n                { \"Name\", \"Example Image Builder\" },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/appstream\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := appstream.NewImageBuilder(ctx, \"testFleet\", \u0026appstream.ImageBuilderArgs{\n\t\t\tDescription:                 pulumi.String(\"Description of a ImageBuilder\"),\n\t\t\tDisplayName:                 pulumi.String(\"Display name of a ImageBuilder\"),\n\t\t\tEnableDefaultInternetAccess: pulumi.Bool(false),\n\t\t\tImageName:                   pulumi.String(\"AppStream-WinServer2012R2-07-19-2021\"),\n\t\t\tInstanceType:                pulumi.String(\"stream.standard.large\"),\n\t\t\tVpcConfig: \u0026appstream.ImageBuilderVpcConfigArgs{\n\t\t\t\tSubnetIds: pulumi.StringArray{\n\t\t\t\t\tpulumi.Any(aws_subnet.Example.Id),\n\t\t\t\t},\n\t\t\t},\n\t\t\tTags: pulumi.StringMap{\n\t\t\t\t\"Name\": pulumi.String(\"Example Image Builder\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\n`aws_appstream_image_builder` can be imported using the `name`, e.g.,\n\n```sh\n $ pulumi import aws:appstream/imageBuilder:ImageBuilder example imageBuilderExample\n```\n\n ",
             "properties": {
@@ -188694,6 +192487,188 @@
                 "type": "object"
             }
         },
+        "aws:appstream/user:User": {
+            "description": "Provides an AppStream user.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.appstream.User(\"example\", {\n    authenticationType: \"USERPOOL\",\n    firstName: \"FIRST NAME\",\n    lastName: \"LAST NAME\",\n    userName: \"EMAIL ADDRESS\",\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.appstream.User(\"example\",\n    authentication_type=\"USERPOOL\",\n    first_name=\"FIRST NAME\",\n    last_name=\"LAST NAME\",\n    user_name=\"EMAIL ADDRESS\")\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.AppStream.User(\"example\", new Aws.AppStream.UserArgs\n        {\n            AuthenticationType = \"USERPOOL\",\n            FirstName = \"FIRST NAME\",\n            LastName = \"LAST NAME\",\n            UserName = \"EMAIL ADDRESS\",\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/appstream\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := appstream.NewUser(ctx, \"example\", \u0026appstream.UserArgs{\n\t\t\tAuthenticationType: pulumi.String(\"USERPOOL\"),\n\t\t\tFirstName:          pulumi.String(\"FIRST NAME\"),\n\t\t\tLastName:           pulumi.String(\"LAST NAME\"),\n\t\t\tUserName:           pulumi.String(\"EMAIL ADDRESS\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\n`aws_appstream_user` can be imported using the `user_name` and `authentication_type` separated by a slash (`/`), e.g.,\n\n```sh\n $ pulumi import aws:appstream/user:User example UserName/AuthenticationType\n```\n\n ",
+            "properties": {
+                "arn": {
+                    "type": "string",
+                    "description": "ARN of the appstream user.\n"
+                },
+                "authenticationType": {
+                    "type": "string",
+                    "description": "Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`\n"
+                },
+                "createdTime": {
+                    "type": "string",
+                    "description": "Date and time, in UTC and extended RFC 3339 format, when the user was created.\n"
+                },
+                "enabled": {
+                    "type": "boolean",
+                    "description": "Specifies whether the user in the user pool is enabled.\n"
+                },
+                "firstName": {
+                    "type": "string",
+                    "description": "First name, or given name, of the user.\n"
+                },
+                "lastName": {
+                    "type": "string",
+                    "description": "Last name, or surname, of the user.\n"
+                },
+                "sendEmailNotification": {
+                    "type": "boolean",
+                    "description": "Send an email notification.\n"
+                },
+                "userName": {
+                    "type": "string",
+                    "description": "Email address of the user.\n"
+                }
+            },
+            "required": [
+                "arn",
+                "authenticationType",
+                "createdTime",
+                "userName"
+            ],
+            "inputProperties": {
+                "authenticationType": {
+                    "type": "string",
+                    "description": "Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`\n"
+                },
+                "enabled": {
+                    "type": "boolean",
+                    "description": "Specifies whether the user in the user pool is enabled.\n"
+                },
+                "firstName": {
+                    "type": "string",
+                    "description": "First name, or given name, of the user.\n"
+                },
+                "lastName": {
+                    "type": "string",
+                    "description": "Last name, or surname, of the user.\n"
+                },
+                "sendEmailNotification": {
+                    "type": "boolean",
+                    "description": "Send an email notification.\n"
+                },
+                "userName": {
+                    "type": "string",
+                    "description": "Email address of the user.\n"
+                }
+            },
+            "requiredInputs": [
+                "authenticationType",
+                "userName"
+            ],
+            "stateInputs": {
+                "description": "Input properties used for looking up and filtering User resources.\n",
+                "properties": {
+                    "arn": {
+                        "type": "string",
+                        "description": "ARN of the appstream user.\n"
+                    },
+                    "authenticationType": {
+                        "type": "string",
+                        "description": "Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`\n"
+                    },
+                    "createdTime": {
+                        "type": "string",
+                        "description": "Date and time, in UTC and extended RFC 3339 format, when the user was created.\n"
+                    },
+                    "enabled": {
+                        "type": "boolean",
+                        "description": "Specifies whether the user in the user pool is enabled.\n"
+                    },
+                    "firstName": {
+                        "type": "string",
+                        "description": "First name, or given name, of the user.\n"
+                    },
+                    "lastName": {
+                        "type": "string",
+                        "description": "Last name, or surname, of the user.\n"
+                    },
+                    "sendEmailNotification": {
+                        "type": "boolean",
+                        "description": "Send an email notification.\n"
+                    },
+                    "userName": {
+                        "type": "string",
+                        "description": "Email address of the user.\n"
+                    }
+                },
+                "type": "object"
+            }
+        },
+        "aws:appstream/userStackAssociation:UserStackAssociation": {
+            "description": "Manages an AppStream User Stack association.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst testStack = new aws.appstream.Stack(\"testStack\", {});\nconst testUser = new aws.appstream.User(\"testUser\", {\n    authenticationType: \"USERPOOL\",\n    userName: \"EMAIL\",\n});\nconst testUserStackAssociation = new aws.appstream.UserStackAssociation(\"testUserStackAssociation\", {\n    authenticationType: testUser.authenticationType,\n    stackName: testStack.name,\n    userName: testUser.userName,\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ntest_stack = aws.appstream.Stack(\"testStack\")\ntest_user = aws.appstream.User(\"testUser\",\n    authentication_type=\"USERPOOL\",\n    user_name=\"EMAIL\")\ntest_user_stack_association = aws.appstream.UserStackAssociation(\"testUserStackAssociation\",\n    authentication_type=test_user.authentication_type,\n    stack_name=test_stack.name,\n    user_name=test_user.user_name)\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var testStack = new Aws.AppStream.Stack(\"testStack\", new Aws.AppStream.StackArgs\n        {\n        });\n        var testUser = new Aws.AppStream.User(\"testUser\", new Aws.AppStream.UserArgs\n        {\n            AuthenticationType = \"USERPOOL\",\n            UserName = \"EMAIL\",\n        });\n        var testUserStackAssociation = new Aws.AppStream.UserStackAssociation(\"testUserStackAssociation\", new Aws.AppStream.UserStackAssociationArgs\n        {\n            AuthenticationType = testUser.AuthenticationType,\n            StackName = testStack.Name,\n            UserName = testUser.UserName,\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/appstream\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttestStack, err := appstream.NewStack(ctx, \"testStack\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttestUser, err := appstream.NewUser(ctx, \"testUser\", \u0026appstream.UserArgs{\n\t\t\tAuthenticationType: pulumi.String(\"USERPOOL\"),\n\t\t\tUserName:           pulumi.String(\"EMAIL\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = appstream.NewUserStackAssociation(ctx, \"testUserStackAssociation\", \u0026appstream.UserStackAssociationArgs{\n\t\t\tAuthenticationType: testUser.AuthenticationType,\n\t\t\tStackName:          testStack.Name,\n\t\t\tUserName:           testUser.UserName,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nAppStream User Stack Association can be imported by using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`), e.g.,\n\n```sh\n $ pulumi import aws:appstream/userStackAssociation:UserStackAssociation example userName/auhtenticationType/stackName\n```\n\n ",
+            "properties": {
+                "authenticationType": {
+                    "type": "string",
+                    "description": "Authentication type for the user.\n"
+                },
+                "sendEmailNotification": {
+                    "type": "boolean",
+                    "description": "Specifies whether a welcome email is sent to a user after the user is created in the user pool.\n"
+                },
+                "stackName": {
+                    "type": "string",
+                    "description": "Name of the stack that is associated with the user.\n"
+                },
+                "userName": {
+                    "type": "string",
+                    "description": "Email address of the user who is associated with the stack.\n"
+                }
+            },
+            "required": [
+                "authenticationType",
+                "stackName",
+                "userName"
+            ],
+            "inputProperties": {
+                "authenticationType": {
+                    "type": "string",
+                    "description": "Authentication type for the user.\n"
+                },
+                "sendEmailNotification": {
+                    "type": "boolean",
+                    "description": "Specifies whether a welcome email is sent to a user after the user is created in the user pool.\n"
+                },
+                "stackName": {
+                    "type": "string",
+                    "description": "Name of the stack that is associated with the user.\n"
+                },
+                "userName": {
+                    "type": "string",
+                    "description": "Email address of the user who is associated with the stack.\n"
+                }
+            },
+            "requiredInputs": [
+                "authenticationType",
+                "stackName",
+                "userName"
+            ],
+            "stateInputs": {
+                "description": "Input properties used for looking up and filtering UserStackAssociation resources.\n",
+                "properties": {
+                    "authenticationType": {
+                        "type": "string",
+                        "description": "Authentication type for the user.\n"
+                    },
+                    "sendEmailNotification": {
+                        "type": "boolean",
+                        "description": "Specifies whether a welcome email is sent to a user after the user is created in the user pool.\n"
+                    },
+                    "stackName": {
+                        "type": "string",
+                        "description": "Name of the stack that is associated with the user.\n"
+                    },
+                    "userName": {
+                        "type": "string",
+                        "description": "Email address of the user who is associated with the stack.\n"
+                    }
+                },
+                "type": "object"
+            }
+        },
         "aws:appsync/apiKey:ApiKey": {
             "description": "Provides an AppSync API Key.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst exampleGraphQLApi = new aws.appsync.GraphQLApi(\"exampleGraphQLApi\", {authenticationType: \"API_KEY\"});\nconst exampleApiKey = new aws.appsync.ApiKey(\"exampleApiKey\", {\n    apiId: exampleGraphQLApi.id,\n    expires: \"2018-05-03T04:00:00Z\",\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample_graph_ql_api = aws.appsync.GraphQLApi(\"exampleGraphQLApi\", authentication_type=\"API_KEY\")\nexample_api_key = aws.appsync.ApiKey(\"exampleApiKey\",\n    api_id=example_graph_ql_api.id,\n    expires=\"2018-05-03T04:00:00Z\")\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var exampleGraphQLApi = new Aws.AppSync.GraphQLApi(\"exampleGraphQLApi\", new Aws.AppSync.GraphQLApiArgs\n        {\n            AuthenticationType = \"API_KEY\",\n        });\n        var exampleApiKey = new Aws.AppSync.ApiKey(\"exampleApiKey\", new Aws.AppSync.ApiKeyArgs\n        {\n            ApiId = exampleGraphQLApi.Id,\n            Expires = \"2018-05-03T04:00:00Z\",\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/appsync\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texampleGraphQLApi, err := appsync.NewGraphQLApi(ctx, \"exampleGraphQLApi\", \u0026appsync.GraphQLApiArgs{\n\t\t\tAuthenticationType: pulumi.String(\"API_KEY\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = appsync.NewApiKey(ctx, \"exampleApiKey\", \u0026appsync.ApiKeyArgs{\n\t\t\tApiId:   exampleGraphQLApi.ID(),\n\t\t\tExpires: pulumi.String(\"2018-05-03T04:00:00Z\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\n`aws_appsync_api_key` can be imported using the AppSync API ID and key separated by `:`, e.g.,\n\n```sh\n $ pulumi import aws:appsync/apiKey:ApiKey example xxxxx:yyyyy\n```\n\n ",
             "properties": {
@@ -193399,34 +197374,50 @@
             }
         },
         "aws:cfg/remediationConfiguration:RemediationConfiguration": {
-            "description": "Provides an AWS Config Remediation Configuration.\n\n\u003e **Note:** Config Remediation Configuration requires an existing Config Rule to be present.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\nAWS managed rules can be used by setting the source owner to `AWS` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst thisRule = new aws.cfg.Rule(\"thisRule\", {source: {\n    owner: \"AWS\",\n    sourceIdentifier: \"S3_BUCKET_VERSIONING_ENABLED\",\n}});\nconst thisRemediationConfiguration = new aws.cfg.RemediationConfiguration(\"thisRemediationConfiguration\", {\n    configRuleName: thisRule.name,\n    resourceType: \"AWS::S3::Bucket\",\n    targetType: \"SSM_DOCUMENT\",\n    targetId: \"AWS-EnableS3BucketEncryption\",\n    targetVersion: \"1\",\n    parameters: [\n        {\n            name: \"AutomationAssumeRole\",\n            staticValue: \"arn:aws:iam::875924563244:role/security_config\",\n        },\n        {\n            name: \"BucketName\",\n            resourceValue: \"RESOURCE_ID\",\n        },\n        {\n            name: \"SSEAlgorithm\",\n            staticValue: \"AES256\",\n        },\n    ],\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nthis_rule = aws.cfg.Rule(\"thisRule\", source=aws.cfg.RuleSourceArgs(\n    owner=\"AWS\",\n    source_identifier=\"S3_BUCKET_VERSIONING_ENABLED\",\n))\nthis_remediation_configuration = aws.cfg.RemediationConfiguration(\"thisRemediationConfiguration\",\n    config_rule_name=this_rule.name,\n    resource_type=\"AWS::S3::Bucket\",\n    target_type=\"SSM_DOCUMENT\",\n    target_id=\"AWS-EnableS3BucketEncryption\",\n    target_version=\"1\",\n    parameters=[\n        aws.cfg.RemediationConfigurationParameterArgs(\n            name=\"AutomationAssumeRole\",\n            static_value=\"arn:aws:iam::875924563244:role/security_config\",\n        ),\n        aws.cfg.RemediationConfigurationParameterArgs(\n            name=\"BucketName\",\n            resource_value=\"RESOURCE_ID\",\n        ),\n        aws.cfg.RemediationConfigurationParameterArgs(\n            name=\"SSEAlgorithm\",\n            static_value=\"AES256\",\n        ),\n    ])\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var thisRule = new Aws.Cfg.Rule(\"thisRule\", new Aws.Cfg.RuleArgs\n        {\n            Source = new Aws.Cfg.Inputs.RuleSourceArgs\n            {\n                Owner = \"AWS\",\n                SourceIdentifier = \"S3_BUCKET_VERSIONING_ENABLED\",\n            },\n        });\n        var thisRemediationConfiguration = new Aws.Cfg.RemediationConfiguration(\"thisRemediationConfiguration\", new Aws.Cfg.RemediationConfigurationArgs\n        {\n            ConfigRuleName = thisRule.Name,\n            ResourceType = \"AWS::S3::Bucket\",\n            TargetType = \"SSM_DOCUMENT\",\n            TargetId = \"AWS-EnableS3BucketEncryption\",\n            TargetVersion = \"1\",\n            Parameters = \n            {\n                new Aws.Cfg.Inputs.RemediationConfigurationParameterArgs\n                {\n                    Name = \"AutomationAssumeRole\",\n                    StaticValue = \"arn:aws:iam::875924563244:role/security_config\",\n                },\n                new Aws.Cfg.Inputs.RemediationConfigurationParameterArgs\n                {\n                    Name = \"BucketName\",\n                    ResourceValue = \"RESOURCE_ID\",\n                },\n                new Aws.Cfg.Inputs.RemediationConfigurationParameterArgs\n                {\n                    Name = \"SSEAlgorithm\",\n                    StaticValue = \"AES256\",\n                },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/cfg\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tthisRule, err := cfg.NewRule(ctx, \"thisRule\", \u0026cfg.RuleArgs{\n\t\t\tSource: \u0026cfg.RuleSourceArgs{\n\t\t\t\tOwner:            pulumi.String(\"AWS\"),\n\t\t\t\tSourceIdentifier: pulumi.String(\"S3_BUCKET_VERSIONING_ENABLED\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = cfg.NewRemediationConfiguration(ctx, \"thisRemediationConfiguration\", \u0026cfg.RemediationConfigurationArgs{\n\t\t\tConfigRuleName: thisRule.Name,\n\t\t\tResourceType:   pulumi.String(\"AWS::S3::Bucket\"),\n\t\t\tTargetType:     pulumi.String(\"SSM_DOCUMENT\"),\n\t\t\tTargetId:       pulumi.String(\"AWS-EnableS3BucketEncryption\"),\n\t\t\tTargetVersion:  pulumi.String(\"1\"),\n\t\t\tParameters: cfg.RemediationConfigurationParameterArray{\n\t\t\t\t\u0026cfg.RemediationConfigurationParameterArgs{\n\t\t\t\t\tName:        pulumi.String(\"AutomationAssumeRole\"),\n\t\t\t\t\tStaticValue: pulumi.String(\"arn:aws:iam::875924563244:role/security_config\"),\n\t\t\t\t},\n\t\t\t\t\u0026cfg.RemediationConfigurationParameterArgs{\n\t\t\t\t\tName:          pulumi.String(\"BucketName\"),\n\t\t\t\t\tResourceValue: pulumi.String(\"RESOURCE_ID\"),\n\t\t\t\t},\n\t\t\t\t\u0026cfg.RemediationConfigurationParameterArgs{\n\t\t\t\t\tName:        pulumi.String(\"SSEAlgorithm\"),\n\t\t\t\t\tStaticValue: pulumi.String(\"AES256\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nRemediation Configurations can be imported using the name config_rule_name, e.g.,\n\n```sh\n $ pulumi import aws:cfg/remediationConfiguration:RemediationConfiguration this example\n```\n\n ",
+            "description": "Provides an AWS Config Remediation Configuration.\n\n\u003e **Note:** Config Remediation Configuration requires an existing Config Rule to be present.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\nAWS managed rules can be used by setting the source owner to `AWS` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst thisRule = new aws.cfg.Rule(\"thisRule\", {source: {\n    owner: \"AWS\",\n    sourceIdentifier: \"S3_BUCKET_VERSIONING_ENABLED\",\n}});\nconst thisRemediationConfiguration = new aws.cfg.RemediationConfiguration(\"thisRemediationConfiguration\", {\n    configRuleName: thisRule.name,\n    resourceType: \"AWS::S3::Bucket\",\n    targetType: \"SSM_DOCUMENT\",\n    targetId: \"AWS-EnableS3BucketEncryption\",\n    targetVersion: \"1\",\n    parameters: [\n        {\n            name: \"AutomationAssumeRole\",\n            staticValue: \"arn:aws:iam::875924563244:role/security_config\",\n        },\n        {\n            name: \"BucketName\",\n            resourceValue: \"RESOURCE_ID\",\n        },\n        {\n            name: \"SSEAlgorithm\",\n            staticValue: \"AES256\",\n        },\n    ],\n    automatic: true,\n    maximumAutomaticAttempts: 10,\n    retryAttemptSeconds: 600,\n    executionControls: {\n        ssmControls: {\n            concurrentExecutionRatePercentage: 25,\n            errorPercentage: 20,\n        },\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nthis_rule = aws.cfg.Rule(\"thisRule\", source=aws.cfg.RuleSourceArgs(\n    owner=\"AWS\",\n    source_identifier=\"S3_BUCKET_VERSIONING_ENABLED\",\n))\nthis_remediation_configuration = aws.cfg.RemediationConfiguration(\"thisRemediationConfiguration\",\n    config_rule_name=this_rule.name,\n    resource_type=\"AWS::S3::Bucket\",\n    target_type=\"SSM_DOCUMENT\",\n    target_id=\"AWS-EnableS3BucketEncryption\",\n    target_version=\"1\",\n    parameters=[\n        aws.cfg.RemediationConfigurationParameterArgs(\n            name=\"AutomationAssumeRole\",\n            static_value=\"arn:aws:iam::875924563244:role/security_config\",\n        ),\n        aws.cfg.RemediationConfigurationParameterArgs(\n            name=\"BucketName\",\n            resource_value=\"RESOURCE_ID\",\n        ),\n        aws.cfg.RemediationConfigurationParameterArgs(\n            name=\"SSEAlgorithm\",\n            static_value=\"AES256\",\n        ),\n    ],\n    automatic=True,\n    maximum_automatic_attempts=10,\n    retry_attempt_seconds=600,\n    execution_controls=aws.cfg.RemediationConfigurationExecutionControlsArgs(\n        ssm_controls=aws.cfg.RemediationConfigurationExecutionControlsSsmControlsArgs(\n            concurrent_execution_rate_percentage=25,\n            error_percentage=20,\n        ),\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var thisRule = new Aws.Cfg.Rule(\"thisRule\", new Aws.Cfg.RuleArgs\n        {\n            Source = new Aws.Cfg.Inputs.RuleSourceArgs\n            {\n                Owner = \"AWS\",\n                SourceIdentifier = \"S3_BUCKET_VERSIONING_ENABLED\",\n            },\n        });\n        var thisRemediationConfiguration = new Aws.Cfg.RemediationConfiguration(\"thisRemediationConfiguration\", new Aws.Cfg.RemediationConfigurationArgs\n        {\n            ConfigRuleName = thisRule.Name,\n            ResourceType = \"AWS::S3::Bucket\",\n            TargetType = \"SSM_DOCUMENT\",\n            TargetId = \"AWS-EnableS3BucketEncryption\",\n            TargetVersion = \"1\",\n            Parameters = \n            {\n                new Aws.Cfg.Inputs.RemediationConfigurationParameterArgs\n                {\n                    Name = \"AutomationAssumeRole\",\n                    StaticValue = \"arn:aws:iam::875924563244:role/security_config\",\n                },\n                new Aws.Cfg.Inputs.RemediationConfigurationParameterArgs\n                {\n                    Name = \"BucketName\",\n                    ResourceValue = \"RESOURCE_ID\",\n                },\n                new Aws.Cfg.Inputs.RemediationConfigurationParameterArgs\n                {\n                    Name = \"SSEAlgorithm\",\n                    StaticValue = \"AES256\",\n                },\n            },\n            Automatic = true,\n            MaximumAutomaticAttempts = 10,\n            RetryAttemptSeconds = 600,\n            ExecutionControls = new Aws.Cfg.Inputs.RemediationConfigurationExecutionControlsArgs\n            {\n                SsmControls = new Aws.Cfg.Inputs.RemediationConfigurationExecutionControlsSsmControlsArgs\n                {\n                    ConcurrentExecutionRatePercentage = 25,\n                    ErrorPercentage = 20,\n                },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/cfg\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tthisRule, err := cfg.NewRule(ctx, \"thisRule\", \u0026cfg.RuleArgs{\n\t\t\tSource: \u0026cfg.RuleSourceArgs{\n\t\t\t\tOwner:            pulumi.String(\"AWS\"),\n\t\t\t\tSourceIdentifier: pulumi.String(\"S3_BUCKET_VERSIONING_ENABLED\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = cfg.NewRemediationConfiguration(ctx, \"thisRemediationConfiguration\", \u0026cfg.RemediationConfigurationArgs{\n\t\t\tConfigRuleName: thisRule.Name,\n\t\t\tResourceType:   pulumi.String(\"AWS::S3::Bucket\"),\n\t\t\tTargetType:     pulumi.String(\"SSM_DOCUMENT\"),\n\t\t\tTargetId:       pulumi.String(\"AWS-EnableS3BucketEncryption\"),\n\t\t\tTargetVersion:  pulumi.String(\"1\"),\n\t\t\tParameters: cfg.RemediationConfigurationParameterArray{\n\t\t\t\t\u0026cfg.RemediationConfigurationParameterArgs{\n\t\t\t\t\tName:        pulumi.String(\"AutomationAssumeRole\"),\n\t\t\t\t\tStaticValue: pulumi.String(\"arn:aws:iam::875924563244:role/security_config\"),\n\t\t\t\t},\n\t\t\t\t\u0026cfg.RemediationConfigurationParameterArgs{\n\t\t\t\t\tName:          pulumi.String(\"BucketName\"),\n\t\t\t\t\tResourceValue: pulumi.String(\"RESOURCE_ID\"),\n\t\t\t\t},\n\t\t\t\t\u0026cfg.RemediationConfigurationParameterArgs{\n\t\t\t\t\tName:        pulumi.String(\"SSEAlgorithm\"),\n\t\t\t\t\tStaticValue: pulumi.String(\"AES256\"),\n\t\t\t\t},\n\t\t\t},\n\t\t\tAutomatic:                pulumi.Bool(true),\n\t\t\tMaximumAutomaticAttempts: pulumi.Int(10),\n\t\t\tRetryAttemptSeconds:      pulumi.Int(600),\n\t\t\tExecutionControls: \u0026cfg.RemediationConfigurationExecutionControlsArgs{\n\t\t\t\tSsmControls: \u0026cfg.RemediationConfigurationExecutionControlsSsmControlsArgs{\n\t\t\t\t\tConcurrentExecutionRatePercentage: pulumi.Int(25),\n\t\t\t\t\tErrorPercentage:                   pulumi.Int(20),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nRemediation Configurations can be imported using the name config_rule_name, e.g.,\n\n```sh\n $ pulumi import aws:cfg/remediationConfiguration:RemediationConfiguration this example\n```\n\n ",
             "properties": {
                 "arn": {
                     "type": "string",
-                    "description": "Amazon Resource Name (ARN) of the Config Remediation Configuration.\n"
+                    "description": "ARN of the Config Remediation Configuration.\n"
+                },
+                "automatic": {
+                    "type": "boolean",
+                    "description": "Remediation is triggered automatically if `true`.\n"
                 },
                 "configRuleName": {
                     "type": "string",
-                    "description": "The name of the AWS Config rule\n"
+                    "description": "Name of the AWS Config rule.\n"
+                },
+                "executionControls": {
+                    "$ref": "#/types/aws:cfg/RemediationConfigurationExecutionControls:RemediationConfigurationExecutionControls",
+                    "description": "Configuration block for execution controls. See below.\n"
+                },
+                "maximumAutomaticAttempts": {
+                    "type": "integer",
+                    "description": "Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.\n"
                 },
                 "parameters": {
                     "type": "array",
                     "items": {
                         "$ref": "#/types/aws:cfg/RemediationConfigurationParameter:RemediationConfigurationParameter"
                     },
-                    "description": "Can be specified multiple times for each\nparameter. Each parameter block supports fields documented below.\n"
+                    "description": "Can be specified multiple times for each parameter. Each parameter block supports arguments below.\n"
                 },
                 "resourceType": {
                     "type": "string",
-                    "description": "The type of a resource\n"
+                    "description": "Type of resource.\n"
+                },
+                "retryAttemptSeconds": {
+                    "type": "integer",
+                    "description": "Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.\n"
                 },
                 "targetId": {
                     "type": "string",
-                    "description": "Target ID is the name of the public document\n"
+                    "description": "Target ID is the name of the public document.\n"
                 },
                 "targetType": {
                     "type": "string",
-                    "description": "The type of the target. Target executes remediation. For example, SSM document\n"
+                    "description": "Type of the target. Target executes remediation. For example, SSM document.\n"
                 },
                 "targetVersion": {
                     "type": "string",
@@ -193440,28 +197431,44 @@
                 "targetType"
             ],
             "inputProperties": {
+                "automatic": {
+                    "type": "boolean",
+                    "description": "Remediation is triggered automatically if `true`.\n"
+                },
                 "configRuleName": {
                     "type": "string",
-                    "description": "The name of the AWS Config rule\n"
+                    "description": "Name of the AWS Config rule.\n"
+                },
+                "executionControls": {
+                    "$ref": "#/types/aws:cfg/RemediationConfigurationExecutionControls:RemediationConfigurationExecutionControls",
+                    "description": "Configuration block for execution controls. See below.\n"
+                },
+                "maximumAutomaticAttempts": {
+                    "type": "integer",
+                    "description": "Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.\n"
                 },
                 "parameters": {
                     "type": "array",
                     "items": {
                         "$ref": "#/types/aws:cfg/RemediationConfigurationParameter:RemediationConfigurationParameter"
                     },
-                    "description": "Can be specified multiple times for each\nparameter. Each parameter block supports fields documented below.\n"
+                    "description": "Can be specified multiple times for each parameter. Each parameter block supports arguments below.\n"
                 },
                 "resourceType": {
                     "type": "string",
-                    "description": "The type of a resource\n"
+                    "description": "Type of resource.\n"
+                },
+                "retryAttemptSeconds": {
+                    "type": "integer",
+                    "description": "Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.\n"
                 },
                 "targetId": {
                     "type": "string",
-                    "description": "Target ID is the name of the public document\n"
+                    "description": "Target ID is the name of the public document.\n"
                 },
                 "targetType": {
                     "type": "string",
-                    "description": "The type of the target. Target executes remediation. For example, SSM document\n"
+                    "description": "Type of the target. Target executes remediation. For example, SSM document.\n"
                 },
                 "targetVersion": {
                     "type": "string",
@@ -193478,30 +197485,46 @@
                 "properties": {
                     "arn": {
                         "type": "string",
-                        "description": "Amazon Resource Name (ARN) of the Config Remediation Configuration.\n"
+                        "description": "ARN of the Config Remediation Configuration.\n"
+                    },
+                    "automatic": {
+                        "type": "boolean",
+                        "description": "Remediation is triggered automatically if `true`.\n"
                     },
                     "configRuleName": {
                         "type": "string",
-                        "description": "The name of the AWS Config rule\n"
+                        "description": "Name of the AWS Config rule.\n"
+                    },
+                    "executionControls": {
+                        "$ref": "#/types/aws:cfg/RemediationConfigurationExecutionControls:RemediationConfigurationExecutionControls",
+                        "description": "Configuration block for execution controls. See below.\n"
+                    },
+                    "maximumAutomaticAttempts": {
+                        "type": "integer",
+                        "description": "Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.\n"
                     },
                     "parameters": {
                         "type": "array",
                         "items": {
                             "$ref": "#/types/aws:cfg/RemediationConfigurationParameter:RemediationConfigurationParameter"
                         },
-                        "description": "Can be specified multiple times for each\nparameter. Each parameter block supports fields documented below.\n"
+                        "description": "Can be specified multiple times for each parameter. Each parameter block supports arguments below.\n"
                     },
                     "resourceType": {
                         "type": "string",
-                        "description": "The type of a resource\n"
+                        "description": "Type of resource.\n"
+                    },
+                    "retryAttemptSeconds": {
+                        "type": "integer",
+                        "description": "Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.\n"
                     },
                     "targetId": {
                         "type": "string",
-                        "description": "Target ID is the name of the public document\n"
+                        "description": "Target ID is the name of the public document.\n"
                     },
                     "targetType": {
                         "type": "string",
-                        "description": "The type of the target. Target executes remediation. For example, SSM document\n"
+                        "description": "Type of the target. Target executes remediation. For example, SSM document.\n"
                     },
                     "targetVersion": {
                         "type": "string",
@@ -208241,7 +212264,7 @@
             }
         },
         "aws:dlm/lifecyclePolicy:LifecyclePolicy": {
-            "description": "Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst dlmLifecycleRole = new aws.iam.Role(\"dlmLifecycleRole\", {assumeRolePolicy: `{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"dlm.amazonaws.com\"\n      },\n      \"Effect\": \"Allow\",\n      \"Sid\": \"\"\n    }\n  ]\n}\n`});\nconst dlmLifecycle = new aws.iam.RolePolicy(\"dlmLifecycle\", {\n    role: dlmLifecycleRole.id,\n    policy: `{\n   \"Version\": \"2012-10-17\",\n   \"Statement\": [\n      {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n            \"ec2:CreateSnapshot\",\n            \"ec2:CreateSnapshots\",\n            \"ec2:DeleteSnapshot\",\n            \"ec2:DescribeInstances\",\n            \"ec2:DescribeVolumes\",\n            \"ec2:DescribeSnapshots\"\n         ],\n         \"Resource\": \"*\"\n      },\n      {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n            \"ec2:CreateTags\"\n         ],\n         \"Resource\": \"arn:aws:ec2:*::snapshot/*\"\n      }\n   ]\n}\n`,\n});\nconst example = new aws.dlm.LifecyclePolicy(\"example\", {\n    description: \"example DLM lifecycle policy\",\n    executionRoleArn: dlmLifecycleRole.arn,\n    state: \"ENABLED\",\n    policyDetails: {\n        resourceTypes: [\"VOLUME\"],\n        schedules: [{\n            name: \"2 weeks of daily snapshots\",\n            createRule: {\n                interval: 24,\n                intervalUnit: \"HOURS\",\n                times: [\"23:45\"],\n            },\n            retainRule: {\n                count: 14,\n            },\n            tagsToAdd: {\n                SnapshotCreator: \"DLM\",\n            },\n            copyTags: false,\n        }],\n        targetTags: {\n            Snapshot: \"true\",\n        },\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ndlm_lifecycle_role = aws.iam.Role(\"dlmLifecycleRole\", assume_role_policy=\"\"\"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"dlm.amazonaws.com\"\n      },\n      \"Effect\": \"Allow\",\n      \"Sid\": \"\"\n    }\n  ]\n}\n\"\"\")\ndlm_lifecycle = aws.iam.RolePolicy(\"dlmLifecycle\",\n    role=dlm_lifecycle_role.id,\n    policy=\"\"\"{\n   \"Version\": \"2012-10-17\",\n   \"Statement\": [\n      {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n            \"ec2:CreateSnapshot\",\n            \"ec2:CreateSnapshots\",\n            \"ec2:DeleteSnapshot\",\n            \"ec2:DescribeInstances\",\n            \"ec2:DescribeVolumes\",\n            \"ec2:DescribeSnapshots\"\n         ],\n         \"Resource\": \"*\"\n      },\n      {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n            \"ec2:CreateTags\"\n         ],\n         \"Resource\": \"arn:aws:ec2:*::snapshot/*\"\n      }\n   ]\n}\n\"\"\")\nexample = aws.dlm.LifecyclePolicy(\"example\",\n    description=\"example DLM lifecycle policy\",\n    execution_role_arn=dlm_lifecycle_role.arn,\n    state=\"ENABLED\",\n    policy_details=aws.dlm.LifecyclePolicyPolicyDetailsArgs(\n        resource_types=[\"VOLUME\"],\n        schedules=[aws.dlm.LifecyclePolicyPolicyDetailsScheduleArgs(\n            name=\"2 weeks of daily snapshots\",\n            create_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs(\n                interval=24,\n                interval_unit=\"HOURS\",\n                times=[\"23:45\"],\n            ),\n            retain_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs(\n                count=14,\n            ),\n            tags_to_add={\n                \"SnapshotCreator\": \"DLM\",\n            },\n            copy_tags=False,\n        )],\n        target_tags={\n            \"Snapshot\": \"true\",\n        },\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var dlmLifecycleRole = new Aws.Iam.Role(\"dlmLifecycleRole\", new Aws.Iam.RoleArgs\n        {\n            AssumeRolePolicy = @\"{\n  \"\"Version\"\": \"\"2012-10-17\"\",\n  \"\"Statement\"\": [\n    {\n      \"\"Action\"\": \"\"sts:AssumeRole\"\",\n      \"\"Principal\"\": {\n        \"\"Service\"\": \"\"dlm.amazonaws.com\"\"\n      },\n      \"\"Effect\"\": \"\"Allow\"\",\n      \"\"Sid\"\": \"\"\"\"\n    }\n  ]\n}\n\",\n        });\n        var dlmLifecycle = new Aws.Iam.RolePolicy(\"dlmLifecycle\", new Aws.Iam.RolePolicyArgs\n        {\n            Role = dlmLifecycleRole.Id,\n            Policy = @\"{\n   \"\"Version\"\": \"\"2012-10-17\"\",\n   \"\"Statement\"\": [\n      {\n         \"\"Effect\"\": \"\"Allow\"\",\n         \"\"Action\"\": [\n            \"\"ec2:CreateSnapshot\"\",\n            \"\"ec2:CreateSnapshots\"\",\n            \"\"ec2:DeleteSnapshot\"\",\n            \"\"ec2:DescribeInstances\"\",\n            \"\"ec2:DescribeVolumes\"\",\n            \"\"ec2:DescribeSnapshots\"\"\n         ],\n         \"\"Resource\"\": \"\"*\"\"\n      },\n      {\n         \"\"Effect\"\": \"\"Allow\"\",\n         \"\"Action\"\": [\n            \"\"ec2:CreateTags\"\"\n         ],\n         \"\"Resource\"\": \"\"arn:aws:ec2:*::snapshot/*\"\"\n      }\n   ]\n}\n\",\n        });\n        var example = new Aws.Dlm.LifecyclePolicy(\"example\", new Aws.Dlm.LifecyclePolicyArgs\n        {\n            Description = \"example DLM lifecycle policy\",\n            ExecutionRoleArn = dlmLifecycleRole.Arn,\n            State = \"ENABLED\",\n            PolicyDetails = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsArgs\n            {\n                ResourceTypes = \n                {\n                    \"VOLUME\",\n                },\n                Schedules = \n                {\n                    new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleArgs\n                    {\n                        Name = \"2 weeks of daily snapshots\",\n                        CreateRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs\n                        {\n                            Interval = 24,\n                            IntervalUnit = \"HOURS\",\n                            Times = \n                            {\n                                \"23:45\",\n                            },\n                        },\n                        RetainRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs\n                        {\n                            Count = 14,\n                        },\n                        TagsToAdd = \n                        {\n                            { \"SnapshotCreator\", \"DLM\" },\n                        },\n                        CopyTags = false,\n                    },\n                },\n                TargetTags = \n                {\n                    { \"Snapshot\", \"true\" },\n                },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/dlm\"\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/iam\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tdlmLifecycleRole, err := iam.NewRole(ctx, \"dlmLifecycleRole\", \u0026iam.RoleArgs{\n\t\t\tAssumeRolePolicy: pulumi.Any(fmt.Sprintf(\"%v%v%v%v%v%v%v%v%v%v%v%v%v\", \"{\\n\", \"  \\\"Version\\\": \\\"2012-10-17\\\",\\n\", \"  \\\"Statement\\\": [\\n\", \"    {\\n\", \"      \\\"Action\\\": \\\"sts:AssumeRole\\\",\\n\", \"      \\\"Principal\\\": {\\n\", \"        \\\"Service\\\": \\\"dlm.amazonaws.com\\\"\\n\", \"      },\\n\", \"      \\\"Effect\\\": \\\"Allow\\\",\\n\", \"      \\\"Sid\\\": \\\"\\\"\\n\", \"    }\\n\", \"  ]\\n\", \"}\\n\")),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = iam.NewRolePolicy(ctx, \"dlmLifecycle\", \u0026iam.RolePolicyArgs{\n\t\t\tRole:   dlmLifecycleRole.ID(),\n\t\t\tPolicy: pulumi.Any(fmt.Sprintf(\"%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v\", \"{\\n\", \"   \\\"Version\\\": \\\"2012-10-17\\\",\\n\", \"   \\\"Statement\\\": [\\n\", \"      {\\n\", \"         \\\"Effect\\\": \\\"Allow\\\",\\n\", \"         \\\"Action\\\": [\\n\", \"            \\\"ec2:CreateSnapshot\\\",\\n\", \"            \\\"ec2:CreateSnapshots\\\",\\n\", \"            \\\"ec2:DeleteSnapshot\\\",\\n\", \"            \\\"ec2:DescribeInstances\\\",\\n\", \"            \\\"ec2:DescribeVolumes\\\",\\n\", \"            \\\"ec2:DescribeSnapshots\\\"\\n\", \"         ],\\n\", \"         \\\"Resource\\\": \\\"*\\\"\\n\", \"      },\\n\", \"      {\\n\", \"         \\\"Effect\\\": \\\"Allow\\\",\\n\", \"         \\\"Action\\\": [\\n\", \"            \\\"ec2:CreateTags\\\"\\n\", \"         ],\\n\", \"         \\\"Resource\\\": \\\"arn:aws:ec2:*::snapshot/*\\\"\\n\", \"      }\\n\", \"   ]\\n\", \"}\\n\")),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = dlm.NewLifecyclePolicy(ctx, \"example\", \u0026dlm.LifecyclePolicyArgs{\n\t\t\tDescription:      pulumi.String(\"example DLM lifecycle policy\"),\n\t\t\tExecutionRoleArn: dlmLifecycleRole.Arn,\n\t\t\tState:            pulumi.String(\"ENABLED\"),\n\t\t\tPolicyDetails: \u0026dlm.LifecyclePolicyPolicyDetailsArgs{\n\t\t\t\tResourceTypes: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"VOLUME\"),\n\t\t\t\t},\n\t\t\t\tSchedules: dlm.LifecyclePolicyPolicyDetailsScheduleArray{\n\t\t\t\t\t\u0026dlm.LifecyclePolicyPolicyDetailsScheduleArgs{\n\t\t\t\t\t\tName: pulumi.String(\"2 weeks of daily snapshots\"),\n\t\t\t\t\t\tCreateRule: \u0026dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs{\n\t\t\t\t\t\t\tInterval:     pulumi.Int(24),\n\t\t\t\t\t\t\tIntervalUnit: pulumi.String(\"HOURS\"),\n\t\t\t\t\t\t\tTimes: pulumi.String{\n\t\t\t\t\t\t\t\t\"23:45\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t\tRetainRule: \u0026dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs{\n\t\t\t\t\t\t\tCount: pulumi.Int(14),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tTagsToAdd: pulumi.StringMap{\n\t\t\t\t\t\t\t\"SnapshotCreator\": pulumi.String(\"DLM\"),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tCopyTags: pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tTargetTags: pulumi.StringMap{\n\t\t\t\t\t\"Snapshot\": pulumi.String(\"true\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nDLM lifecyle policies can be imported by their policy ID\n\n```sh\n $ pulumi import aws:dlm/lifecyclePolicy:LifecyclePolicy example policy-abcdef12345678901\n```\n\n ",
+            "description": "Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n### Basic\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst dlmLifecycleRole = new aws.iam.Role(\"dlmLifecycleRole\", {assumeRolePolicy: `{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"dlm.amazonaws.com\"\n      },\n      \"Effect\": \"Allow\",\n      \"Sid\": \"\"\n    }\n  ]\n}\n`});\nconst dlmLifecycle = new aws.iam.RolePolicy(\"dlmLifecycle\", {\n    role: dlmLifecycleRole.id,\n    policy: `{\n   \"Version\": \"2012-10-17\",\n   \"Statement\": [\n      {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n            \"ec2:CreateSnapshot\",\n            \"ec2:CreateSnapshots\",\n            \"ec2:DeleteSnapshot\",\n            \"ec2:DescribeInstances\",\n            \"ec2:DescribeVolumes\",\n            \"ec2:DescribeSnapshots\"\n         ],\n         \"Resource\": \"*\"\n      },\n      {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n            \"ec2:CreateTags\"\n         ],\n         \"Resource\": \"arn:aws:ec2:*::snapshot/*\"\n      }\n   ]\n}\n`,\n});\nconst example = new aws.dlm.LifecyclePolicy(\"example\", {\n    description: \"example DLM lifecycle policy\",\n    executionRoleArn: dlmLifecycleRole.arn,\n    state: \"ENABLED\",\n    policyDetails: {\n        resourceTypes: [\"VOLUME\"],\n        schedules: [{\n            name: \"2 weeks of daily snapshots\",\n            createRule: {\n                interval: 24,\n                intervalUnit: \"HOURS\",\n                times: [\"23:45\"],\n            },\n            retainRule: {\n                count: 14,\n            },\n            tagsToAdd: {\n                SnapshotCreator: \"DLM\",\n            },\n            copyTags: false,\n        }],\n        targetTags: {\n            Snapshot: \"true\",\n        },\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ndlm_lifecycle_role = aws.iam.Role(\"dlmLifecycleRole\", assume_role_policy=\"\"\"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"dlm.amazonaws.com\"\n      },\n      \"Effect\": \"Allow\",\n      \"Sid\": \"\"\n    }\n  ]\n}\n\"\"\")\ndlm_lifecycle = aws.iam.RolePolicy(\"dlmLifecycle\",\n    role=dlm_lifecycle_role.id,\n    policy=\"\"\"{\n   \"Version\": \"2012-10-17\",\n   \"Statement\": [\n      {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n            \"ec2:CreateSnapshot\",\n            \"ec2:CreateSnapshots\",\n            \"ec2:DeleteSnapshot\",\n            \"ec2:DescribeInstances\",\n            \"ec2:DescribeVolumes\",\n            \"ec2:DescribeSnapshots\"\n         ],\n         \"Resource\": \"*\"\n      },\n      {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n            \"ec2:CreateTags\"\n         ],\n         \"Resource\": \"arn:aws:ec2:*::snapshot/*\"\n      }\n   ]\n}\n\"\"\")\nexample = aws.dlm.LifecyclePolicy(\"example\",\n    description=\"example DLM lifecycle policy\",\n    execution_role_arn=dlm_lifecycle_role.arn,\n    state=\"ENABLED\",\n    policy_details=aws.dlm.LifecyclePolicyPolicyDetailsArgs(\n        resource_types=[\"VOLUME\"],\n        schedules=[aws.dlm.LifecyclePolicyPolicyDetailsScheduleArgs(\n            name=\"2 weeks of daily snapshots\",\n            create_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs(\n                interval=24,\n                interval_unit=\"HOURS\",\n                times=[\"23:45\"],\n            ),\n            retain_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs(\n                count=14,\n            ),\n            tags_to_add={\n                \"SnapshotCreator\": \"DLM\",\n            },\n            copy_tags=False,\n        )],\n        target_tags={\n            \"Snapshot\": \"true\",\n        },\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var dlmLifecycleRole = new Aws.Iam.Role(\"dlmLifecycleRole\", new Aws.Iam.RoleArgs\n        {\n            AssumeRolePolicy = @\"{\n  \"\"Version\"\": \"\"2012-10-17\"\",\n  \"\"Statement\"\": [\n    {\n      \"\"Action\"\": \"\"sts:AssumeRole\"\",\n      \"\"Principal\"\": {\n        \"\"Service\"\": \"\"dlm.amazonaws.com\"\"\n      },\n      \"\"Effect\"\": \"\"Allow\"\",\n      \"\"Sid\"\": \"\"\"\"\n    }\n  ]\n}\n\",\n        });\n        var dlmLifecycle = new Aws.Iam.RolePolicy(\"dlmLifecycle\", new Aws.Iam.RolePolicyArgs\n        {\n            Role = dlmLifecycleRole.Id,\n            Policy = @\"{\n   \"\"Version\"\": \"\"2012-10-17\"\",\n   \"\"Statement\"\": [\n      {\n         \"\"Effect\"\": \"\"Allow\"\",\n         \"\"Action\"\": [\n            \"\"ec2:CreateSnapshot\"\",\n            \"\"ec2:CreateSnapshots\"\",\n            \"\"ec2:DeleteSnapshot\"\",\n            \"\"ec2:DescribeInstances\"\",\n            \"\"ec2:DescribeVolumes\"\",\n            \"\"ec2:DescribeSnapshots\"\"\n         ],\n         \"\"Resource\"\": \"\"*\"\"\n      },\n      {\n         \"\"Effect\"\": \"\"Allow\"\",\n         \"\"Action\"\": [\n            \"\"ec2:CreateTags\"\"\n         ],\n         \"\"Resource\"\": \"\"arn:aws:ec2:*::snapshot/*\"\"\n      }\n   ]\n}\n\",\n        });\n        var example = new Aws.Dlm.LifecyclePolicy(\"example\", new Aws.Dlm.LifecyclePolicyArgs\n        {\n            Description = \"example DLM lifecycle policy\",\n            ExecutionRoleArn = dlmLifecycleRole.Arn,\n            State = \"ENABLED\",\n            PolicyDetails = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsArgs\n            {\n                ResourceTypes = \n                {\n                    \"VOLUME\",\n                },\n                Schedules = \n                {\n                    new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleArgs\n                    {\n                        Name = \"2 weeks of daily snapshots\",\n                        CreateRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs\n                        {\n                            Interval = 24,\n                            IntervalUnit = \"HOURS\",\n                            Times = \n                            {\n                                \"23:45\",\n                            },\n                        },\n                        RetainRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs\n                        {\n                            Count = 14,\n                        },\n                        TagsToAdd = \n                        {\n                            { \"SnapshotCreator\", \"DLM\" },\n                        },\n                        CopyTags = false,\n                    },\n                },\n                TargetTags = \n                {\n                    { \"Snapshot\", \"true\" },\n                },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/dlm\"\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/iam\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tdlmLifecycleRole, err := iam.NewRole(ctx, \"dlmLifecycleRole\", \u0026iam.RoleArgs{\n\t\t\tAssumeRolePolicy: pulumi.Any(fmt.Sprintf(\"%v%v%v%v%v%v%v%v%v%v%v%v%v\", \"{\\n\", \"  \\\"Version\\\": \\\"2012-10-17\\\",\\n\", \"  \\\"Statement\\\": [\\n\", \"    {\\n\", \"      \\\"Action\\\": \\\"sts:AssumeRole\\\",\\n\", \"      \\\"Principal\\\": {\\n\", \"        \\\"Service\\\": \\\"dlm.amazonaws.com\\\"\\n\", \"      },\\n\", \"      \\\"Effect\\\": \\\"Allow\\\",\\n\", \"      \\\"Sid\\\": \\\"\\\"\\n\", \"    }\\n\", \"  ]\\n\", \"}\\n\")),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = iam.NewRolePolicy(ctx, \"dlmLifecycle\", \u0026iam.RolePolicyArgs{\n\t\t\tRole:   dlmLifecycleRole.ID(),\n\t\t\tPolicy: pulumi.Any(fmt.Sprintf(\"%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v\", \"{\\n\", \"   \\\"Version\\\": \\\"2012-10-17\\\",\\n\", \"   \\\"Statement\\\": [\\n\", \"      {\\n\", \"         \\\"Effect\\\": \\\"Allow\\\",\\n\", \"         \\\"Action\\\": [\\n\", \"            \\\"ec2:CreateSnapshot\\\",\\n\", \"            \\\"ec2:CreateSnapshots\\\",\\n\", \"            \\\"ec2:DeleteSnapshot\\\",\\n\", \"            \\\"ec2:DescribeInstances\\\",\\n\", \"            \\\"ec2:DescribeVolumes\\\",\\n\", \"            \\\"ec2:DescribeSnapshots\\\"\\n\", \"         ],\\n\", \"         \\\"Resource\\\": \\\"*\\\"\\n\", \"      },\\n\", \"      {\\n\", \"         \\\"Effect\\\": \\\"Allow\\\",\\n\", \"         \\\"Action\\\": [\\n\", \"            \\\"ec2:CreateTags\\\"\\n\", \"         ],\\n\", \"         \\\"Resource\\\": \\\"arn:aws:ec2:*::snapshot/*\\\"\\n\", \"      }\\n\", \"   ]\\n\", \"}\\n\")),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = dlm.NewLifecyclePolicy(ctx, \"example\", \u0026dlm.LifecyclePolicyArgs{\n\t\t\tDescription:      pulumi.String(\"example DLM lifecycle policy\"),\n\t\t\tExecutionRoleArn: dlmLifecycleRole.Arn,\n\t\t\tState:            pulumi.String(\"ENABLED\"),\n\t\t\tPolicyDetails: \u0026dlm.LifecyclePolicyPolicyDetailsArgs{\n\t\t\t\tResourceTypes: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"VOLUME\"),\n\t\t\t\t},\n\t\t\t\tSchedules: dlm.LifecyclePolicyPolicyDetailsScheduleArray{\n\t\t\t\t\t\u0026dlm.LifecyclePolicyPolicyDetailsScheduleArgs{\n\t\t\t\t\t\tName: pulumi.String(\"2 weeks of daily snapshots\"),\n\t\t\t\t\t\tCreateRule: \u0026dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs{\n\t\t\t\t\t\t\tInterval:     pulumi.Int(24),\n\t\t\t\t\t\t\tIntervalUnit: pulumi.String(\"HOURS\"),\n\t\t\t\t\t\t\tTimes: pulumi.String{\n\t\t\t\t\t\t\t\t\"23:45\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t\tRetainRule: \u0026dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs{\n\t\t\t\t\t\t\tCount: pulumi.Int(14),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tTagsToAdd: pulumi.StringMap{\n\t\t\t\t\t\t\t\"SnapshotCreator\": pulumi.String(\"DLM\"),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tCopyTags: pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tTargetTags: pulumi.StringMap{\n\t\t\t\t\t\"Snapshot\": pulumi.String(\"true\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Example Cross-Region Snapshot Copy Usage\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\n// ...other configuration...\nconst dlmCrossRegionCopyCmk = new aws.kms.Key(\"dlmCrossRegionCopyCmk\", {\n    description: \"Example Alternate Region KMS Key\",\n    policy: `{\n  \"Version\": \"2012-10-17\",\n  \"Id\": \"dlm-cross-region-copy-cmk\",\n  \"Statement\": [\n    {\n      \"Sid\": \"Enable IAM User Permissions\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"*\"\n      },\n      \"Action\": \"kms:*\",\n      \"Resource\": \"*\"\n    }\n  ]\n}\n`,\n}, {\n    provider: aws.alternate,\n});\nconst example = new aws.dlm.LifecyclePolicy(\"example\", {\n    description: \"example DLM lifecycle policy\",\n    executionRoleArn: aws_iam_role.dlm_lifecycle_role.arn,\n    state: \"ENABLED\",\n    policyDetails: {\n        resourceTypes: [\"VOLUME\"],\n        schedules: [{\n            name: \"2 weeks of daily snapshots\",\n            createRule: {\n                interval: 24,\n                intervalUnit: \"HOURS\",\n                times: [\"23:45\"],\n            },\n            retainRule: {\n                count: 14,\n            },\n            tagsToAdd: {\n                SnapshotCreator: \"DLM\",\n            },\n            copyTags: false,\n            crossRegionCopyRules: [{\n                target: \"us-west-2\",\n                encrypted: true,\n                cmkArn: dlmCrossRegionCopyCmk.arn,\n                copyTags: true,\n                retainRule: {\n                    interval: 30,\n                    intervalUnit: \"DAYS\",\n                },\n            }],\n        }],\n        targetTags: {\n            Snapshot: \"true\",\n        },\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\n# ...other configuration...\ndlm_cross_region_copy_cmk = aws.kms.Key(\"dlmCrossRegionCopyCmk\",\n    description=\"Example Alternate Region KMS Key\",\n    policy=\"\"\"{\n  \"Version\": \"2012-10-17\",\n  \"Id\": \"dlm-cross-region-copy-cmk\",\n  \"Statement\": [\n    {\n      \"Sid\": \"Enable IAM User Permissions\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"*\"\n      },\n      \"Action\": \"kms:*\",\n      \"Resource\": \"*\"\n    }\n  ]\n}\n\"\"\",\n    opts=pulumi.ResourceOptions(provider=aws[\"alternate\"]))\nexample = aws.dlm.LifecyclePolicy(\"example\",\n    description=\"example DLM lifecycle policy\",\n    execution_role_arn=aws_iam_role[\"dlm_lifecycle_role\"][\"arn\"],\n    state=\"ENABLED\",\n    policy_details=aws.dlm.LifecyclePolicyPolicyDetailsArgs(\n        resource_types=[\"VOLUME\"],\n        schedules=[aws.dlm.LifecyclePolicyPolicyDetailsScheduleArgs(\n            name=\"2 weeks of daily snapshots\",\n            create_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs(\n                interval=24,\n                interval_unit=\"HOURS\",\n                times=[\"23:45\"],\n            ),\n            retain_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs(\n                count=14,\n            ),\n            tags_to_add={\n                \"SnapshotCreator\": \"DLM\",\n            },\n            copy_tags=False,\n            cross_region_copy_rules=[aws.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs(\n                target=\"us-west-2\",\n                encrypted=True,\n                cmk_arn=dlm_cross_region_copy_cmk.arn,\n                copy_tags=True,\n                retain_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs(\n                    interval=30,\n                    interval_unit=\"DAYS\",\n                ),\n            )],\n        )],\n        target_tags={\n            \"Snapshot\": \"true\",\n        },\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        // ...other configuration...\n        var dlmCrossRegionCopyCmk = new Aws.Kms.Key(\"dlmCrossRegionCopyCmk\", new Aws.Kms.KeyArgs\n        {\n            Description = \"Example Alternate Region KMS Key\",\n            Policy = @\"{\n  \"\"Version\"\": \"\"2012-10-17\"\",\n  \"\"Id\"\": \"\"dlm-cross-region-copy-cmk\"\",\n  \"\"Statement\"\": [\n    {\n      \"\"Sid\"\": \"\"Enable IAM User Permissions\"\",\n      \"\"Effect\"\": \"\"Allow\"\",\n      \"\"Principal\"\": {\n        \"\"AWS\"\": \"\"*\"\"\n      },\n      \"\"Action\"\": \"\"kms:*\"\",\n      \"\"Resource\"\": \"\"*\"\"\n    }\n  ]\n}\n\",\n        }, new CustomResourceOptions\n        {\n            Provider = aws.Alternate,\n        });\n        var example = new Aws.Dlm.LifecyclePolicy(\"example\", new Aws.Dlm.LifecyclePolicyArgs\n        {\n            Description = \"example DLM lifecycle policy\",\n            ExecutionRoleArn = aws_iam_role.Dlm_lifecycle_role.Arn,\n            State = \"ENABLED\",\n            PolicyDetails = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsArgs\n            {\n                ResourceTypes = \n                {\n                    \"VOLUME\",\n                },\n                Schedules = \n                {\n                    new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleArgs\n                    {\n                        Name = \"2 weeks of daily snapshots\",\n                        CreateRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs\n                        {\n                            Interval = 24,\n                            IntervalUnit = \"HOURS\",\n                            Times = \n                            {\n                                \"23:45\",\n                            },\n                        },\n                        RetainRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs\n                        {\n                            Count = 14,\n                        },\n                        TagsToAdd = \n                        {\n                            { \"SnapshotCreator\", \"DLM\" },\n                        },\n                        CopyTags = false,\n                        CrossRegionCopyRules = \n                        {\n                            new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs\n                            {\n                                Target = \"us-west-2\",\n                                Encrypted = true,\n                                CmkArn = dlmCrossRegionCopyCmk.Arn,\n                                CopyTags = true,\n                                RetainRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs\n                                {\n                                    Interval = 30,\n                                    IntervalUnit = \"DAYS\",\n                                },\n                            },\n                        },\n                    },\n                },\n                TargetTags = \n                {\n                    { \"Snapshot\", \"true\" },\n                },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/dlm\"\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/kms\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tdlmCrossRegionCopyCmk, err := kms.NewKey(ctx, \"dlmCrossRegionCopyCmk\", \u0026kms.KeyArgs{\n\t\t\tDescription: pulumi.String(\"Example Alternate Region KMS Key\"),\n\t\t\tPolicy:      pulumi.String(fmt.Sprintf(\"%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v\", \"{\\n\", \"  \\\"Version\\\": \\\"2012-10-17\\\",\\n\", \"  \\\"Id\\\": \\\"dlm-cross-region-copy-cmk\\\",\\n\", \"  \\\"Statement\\\": [\\n\", \"    {\\n\", \"      \\\"Sid\\\": \\\"Enable IAM User Permissions\\\",\\n\", \"      \\\"Effect\\\": \\\"Allow\\\",\\n\", \"      \\\"Principal\\\": {\\n\", \"        \\\"AWS\\\": \\\"*\\\"\\n\", \"      },\\n\", \"      \\\"Action\\\": \\\"kms:*\\\",\\n\", \"      \\\"Resource\\\": \\\"*\\\"\\n\", \"    }\\n\", \"  ]\\n\", \"}\\n\")),\n\t\t}, pulumi.Provider(aws.Alternate))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = dlm.NewLifecyclePolicy(ctx, \"example\", \u0026dlm.LifecyclePolicyArgs{\n\t\t\tDescription:      pulumi.String(\"example DLM lifecycle policy\"),\n\t\t\tExecutionRoleArn: pulumi.Any(aws_iam_role.Dlm_lifecycle_role.Arn),\n\t\t\tState:            pulumi.String(\"ENABLED\"),\n\t\t\tPolicyDetails: \u0026dlm.LifecyclePolicyPolicyDetailsArgs{\n\t\t\t\tResourceTypes: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"VOLUME\"),\n\t\t\t\t},\n\t\t\t\tSchedules: dlm.LifecyclePolicyPolicyDetailsScheduleArray{\n\t\t\t\t\t\u0026dlm.LifecyclePolicyPolicyDetailsScheduleArgs{\n\t\t\t\t\t\tName: pulumi.String(\"2 weeks of daily snapshots\"),\n\t\t\t\t\t\tCreateRule: \u0026dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs{\n\t\t\t\t\t\t\tInterval:     pulumi.Int(24),\n\t\t\t\t\t\t\tIntervalUnit: pulumi.String(\"HOURS\"),\n\t\t\t\t\t\t\tTimes: pulumi.String{\n\t\t\t\t\t\t\t\t\"23:45\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t\tRetainRule: \u0026dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs{\n\t\t\t\t\t\t\tCount: pulumi.Int(14),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tTagsToAdd: pulumi.StringMap{\n\t\t\t\t\t\t\t\"SnapshotCreator\": pulumi.String(\"DLM\"),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tCopyTags: pulumi.Bool(false),\n\t\t\t\t\t\tCrossRegionCopyRules: dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray{\n\t\t\t\t\t\t\t\u0026dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs{\n\t\t\t\t\t\t\t\tTarget:    pulumi.String(\"us-west-2\"),\n\t\t\t\t\t\t\t\tEncrypted: pulumi.Bool(true),\n\t\t\t\t\t\t\t\tCmkArn:    dlmCrossRegionCopyCmk.Arn,\n\t\t\t\t\t\t\t\tCopyTags:  pulumi.Bool(true),\n\t\t\t\t\t\t\t\tRetainRule: \u0026dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs{\n\t\t\t\t\t\t\t\t\tInterval:     pulumi.Int(30),\n\t\t\t\t\t\t\t\t\tIntervalUnit: pulumi.String(\"DAYS\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tTargetTags: pulumi.StringMap{\n\t\t\t\t\t\"Snapshot\": pulumi.String(\"true\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nDLM lifecycle policies can be imported by their policy ID\n\n```sh\n $ pulumi import aws:dlm/lifecyclePolicy:LifecyclePolicy example policy-abcdef12345678901\n```\n\n ",
             "properties": {
                 "arn": {
                     "type": "string",
@@ -226237,7 +230260,7 @@
             }
         },
         "aws:ecs/capacityProvider:CapacityProvider": {
-            "description": "Provides an ECS cluster capacity provider. More information can be found on the [ECS Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html).\n\n\u003e **NOTE:** Associating an ECS Capacity Provider to an Auto Scaling Group will automatically add the `AmazonECSManaged` tag to the Auto Scaling Group. This tag should be included in the `aws.autoscaling.Group` resource configuration to prevent the provider from removing it in subsequent executions as well as ensuring the `AmazonECSManaged` tag is propagated to all EC2 Instances in the Auto Scaling Group if `min_size` is above 0 on creation. Any EC2 Instances in the Auto Scaling Group without this tag must be manually be updated, otherwise they may cause unexpected scaling behavior and metrics.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\n// ... other configuration, including potentially other tags ...\nconst testGroup = new aws.autoscaling.Group(\"testGroup\", {tags: [{\n    key: \"AmazonECSManaged\",\n    value: \"\",\n    propagateAtLaunch: true,\n}]});\nconst testCapacityProvider = new aws.ecs.CapacityProvider(\"testCapacityProvider\", {autoScalingGroupProvider: {\n    autoScalingGroupArn: testGroup.arn,\n    managedTerminationProtection: \"ENABLED\",\n    managedScaling: {\n        maximumScalingStepSize: 1000,\n        minimumScalingStepSize: 1,\n        status: \"ENABLED\",\n        targetCapacity: 10,\n    },\n}});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\n# ... other configuration, including potentially other tags ...\ntest_group = aws.autoscaling.Group(\"testGroup\", tags=[aws.autoscaling.GroupTagArgs(\n    key=\"AmazonECSManaged\",\n    value=\"\",\n    propagate_at_launch=True,\n)])\ntest_capacity_provider = aws.ecs.CapacityProvider(\"testCapacityProvider\", auto_scaling_group_provider=aws.ecs.CapacityProviderAutoScalingGroupProviderArgs(\n    auto_scaling_group_arn=test_group.arn,\n    managed_termination_protection=\"ENABLED\",\n    managed_scaling=aws.ecs.CapacityProviderAutoScalingGroupProviderManagedScalingArgs(\n        maximum_scaling_step_size=1000,\n        minimum_scaling_step_size=1,\n        status=\"ENABLED\",\n        target_capacity=10,\n    ),\n))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        // ... other configuration, including potentially other tags ...\n        var testGroup = new Aws.AutoScaling.Group(\"testGroup\", new Aws.AutoScaling.GroupArgs\n        {\n            Tags = \n            {\n                new Aws.AutoScaling.Inputs.GroupTagArgs\n                {\n                    Key = \"AmazonECSManaged\",\n                    Value = \"\",\n                    PropagateAtLaunch = true,\n                },\n            },\n        });\n        var testCapacityProvider = new Aws.Ecs.CapacityProvider(\"testCapacityProvider\", new Aws.Ecs.CapacityProviderArgs\n        {\n            AutoScalingGroupProvider = new Aws.Ecs.Inputs.CapacityProviderAutoScalingGroupProviderArgs\n            {\n                AutoScalingGroupArn = testGroup.Arn,\n                ManagedTerminationProtection = \"ENABLED\",\n                ManagedScaling = new Aws.Ecs.Inputs.CapacityProviderAutoScalingGroupProviderManagedScalingArgs\n                {\n                    MaximumScalingStepSize = 1000,\n                    MinimumScalingStepSize = 1,\n                    Status = \"ENABLED\",\n                    TargetCapacity = 10,\n                },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/autoscaling\"\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/ecs\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttestGroup, err := autoscaling.NewGroup(ctx, \"testGroup\", \u0026autoscaling.GroupArgs{\n\t\t\tTags: autoscaling.GroupTagArray{\n\t\t\t\t\u0026autoscaling.GroupTagArgs{\n\t\t\t\t\tKey:               pulumi.String(\"AmazonECSManaged\"),\n\t\t\t\t\tValue:             pulumi.String(\"\"),\n\t\t\t\t\tPropagateAtLaunch: pulumi.Bool(true),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ecs.NewCapacityProvider(ctx, \"testCapacityProvider\", \u0026ecs.CapacityProviderArgs{\n\t\t\tAutoScalingGroupProvider: \u0026ecs.CapacityProviderAutoScalingGroupProviderArgs{\n\t\t\t\tAutoScalingGroupArn:          testGroup.Arn,\n\t\t\t\tManagedTerminationProtection: pulumi.String(\"ENABLED\"),\n\t\t\t\tManagedScaling: \u0026ecs.CapacityProviderAutoScalingGroupProviderManagedScalingArgs{\n\t\t\t\t\tMaximumScalingStepSize: pulumi.Int(1000),\n\t\t\t\t\tMinimumScalingStepSize: pulumi.Int(1),\n\t\t\t\t\tStatus:                 pulumi.String(\"ENABLED\"),\n\t\t\t\t\tTargetCapacity:         pulumi.Int(10),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nECS Capacity Providers can be imported using the `name`, e.g.,\n\n```sh\n $ pulumi import aws:ecs/capacityProvider:CapacityProvider example example\n```\n\n ",
+            "description": "Provides an ECS cluster capacity provider. More information can be found on the [ECS Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html).\n\n\u003e **NOTE:** Associating an ECS Capacity Provider to an Auto Scaling Group will automatically add the `AmazonECSManaged` tag to the Auto Scaling Group. This tag should be included in the `aws.autoscaling.Group` resource configuration to prevent the provider from removing it in subsequent executions as well as ensuring the `AmazonECSManaged` tag is propagated to all EC2 Instances in the Auto Scaling Group if `min_size` is above 0 on creation. Any EC2 Instances in the Auto Scaling Group without this tag must be manually be updated, otherwise they may cause unexpected scaling behavior and metrics.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\n// ... other configuration, including potentially other tags ...\nconst testGroup = new aws.autoscaling.Group(\"testGroup\", {tags: [{\n    key: \"AmazonECSManaged\",\n    value: true,\n    propagateAtLaunch: true,\n}]});\nconst testCapacityProvider = new aws.ecs.CapacityProvider(\"testCapacityProvider\", {autoScalingGroupProvider: {\n    autoScalingGroupArn: testGroup.arn,\n    managedTerminationProtection: \"ENABLED\",\n    managedScaling: {\n        maximumScalingStepSize: 1000,\n        minimumScalingStepSize: 1,\n        status: \"ENABLED\",\n        targetCapacity: 10,\n    },\n}});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\n# ... other configuration, including potentially other tags ...\ntest_group = aws.autoscaling.Group(\"testGroup\", tags=[aws.autoscaling.GroupTagArgs(\n    key=\"AmazonECSManaged\",\n    value=\"true\",\n    propagate_at_launch=True,\n)])\ntest_capacity_provider = aws.ecs.CapacityProvider(\"testCapacityProvider\", auto_scaling_group_provider=aws.ecs.CapacityProviderAutoScalingGroupProviderArgs(\n    auto_scaling_group_arn=test_group.arn,\n    managed_termination_protection=\"ENABLED\",\n    managed_scaling=aws.ecs.CapacityProviderAutoScalingGroupProviderManagedScalingArgs(\n        maximum_scaling_step_size=1000,\n        minimum_scaling_step_size=1,\n        status=\"ENABLED\",\n        target_capacity=10,\n    ),\n))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        // ... other configuration, including potentially other tags ...\n        var testGroup = new Aws.AutoScaling.Group(\"testGroup\", new Aws.AutoScaling.GroupArgs\n        {\n            Tags = \n            {\n                new Aws.AutoScaling.Inputs.GroupTagArgs\n                {\n                    Key = \"AmazonECSManaged\",\n                    Value = \"true\",\n                    PropagateAtLaunch = true,\n                },\n            },\n        });\n        var testCapacityProvider = new Aws.Ecs.CapacityProvider(\"testCapacityProvider\", new Aws.Ecs.CapacityProviderArgs\n        {\n            AutoScalingGroupProvider = new Aws.Ecs.Inputs.CapacityProviderAutoScalingGroupProviderArgs\n            {\n                AutoScalingGroupArn = testGroup.Arn,\n                ManagedTerminationProtection = \"ENABLED\",\n                ManagedScaling = new Aws.Ecs.Inputs.CapacityProviderAutoScalingGroupProviderManagedScalingArgs\n                {\n                    MaximumScalingStepSize = 1000,\n                    MinimumScalingStepSize = 1,\n                    Status = \"ENABLED\",\n                    TargetCapacity = 10,\n                },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/autoscaling\"\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/ecs\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttestGroup, err := autoscaling.NewGroup(ctx, \"testGroup\", \u0026autoscaling.GroupArgs{\n\t\t\tTags: autoscaling.GroupTagArray{\n\t\t\t\t\u0026autoscaling.GroupTagArgs{\n\t\t\t\t\tKey:               pulumi.String(\"AmazonECSManaged\"),\n\t\t\t\t\tValue:             pulumi.String(\"true\"),\n\t\t\t\t\tPropagateAtLaunch: pulumi.Bool(true),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ecs.NewCapacityProvider(ctx, \"testCapacityProvider\", \u0026ecs.CapacityProviderArgs{\n\t\t\tAutoScalingGroupProvider: \u0026ecs.CapacityProviderAutoScalingGroupProviderArgs{\n\t\t\t\tAutoScalingGroupArn:          testGroup.Arn,\n\t\t\t\tManagedTerminationProtection: pulumi.String(\"ENABLED\"),\n\t\t\t\tManagedScaling: \u0026ecs.CapacityProviderAutoScalingGroupProviderManagedScalingArgs{\n\t\t\t\t\tMaximumScalingStepSize: pulumi.Int(1000),\n\t\t\t\t\tMinimumScalingStepSize: pulumi.Int(1),\n\t\t\t\t\tStatus:                 pulumi.String(\"ENABLED\"),\n\t\t\t\t\tTargetCapacity:         pulumi.Int(10),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nECS Capacity Providers can be imported using the `name`, e.g.,\n\n```sh\n $ pulumi import aws:ecs/capacityProvider:CapacityProvider example example\n```\n\n ",
             "properties": {
                 "arn": {
                     "type": "string",
@@ -226472,19 +230495,19 @@
                     "items": {
                         "$ref": "#/types/aws:ecs/ServiceCapacityProviderStrategy:ServiceCapacityProviderStrategy"
                     },
-                    "description": "Capacity provider strategy to use for the service. Can be one or more.  Detailed below.\n"
+                    "description": "Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.\n"
                 },
                 "cluster": {
                     "type": "string",
-                    "description": "ARN of an ECS cluster\n"
+                    "description": "ARN of an ECS cluster.\n"
                 },
                 "deploymentCircuitBreaker": {
                     "$ref": "#/types/aws:ecs/ServiceDeploymentCircuitBreaker:ServiceDeploymentCircuitBreaker",
-                    "description": "Configuration block for deployment circuit breaker. Detailed below.\n"
+                    "description": "Configuration block for deployment circuit breaker. See below.\n"
                 },
                 "deploymentController": {
                     "$ref": "#/types/aws:ecs/ServiceDeploymentController:ServiceDeploymentController",
-                    "description": "Configuration block for deployment controller configuration. Detailed below.\n"
+                    "description": "Configuration block for deployment controller configuration. See below.\n"
                 },
                 "deploymentMaximumPercent": {
                     "type": "integer",
@@ -226527,7 +230550,7 @@
                     "items": {
                         "$ref": "#/types/aws:ecs/ServiceLoadBalancer:ServiceLoadBalancer"
                     },
-                    "description": "Configuration block for load balancers. Detailed below.\n"
+                    "description": "Configuration block for load balancers. See below.\n"
                 },
                 "name": {
                     "type": "string",
@@ -226535,21 +230558,21 @@
                 },
                 "networkConfiguration": {
                     "$ref": "#/types/aws:ecs/ServiceNetworkConfiguration:ServiceNetworkConfiguration",
-                    "description": "Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.\n"
+                    "description": "Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.\n"
                 },
                 "orderedPlacementStrategies": {
                     "type": "array",
                     "items": {
                         "$ref": "#/types/aws:ecs/ServiceOrderedPlacementStrategy:ServiceOrderedPlacementStrategy"
                     },
-                    "description": "Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.\n"
+                    "description": "Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.\n"
                 },
                 "placementConstraints": {
                     "type": "array",
                     "items": {
                         "$ref": "#/types/aws:ecs/ServicePlacementConstraint:ServicePlacementConstraint"
                     },
-                    "description": "Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.\n"
+                    "description": "Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.\n"
                 },
                 "platformVersion": {
                     "type": "string",
@@ -226565,14 +230588,14 @@
                 },
                 "serviceRegistries": {
                     "$ref": "#/types/aws:ecs/ServiceServiceRegistries:ServiceServiceRegistries",
-                    "description": "Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.\n"
+                    "description": "Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.\n"
                 },
                 "tags": {
                     "type": "object",
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "Key-value map of resource tags.\n"
+                    "description": "Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 },
                 "tagsAll": {
                     "type": "object",
@@ -226604,19 +230627,19 @@
                     "items": {
                         "$ref": "#/types/aws:ecs/ServiceCapacityProviderStrategy:ServiceCapacityProviderStrategy"
                     },
-                    "description": "Capacity provider strategy to use for the service. Can be one or more.  Detailed below.\n"
+                    "description": "Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.\n"
                 },
                 "cluster": {
                     "type": "string",
-                    "description": "ARN of an ECS cluster\n"
+                    "description": "ARN of an ECS cluster.\n"
                 },
                 "deploymentCircuitBreaker": {
                     "$ref": "#/types/aws:ecs/ServiceDeploymentCircuitBreaker:ServiceDeploymentCircuitBreaker",
-                    "description": "Configuration block for deployment circuit breaker. Detailed below.\n"
+                    "description": "Configuration block for deployment circuit breaker. See below.\n"
                 },
                 "deploymentController": {
                     "$ref": "#/types/aws:ecs/ServiceDeploymentController:ServiceDeploymentController",
-                    "description": "Configuration block for deployment controller configuration. Detailed below.\n"
+                    "description": "Configuration block for deployment controller configuration. See below.\n"
                 },
                 "deploymentMaximumPercent": {
                     "type": "integer",
@@ -226659,7 +230682,7 @@
                     "items": {
                         "$ref": "#/types/aws:ecs/ServiceLoadBalancer:ServiceLoadBalancer"
                     },
-                    "description": "Configuration block for load balancers. Detailed below.\n"
+                    "description": "Configuration block for load balancers. See below.\n"
                 },
                 "name": {
                     "type": "string",
@@ -226667,21 +230690,21 @@
                 },
                 "networkConfiguration": {
                     "$ref": "#/types/aws:ecs/ServiceNetworkConfiguration:ServiceNetworkConfiguration",
-                    "description": "Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.\n"
+                    "description": "Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.\n"
                 },
                 "orderedPlacementStrategies": {
                     "type": "array",
                     "items": {
                         "$ref": "#/types/aws:ecs/ServiceOrderedPlacementStrategy:ServiceOrderedPlacementStrategy"
                     },
-                    "description": "Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.\n"
+                    "description": "Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.\n"
                 },
                 "placementConstraints": {
                     "type": "array",
                     "items": {
                         "$ref": "#/types/aws:ecs/ServicePlacementConstraint:ServicePlacementConstraint"
                     },
-                    "description": "Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.\n"
+                    "description": "Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.\n"
                 },
                 "platformVersion": {
                     "type": "string",
@@ -226697,14 +230720,14 @@
                 },
                 "serviceRegistries": {
                     "$ref": "#/types/aws:ecs/ServiceServiceRegistries:ServiceServiceRegistries",
-                    "description": "Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.\n"
+                    "description": "Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.\n"
                 },
                 "tags": {
                     "type": "object",
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "Key-value map of resource tags.\n"
+                    "description": "Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 },
                 "taskDefinition": {
                     "type": "string",
@@ -226723,19 +230746,19 @@
                         "items": {
                             "$ref": "#/types/aws:ecs/ServiceCapacityProviderStrategy:ServiceCapacityProviderStrategy"
                         },
-                        "description": "Capacity provider strategy to use for the service. Can be one or more.  Detailed below.\n"
+                        "description": "Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.\n"
                     },
                     "cluster": {
                         "type": "string",
-                        "description": "ARN of an ECS cluster\n"
+                        "description": "ARN of an ECS cluster.\n"
                     },
                     "deploymentCircuitBreaker": {
                         "$ref": "#/types/aws:ecs/ServiceDeploymentCircuitBreaker:ServiceDeploymentCircuitBreaker",
-                        "description": "Configuration block for deployment circuit breaker. Detailed below.\n"
+                        "description": "Configuration block for deployment circuit breaker. See below.\n"
                     },
                     "deploymentController": {
                         "$ref": "#/types/aws:ecs/ServiceDeploymentController:ServiceDeploymentController",
-                        "description": "Configuration block for deployment controller configuration. Detailed below.\n"
+                        "description": "Configuration block for deployment controller configuration. See below.\n"
                     },
                     "deploymentMaximumPercent": {
                         "type": "integer",
@@ -226778,7 +230801,7 @@
                         "items": {
                             "$ref": "#/types/aws:ecs/ServiceLoadBalancer:ServiceLoadBalancer"
                         },
-                        "description": "Configuration block for load balancers. Detailed below.\n"
+                        "description": "Configuration block for load balancers. See below.\n"
                     },
                     "name": {
                         "type": "string",
@@ -226786,21 +230809,21 @@
                     },
                     "networkConfiguration": {
                         "$ref": "#/types/aws:ecs/ServiceNetworkConfiguration:ServiceNetworkConfiguration",
-                        "description": "Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.\n"
+                        "description": "Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.\n"
                     },
                     "orderedPlacementStrategies": {
                         "type": "array",
                         "items": {
                             "$ref": "#/types/aws:ecs/ServiceOrderedPlacementStrategy:ServiceOrderedPlacementStrategy"
                         },
-                        "description": "Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.\n"
+                        "description": "Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.\n"
                     },
                     "placementConstraints": {
                         "type": "array",
                         "items": {
                             "$ref": "#/types/aws:ecs/ServicePlacementConstraint:ServicePlacementConstraint"
                         },
-                        "description": "Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.\n"
+                        "description": "Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.\n"
                     },
                     "platformVersion": {
                         "type": "string",
@@ -226816,14 +230839,14 @@
                     },
                     "serviceRegistries": {
                         "$ref": "#/types/aws:ecs/ServiceServiceRegistries:ServiceServiceRegistries",
-                        "description": "Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.\n"
+                        "description": "Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.\n"
                     },
                     "tags": {
                         "type": "object",
                         "additionalProperties": {
                             "type": "string"
                         },
-                        "description": "Key-value map of resource tags.\n"
+                        "description": "Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                     },
                     "tagsAll": {
                         "type": "object",
@@ -231326,6 +235349,10 @@
                     "type": "boolean",
                     "description": "Enable cross-zone load balancing. Default: `true`\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dnsName": {
                     "type": "string",
                     "description": "The DNS name of the ELB\n"
@@ -231444,6 +235471,10 @@
                     "type": "boolean",
                     "description": "Enable cross-zone load balancing. Default: `true`\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "healthCheck": {
                     "$ref": "#/types/aws:elasticloadbalancing/LoadBalancerHealthCheck:LoadBalancerHealthCheck",
                     "description": "A health_check block. Health Check documented below.\n"
@@ -231536,6 +235567,10 @@
                         "type": "boolean",
                         "description": "Enable cross-zone load balancing. Default: `true`\n"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string",
+                        "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                    },
                     "dnsName": {
                         "type": "string",
                         "description": "The DNS name of the ELB\n"
@@ -232280,6 +236315,10 @@
                     "type": "string",
                     "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dnsName": {
                     "type": "string",
                     "description": "The DNS name of the load balancer.\n"
@@ -232300,6 +236339,10 @@
                     "type": "boolean",
                     "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                 },
+                "enableWafFailOpen": {
+                    "type": "boolean",
+                    "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                },
                 "idleTimeout": {
                     "type": "integer",
                     "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -232350,7 +236393,7 @@
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 },
                 "tagsAll": {
                     "type": "object",
@@ -232390,6 +236433,10 @@
                     "type": "string",
                     "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dropInvalidHeaderFields": {
                     "type": "boolean",
                     "description": "Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.\n"
@@ -232406,6 +236453,10 @@
                     "type": "boolean",
                     "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                 },
+                "enableWafFailOpen": {
+                    "type": "boolean",
+                    "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                },
                 "idleTimeout": {
                     "type": "integer",
                     "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -232456,7 +236507,7 @@
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 }
             },
             "stateInputs": {
@@ -232478,6 +236529,10 @@
                         "type": "string",
                         "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string",
+                        "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                    },
                     "dnsName": {
                         "type": "string",
                         "description": "The DNS name of the load balancer.\n"
@@ -232498,6 +236553,10 @@
                         "type": "boolean",
                         "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                     },
+                    "enableWafFailOpen": {
+                        "type": "boolean",
+                        "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                    },
                     "idleTimeout": {
                         "type": "integer",
                         "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -232548,7 +236607,7 @@
                         "additionalProperties": {
                             "type": "string"
                         },
-                        "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                        "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                     },
                     "tagsAll": {
                         "type": "object",
@@ -233861,6 +237920,10 @@
                     "type": "boolean",
                     "description": "Enable cross-zone load balancing. Default: `true`\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dnsName": {
                     "type": "string",
                     "description": "The DNS name of the ELB\n"
@@ -233979,6 +238042,10 @@
                     "type": "boolean",
                     "description": "Enable cross-zone load balancing. Default: `true`\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "healthCheck": {
                     "$ref": "#/types/aws:elb/LoadBalancerHealthCheck:LoadBalancerHealthCheck",
                     "description": "A health_check block. Health Check documented below.\n"
@@ -234071,6 +238138,10 @@
                         "type": "boolean",
                         "description": "Enable cross-zone load balancing. Default: `true`\n"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string",
+                        "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                    },
                     "dnsName": {
                         "type": "string",
                         "description": "The DNS name of the ELB\n"
@@ -236304,6 +240375,375 @@
                 "type": "object"
             }
         },
+        "aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine": {
+            "description": "Manages a FSx Storage Virtual Machine.\nSee the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html) for more information.\n\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n### Basic Usage\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst test = new aws.fsx.OntapStorageVirtualMachine(\"test\", {fileSystemId: aws_fsx_ontap_file_system.test.id});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ntest = aws.fsx.OntapStorageVirtualMachine(\"test\", file_system_id=aws_fsx_ontap_file_system[\"test\"][\"id\"])\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var test = new Aws.Fsx.OntapStorageVirtualMachine(\"test\", new Aws.Fsx.OntapStorageVirtualMachineArgs\n        {\n            FileSystemId = aws_fsx_ontap_file_system.Test.Id,\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := fsx.NewOntapStorageVirtualMachine(ctx, \"test\", \u0026fsx.OntapStorageVirtualMachineArgs{\n\t\t\tFileSystemId: pulumi.Any(aws_fsx_ontap_file_system.Test.Id),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Using a Self-Managed Microsoft Active Directory\n\nAdditional information for using AWS Directory Service with ONTAP File Systems can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD.html).\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst test = new aws.fsx.OntapStorageVirtualMachine(\"test\", {\n    fileSystemId: aws_fsx_ontap_file_system.test.id,\n    activeDirectoryConfiguration: {\n        netbiosName: \"mysvm\",\n        selfManagedActiveDirectoryConfiguration: {\n            dnsIps: [\n                \"10.0.0.111\",\n                \"10.0.0.222\",\n            ],\n            domainName: \"corp.example.com\",\n            password: \"avoid-plaintext-passwords\",\n            username: \"Admin\",\n        },\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ntest = aws.fsx.OntapStorageVirtualMachine(\"test\",\n    file_system_id=aws_fsx_ontap_file_system[\"test\"][\"id\"],\n    active_directory_configuration=aws.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationArgs(\n        netbios_name=\"mysvm\",\n        self_managed_active_directory_configuration=aws.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs(\n            dns_ips=[\n                \"10.0.0.111\",\n                \"10.0.0.222\",\n            ],\n            domain_name=\"corp.example.com\",\n            password=\"avoid-plaintext-passwords\",\n            username=\"Admin\",\n        ),\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var test = new Aws.Fsx.OntapStorageVirtualMachine(\"test\", new Aws.Fsx.OntapStorageVirtualMachineArgs\n        {\n            FileSystemId = aws_fsx_ontap_file_system.Test.Id,\n            ActiveDirectoryConfiguration = new Aws.Fsx.Inputs.OntapStorageVirtualMachineActiveDirectoryConfigurationArgs\n            {\n                NetbiosName = \"mysvm\",\n                SelfManagedActiveDirectoryConfiguration = new Aws.Fsx.Inputs.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs\n                {\n                    DnsIps = \n                    {\n                        \"10.0.0.111\",\n                        \"10.0.0.222\",\n                    },\n                    DomainName = \"corp.example.com\",\n                    Password = \"avoid-plaintext-passwords\",\n                    Username = \"Admin\",\n                },\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := fsx.NewOntapStorageVirtualMachine(ctx, \"test\", \u0026fsx.OntapStorageVirtualMachineArgs{\n\t\t\tFileSystemId: pulumi.Any(aws_fsx_ontap_file_system.Test.Id),\n\t\t\tActiveDirectoryConfiguration: \u0026fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationArgs{\n\t\t\t\tNetbiosName: pulumi.String(\"mysvm\"),\n\t\t\t\tSelfManagedActiveDirectoryConfiguration: \u0026fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs{\n\t\t\t\t\tDnsIps: pulumi.StringArray{\n\t\t\t\t\t\tpulumi.String(\"10.0.0.111\"),\n\t\t\t\t\t\tpulumi.String(\"10.0.0.222\"),\n\t\t\t\t\t},\n\t\t\t\t\tDomainName: pulumi.String(\"corp.example.com\"),\n\t\t\t\t\tPassword:   pulumi.String(\"avoid-plaintext-passwords\"),\n\t\t\t\t\tUsername:   pulumi.String(\"Admin\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nFSx Storage Virtual Machine can be imported using the `id`, e.g.,\n\n```sh\n $ pulumi import aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine example svm-12345678abcdef123\n```\n\n Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g., terraform resource \"aws_fsx_ontap_storage_virtual_machine\" \"example\" {\n\n # ... other configuration ...\n\n svm_admin_password = \"avoid-plaintext-passwords\"\n\n # There is no FSx API for reading svm_admin_password\n\n lifecycle {\n\n\n\n ignore_changes = [svm_admin_password]\n\n } } ",
+            "properties": {
+                "activeDirectoryConfiguration": {
+                    "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineActiveDirectoryConfiguration:OntapStorageVirtualMachineActiveDirectoryConfiguration",
+                    "description": "Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.\n"
+                },
+                "arn": {
+                    "type": "string",
+                    "description": "Amazon Resource Name of the storage virtual machine.\n"
+                },
+                "endpoints": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineEndpoint:OntapStorageVirtualMachineEndpoint"
+                    },
+                    "description": "The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.\n"
+                },
+                "fileSystemId": {
+                    "type": "string",
+                    "description": "The ID of the Amazon FSx ONTAP File System that this SVM will be created on.\n"
+                },
+                "name": {
+                    "type": "string",
+                    "description": "The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.\n"
+                },
+                "rootVolumeSecurityStyle": {
+                    "type": "string",
+                    "description": "Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.\n"
+                },
+                "subtype": {
+                    "type": "string",
+                    "description": "Describes the SVM's subtype, e.g. `DEFAULT`\n"
+                },
+                "svmAdminPassword": {
+                    "type": "string"
+                },
+                "tags": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                },
+                "tagsAll": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).\n"
+                },
+                "uuid": {
+                    "type": "string",
+                    "description": "The SVM's UUID (universally unique identifier).\n"
+                }
+            },
+            "required": [
+                "arn",
+                "endpoints",
+                "fileSystemId",
+                "name",
+                "subtype",
+                "tagsAll",
+                "uuid"
+            ],
+            "inputProperties": {
+                "activeDirectoryConfiguration": {
+                    "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineActiveDirectoryConfiguration:OntapStorageVirtualMachineActiveDirectoryConfiguration",
+                    "description": "Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.\n"
+                },
+                "fileSystemId": {
+                    "type": "string",
+                    "description": "The ID of the Amazon FSx ONTAP File System that this SVM will be created on.\n"
+                },
+                "name": {
+                    "type": "string",
+                    "description": "The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.\n"
+                },
+                "rootVolumeSecurityStyle": {
+                    "type": "string",
+                    "description": "Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.\n"
+                },
+                "svmAdminPassword": {
+                    "type": "string"
+                },
+                "tags": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                },
+                "tagsAll": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).\n"
+                }
+            },
+            "requiredInputs": [
+                "fileSystemId"
+            ],
+            "stateInputs": {
+                "description": "Input properties used for looking up and filtering OntapStorageVirtualMachine resources.\n",
+                "properties": {
+                    "activeDirectoryConfiguration": {
+                        "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineActiveDirectoryConfiguration:OntapStorageVirtualMachineActiveDirectoryConfiguration",
+                        "description": "Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.\n"
+                    },
+                    "arn": {
+                        "type": "string",
+                        "description": "Amazon Resource Name of the storage virtual machine.\n"
+                    },
+                    "endpoints": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/types/aws:fsx/OntapStorageVirtualMachineEndpoint:OntapStorageVirtualMachineEndpoint"
+                        },
+                        "description": "The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.\n"
+                    },
+                    "fileSystemId": {
+                        "type": "string",
+                        "description": "The ID of the Amazon FSx ONTAP File System that this SVM will be created on.\n"
+                    },
+                    "name": {
+                        "type": "string",
+                        "description": "The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.\n"
+                    },
+                    "rootVolumeSecurityStyle": {
+                        "type": "string",
+                        "description": "Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.\n"
+                    },
+                    "subtype": {
+                        "type": "string",
+                        "description": "Describes the SVM's subtype, e.g. `DEFAULT`\n"
+                    },
+                    "svmAdminPassword": {
+                        "type": "string"
+                    },
+                    "tags": {
+                        "type": "object",
+                        "additionalProperties": {
+                            "type": "string"
+                        },
+                        "description": "A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    },
+                    "tagsAll": {
+                        "type": "object",
+                        "additionalProperties": {
+                            "type": "string"
+                        },
+                        "description": "A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).\n"
+                    },
+                    "uuid": {
+                        "type": "string",
+                        "description": "The SVM's UUID (universally unique identifier).\n"
+                    }
+                },
+                "type": "object"
+            }
+        },
+        "aws:fsx/ontapVolume:OntapVolume": {
+            "description": "Manages a FSx ONTAP Volume.\nSee the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html) for more information.\n\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n### Basic Usage\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst test = new aws.fsx.OntapVolume(\"test\", {\n    junctionPath: \"/test\",\n    sizeInMegabytes: 1024,\n    storageEfficiencyEnabled: true,\n    storageVirtualMachineId: aws_fsx_ontap_storage_virtual_machine.test.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ntest = aws.fsx.OntapVolume(\"test\",\n    junction_path=\"/test\",\n    size_in_megabytes=1024,\n    storage_efficiency_enabled=True,\n    storage_virtual_machine_id=aws_fsx_ontap_storage_virtual_machine[\"test\"][\"id\"])\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var test = new Aws.Fsx.OntapVolume(\"test\", new Aws.Fsx.OntapVolumeArgs\n        {\n            JunctionPath = \"/test\",\n            SizeInMegabytes = 1024,\n            StorageEfficiencyEnabled = true,\n            StorageVirtualMachineId = aws_fsx_ontap_storage_virtual_machine.Test.Id,\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := fsx.NewOntapVolume(ctx, \"test\", \u0026fsx.OntapVolumeArgs{\n\t\t\tJunctionPath:             pulumi.String(\"/test\"),\n\t\t\tSizeInMegabytes:          pulumi.Int(1024),\n\t\t\tStorageEfficiencyEnabled: pulumi.Bool(true),\n\t\t\tStorageVirtualMachineId:  pulumi.Any(aws_fsx_ontap_storage_virtual_machine.Test.Id),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Using Tiering Policy\n\nAdditional information on tiering policy with ONTAP Volumes can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html).\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst test = new aws.fsx.OntapVolume(\"test\", {\n    junctionPath: \"/test\",\n    sizeInMegabytes: 1024,\n    storageEfficiencyEnabled: true,\n    storageVirtualMachineId: aws_fsx_ontap_storage_virtual_machine.test.id,\n    tieringPolicy: {\n        name: \"AUTO\",\n        coolingPeriod: 31,\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ntest = aws.fsx.OntapVolume(\"test\",\n    junction_path=\"/test\",\n    size_in_megabytes=1024,\n    storage_efficiency_enabled=True,\n    storage_virtual_machine_id=aws_fsx_ontap_storage_virtual_machine[\"test\"][\"id\"],\n    tiering_policy=aws.fsx.OntapVolumeTieringPolicyArgs(\n        name=\"AUTO\",\n        cooling_period=31,\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var test = new Aws.Fsx.OntapVolume(\"test\", new Aws.Fsx.OntapVolumeArgs\n        {\n            JunctionPath = \"/test\",\n            SizeInMegabytes = 1024,\n            StorageEfficiencyEnabled = true,\n            StorageVirtualMachineId = aws_fsx_ontap_storage_virtual_machine.Test.Id,\n            TieringPolicy = new Aws.Fsx.Inputs.OntapVolumeTieringPolicyArgs\n            {\n                Name = \"AUTO\",\n                CoolingPeriod = 31,\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := fsx.NewOntapVolume(ctx, \"test\", \u0026fsx.OntapVolumeArgs{\n\t\t\tJunctionPath:             pulumi.String(\"/test\"),\n\t\t\tSizeInMegabytes:          pulumi.Int(1024),\n\t\t\tStorageEfficiencyEnabled: pulumi.Bool(true),\n\t\t\tStorageVirtualMachineId:  pulumi.Any(aws_fsx_ontap_storage_virtual_machine.Test.Id),\n\t\t\tTieringPolicy: \u0026fsx.OntapVolumeTieringPolicyArgs{\n\t\t\t\tName:          pulumi.String(\"AUTO\"),\n\t\t\t\tCoolingPeriod: pulumi.Int(31),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nFSx ONTAP volume can be imported using the `id`, e.g.,\n\n```sh\n $ pulumi import aws:fsx/ontapVolume:OntapVolume example fsvol-12345678abcdef123\n```\n\n ",
+            "properties": {
+                "arn": {
+                    "type": "string",
+                    "description": "Amazon Resource Name of the volune.\n"
+                },
+                "fileSystemId": {
+                    "type": "string",
+                    "description": "Describes the file system for the volume, e.g. `fs-12345679`\n"
+                },
+                "flexcacheEndpointType": {
+                    "type": "string",
+                    "description": "Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.\n"
+                },
+                "junctionPath": {
+                    "type": "string",
+                    "description": "Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`\n"
+                },
+                "name": {
+                    "type": "string",
+                    "description": "Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.\n"
+                },
+                "ontapVolumeType": {
+                    "type": "string",
+                    "description": "Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)\n"
+                },
+                "securityStyle": {
+                    "type": "string",
+                    "description": "Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.\n"
+                },
+                "sizeInMegabytes": {
+                    "type": "integer",
+                    "description": "Specifies the size of the volume, in megabytes (MB), that you are creating.\n"
+                },
+                "storageEfficiencyEnabled": {
+                    "type": "boolean",
+                    "description": "Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.\n"
+                },
+                "storageVirtualMachineId": {
+                    "type": "string",
+                    "description": "Specifies the storage virtual machine in which to create the volume.\n"
+                },
+                "tags": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                },
+                "tagsAll": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).\n"
+                },
+                "tieringPolicy": {
+                    "$ref": "#/types/aws:fsx/OntapVolumeTieringPolicy:OntapVolumeTieringPolicy"
+                },
+                "uuid": {
+                    "type": "string",
+                    "description": "The Volume's UUID (universally unique identifier).\n"
+                },
+                "volumeType": {
+                    "type": "string",
+                    "description": "The type of volume, currently the only valid value is `ONTAP`.\n"
+                }
+            },
+            "required": [
+                "arn",
+                "fileSystemId",
+                "flexcacheEndpointType",
+                "junctionPath",
+                "name",
+                "ontapVolumeType",
+                "sizeInMegabytes",
+                "storageEfficiencyEnabled",
+                "storageVirtualMachineId",
+                "tagsAll",
+                "uuid"
+            ],
+            "inputProperties": {
+                "junctionPath": {
+                    "type": "string",
+                    "description": "Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`\n"
+                },
+                "name": {
+                    "type": "string",
+                    "description": "Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.\n"
+                },
+                "securityStyle": {
+                    "type": "string",
+                    "description": "Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.\n"
+                },
+                "sizeInMegabytes": {
+                    "type": "integer",
+                    "description": "Specifies the size of the volume, in megabytes (MB), that you are creating.\n"
+                },
+                "storageEfficiencyEnabled": {
+                    "type": "boolean",
+                    "description": "Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.\n"
+                },
+                "storageVirtualMachineId": {
+                    "type": "string",
+                    "description": "Specifies the storage virtual machine in which to create the volume.\n"
+                },
+                "tags": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                },
+                "tagsAll": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "string"
+                    },
+                    "description": "A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).\n"
+                },
+                "tieringPolicy": {
+                    "$ref": "#/types/aws:fsx/OntapVolumeTieringPolicy:OntapVolumeTieringPolicy"
+                },
+                "volumeType": {
+                    "type": "string",
+                    "description": "The type of volume, currently the only valid value is `ONTAP`.\n"
+                }
+            },
+            "requiredInputs": [
+                "junctionPath",
+                "sizeInMegabytes",
+                "storageEfficiencyEnabled",
+                "storageVirtualMachineId"
+            ],
+            "stateInputs": {
+                "description": "Input properties used for looking up and filtering OntapVolume resources.\n",
+                "properties": {
+                    "arn": {
+                        "type": "string",
+                        "description": "Amazon Resource Name of the volune.\n"
+                    },
+                    "fileSystemId": {
+                        "type": "string",
+                        "description": "Describes the file system for the volume, e.g. `fs-12345679`\n"
+                    },
+                    "flexcacheEndpointType": {
+                        "type": "string",
+                        "description": "Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.\n"
+                    },
+                    "junctionPath": {
+                        "type": "string",
+                        "description": "Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`\n"
+                    },
+                    "name": {
+                        "type": "string",
+                        "description": "Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.\n"
+                    },
+                    "ontapVolumeType": {
+                        "type": "string",
+                        "description": "Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)\n"
+                    },
+                    "securityStyle": {
+                        "type": "string",
+                        "description": "Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.\n"
+                    },
+                    "sizeInMegabytes": {
+                        "type": "integer",
+                        "description": "Specifies the size of the volume, in megabytes (MB), that you are creating.\n"
+                    },
+                    "storageEfficiencyEnabled": {
+                        "type": "boolean",
+                        "description": "Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.\n"
+                    },
+                    "storageVirtualMachineId": {
+                        "type": "string",
+                        "description": "Specifies the storage virtual machine in which to create the volume.\n"
+                    },
+                    "tags": {
+                        "type": "object",
+                        "additionalProperties": {
+                            "type": "string"
+                        },
+                        "description": "A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    },
+                    "tagsAll": {
+                        "type": "object",
+                        "additionalProperties": {
+                            "type": "string"
+                        },
+                        "description": "A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).\n"
+                    },
+                    "tieringPolicy": {
+                        "$ref": "#/types/aws:fsx/OntapVolumeTieringPolicy:OntapVolumeTieringPolicy"
+                    },
+                    "uuid": {
+                        "type": "string",
+                        "description": "The Volume's UUID (universally unique identifier).\n"
+                    },
+                    "volumeType": {
+                        "type": "string",
+                        "description": "The type of volume, currently the only valid value is `ONTAP`.\n"
+                    }
+                },
+                "type": "object"
+            }
+        },
         "aws:fsx/windowsFileSystem:WindowsFileSystem": {
             "description": "Manages a FSx Windows File System. See the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html) for more information.\n\n\u003e **NOTE:** Either the `active_directory_id` argument or `self_managed_active_directory` configuration block must be specified.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n### Using AWS Directory Service\n\nAdditional information for using AWS Directory Service with Windows File Systems can be found in the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/fsx-aws-managed-ad.html).\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.fsx.WindowsFileSystem(\"example\", {\n    activeDirectoryId: aws_directory_service_directory.example.id,\n    kmsKeyId: aws_kms_key.example.arn,\n    storageCapacity: 300,\n    subnetIds: [aws_subnet.example.id],\n    throughputCapacity: 1024,\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.fsx.WindowsFileSystem(\"example\",\n    active_directory_id=aws_directory_service_directory[\"example\"][\"id\"],\n    kms_key_id=aws_kms_key[\"example\"][\"arn\"],\n    storage_capacity=300,\n    subnet_ids=[aws_subnet[\"example\"][\"id\"]],\n    throughput_capacity=1024)\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.Fsx.WindowsFileSystem(\"example\", new Aws.Fsx.WindowsFileSystemArgs\n        {\n            ActiveDirectoryId = aws_directory_service_directory.Example.Id,\n            KmsKeyId = aws_kms_key.Example.Arn,\n            StorageCapacity = 300,\n            SubnetIds = \n            {\n                aws_subnet.Example.Id,\n            },\n            ThroughputCapacity = 1024,\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := fsx.NewWindowsFileSystem(ctx, \"example\", \u0026fsx.WindowsFileSystemArgs{\n\t\t\tActiveDirectoryId: pulumi.Any(aws_directory_service_directory.Example.Id),\n\t\t\tKmsKeyId:          pulumi.Any(aws_kms_key.Example.Arn),\n\t\t\tStorageCapacity:   pulumi.Int(300),\n\t\t\tSubnetIds: pulumi.StringArray{\n\t\t\t\tpulumi.Any(aws_subnet.Example.Id),\n\t\t\t},\n\t\t\tThroughputCapacity: pulumi.Int(1024),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Using a Self-Managed Microsoft Active Directory\n\nAdditional information for using AWS Directory Service with Windows File Systems can be found in the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-managed-AD.html).\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.fsx.WindowsFileSystem(\"example\", {\n    kmsKeyId: aws_kms_key.example.arn,\n    storageCapacity: 300,\n    subnetIds: [aws_subnet.example.id],\n    throughputCapacity: 1024,\n    selfManagedActiveDirectory: {\n        dnsIps: [\n            \"10.0.0.111\",\n            \"10.0.0.222\",\n        ],\n        domainName: \"corp.example.com\",\n        password: \"avoid-plaintext-passwords\",\n        username: \"Admin\",\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.fsx.WindowsFileSystem(\"example\",\n    kms_key_id=aws_kms_key[\"example\"][\"arn\"],\n    storage_capacity=300,\n    subnet_ids=[aws_subnet[\"example\"][\"id\"]],\n    throughput_capacity=1024,\n    self_managed_active_directory=aws.fsx.WindowsFileSystemSelfManagedActiveDirectoryArgs(\n        dns_ips=[\n            \"10.0.0.111\",\n            \"10.0.0.222\",\n        ],\n        domain_name=\"corp.example.com\",\n        password=\"avoid-plaintext-passwords\",\n        username=\"Admin\",\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.Fsx.WindowsFileSystem(\"example\", new Aws.Fsx.WindowsFileSystemArgs\n        {\n            KmsKeyId = aws_kms_key.Example.Arn,\n            StorageCapacity = 300,\n            SubnetIds = \n            {\n                aws_subnet.Example.Id,\n            },\n            ThroughputCapacity = 1024,\n            SelfManagedActiveDirectory = new Aws.Fsx.Inputs.WindowsFileSystemSelfManagedActiveDirectoryArgs\n            {\n                DnsIps = \n                {\n                    \"10.0.0.111\",\n                    \"10.0.0.222\",\n                },\n                DomainName = \"corp.example.com\",\n                Password = \"avoid-plaintext-passwords\",\n                Username = \"Admin\",\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := fsx.NewWindowsFileSystem(ctx, \"example\", \u0026fsx.WindowsFileSystemArgs{\n\t\t\tKmsKeyId:        pulumi.Any(aws_kms_key.Example.Arn),\n\t\t\tStorageCapacity: pulumi.Int(300),\n\t\t\tSubnetIds: pulumi.StringArray{\n\t\t\t\tpulumi.Any(aws_subnet.Example.Id),\n\t\t\t},\n\t\t\tThroughputCapacity: pulumi.Int(1024),\n\t\t\tSelfManagedActiveDirectory: \u0026fsx.WindowsFileSystemSelfManagedActiveDirectoryArgs{\n\t\t\t\tDnsIps: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"10.0.0.111\"),\n\t\t\t\t\tpulumi.String(\"10.0.0.222\"),\n\t\t\t\t},\n\t\t\t\tDomainName: pulumi.String(\"corp.example.com\"),\n\t\t\t\tPassword:   pulumi.String(\"avoid-plaintext-passwords\"),\n\t\t\t\tUsername:   pulumi.String(\"Admin\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nFSx File Systems can be imported using the `id`, e.g.,\n\n```sh\n $ pulumi import aws:fsx/windowsFileSystem:WindowsFileSystem example fs-543ab12b1ca672f33\n```\n\n Certain resource arguments, like `security_group_ids` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the provider configuration on an imported resource, the povider will always show a difference. To workaround this behavior, either omit the argument from the configuration or use [`ignoreChanges`](https://www.pulumi.com/docs/intro/concepts/programming-model/#ignorechanges) to hide the difference, e.g. terraform resource \"aws_fsx_windows_file_system\" \"example\" {\n\n # ... other configuration ...\n\n security_group_ids = [aws_security_group.example.id]\n\n # There is no FSx API for reading security_group_ids\n\n lifecycle {\n\n\n\n ignore_changes = [security_group_ids]\n\n } } ",
             "properties": {
@@ -250832,6 +255272,10 @@
                     "type": "string",
                     "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dnsName": {
                     "type": "string",
                     "description": "The DNS name of the load balancer.\n"
@@ -250852,6 +255296,10 @@
                     "type": "boolean",
                     "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                 },
+                "enableWafFailOpen": {
+                    "type": "boolean",
+                    "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                },
                 "idleTimeout": {
                     "type": "integer",
                     "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -250902,7 +255350,7 @@
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 },
                 "tagsAll": {
                     "type": "object",
@@ -250942,6 +255390,10 @@
                     "type": "string",
                     "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                 },
+                "desyncMitigationMode": {
+                    "type": "string",
+                    "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                },
                 "dropInvalidHeaderFields": {
                     "type": "boolean",
                     "description": "Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.\n"
@@ -250958,6 +255410,10 @@
                     "type": "boolean",
                     "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                 },
+                "enableWafFailOpen": {
+                    "type": "boolean",
+                    "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                },
                 "idleTimeout": {
                     "type": "integer",
                     "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -251008,7 +255464,7 @@
                     "additionalProperties": {
                         "type": "string"
                     },
-                    "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                    "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                 }
             },
             "stateInputs": {
@@ -251030,6 +255486,10 @@
                         "type": "string",
                         "description": "The ID of the customer owned ipv4 pool to use for this load balancer.\n"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string",
+                        "description": "Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.\n"
+                    },
                     "dnsName": {
                         "type": "string",
                         "description": "The DNS name of the load balancer.\n"
@@ -251050,6 +255510,10 @@
                         "type": "boolean",
                         "description": "Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.\n"
                     },
+                    "enableWafFailOpen": {
+                        "type": "boolean",
+                        "description": "Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.\n"
+                    },
                     "idleTimeout": {
                         "type": "integer",
                         "description": "The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.\n"
@@ -251100,7 +255564,7 @@
                         "additionalProperties": {
                             "type": "string"
                         },
-                        "description": "A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
+                        "description": "A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.\n"
                     },
                     "tagsAll": {
                         "type": "object",
@@ -265254,11 +269718,11 @@
                 },
                 "sessionName": {
                     "type": "string",
-                    "description": "The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.\n"
+                    "description": "The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.\n"
                 },
                 "userName": {
                     "type": "string",
-                    "description": "The Amazon QuickSight user name that you want to create for the user you are registering.\n"
+                    "description": "The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.\n"
                 },
                 "userRole": {
                     "type": "string",
@@ -265295,11 +269759,11 @@
                 },
                 "sessionName": {
                     "type": "string",
-                    "description": "The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.\n"
+                    "description": "The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.\n"
                 },
                 "userName": {
                     "type": "string",
-                    "description": "The Amazon QuickSight user name that you want to create for the user you are registering.\n"
+                    "description": "The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.\n"
                 },
                 "userRole": {
                     "type": "string",
@@ -265340,11 +269804,11 @@
                     },
                     "sessionName": {
                         "type": "string",
-                        "description": "The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.\n"
+                        "description": "The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.\n"
                     },
                     "userName": {
                         "type": "string",
-                        "description": "The Amazon QuickSight user name that you want to create for the user you are registering.\n"
+                        "description": "The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.\n"
                     },
                     "userRole": {
                         "type": "string",
@@ -294041,6 +298505,13 @@
                     "type": "integer",
                     "description": "The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.\n"
                 },
+                "customResponseBodies": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:wafv2/RuleGroupCustomResponseBody:RuleGroupCustomResponseBody"
+                    },
+                    "description": "Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.\n"
+                },
                 "description": {
                     "type": "string",
                     "description": "A friendly description of the rule group.\n"
@@ -294050,7 +298521,7 @@
                 },
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n"
+                    "description": "The label string.\n"
                 },
                 "rules": {
                     "type": "array",
@@ -294096,13 +298567,20 @@
                     "type": "integer",
                     "description": "The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.\n"
                 },
+                "customResponseBodies": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:wafv2/RuleGroupCustomResponseBody:RuleGroupCustomResponseBody"
+                    },
+                    "description": "Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.\n"
+                },
                 "description": {
                     "type": "string",
                     "description": "A friendly description of the rule group.\n"
                 },
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n"
+                    "description": "The label string.\n"
                 },
                 "rules": {
                     "type": "array",
@@ -294150,6 +298628,13 @@
                         "type": "integer",
                         "description": "The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.\n"
                     },
+                    "customResponseBodies": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/types/aws:wafv2/RuleGroupCustomResponseBody:RuleGroupCustomResponseBody"
+                        },
+                        "description": "Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.\n"
+                    },
                     "description": {
                         "type": "string",
                         "description": "A friendly description of the rule group.\n"
@@ -294159,7 +298644,7 @@
                     },
                     "name": {
                         "type": "string",
-                        "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n"
+                        "description": "The label string.\n"
                     },
                     "rules": {
                         "type": "array",
@@ -294195,7 +298680,7 @@
             }
         },
         "aws:wafv2/webAcl:WebAcl": {
-            "description": "Creates a WAFv2 Web ACL resource.\n\n{{% examples %}}\n## Example Usage\n\nThis resource is based on `aws.wafv2.RuleGroup`, check the documentation of the `aws.wafv2.RuleGroup` resource to see examples of the various available statements.\n\n{{% example %}}\n### Managed Rule\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.wafv2.WebAcl(\"example\", {\n    defaultAction: {\n        allow: {},\n    },\n    description: \"Example of a managed rule.\",\n    rules: [{\n        name: \"rule-1\",\n        overrideAction: {\n            count: {},\n        },\n        priority: 1,\n        statement: {\n            managedRuleGroupStatement: {\n                excludedRules: [\n                    {\n                        name: \"SizeRestrictions_QUERYSTRING\",\n                    },\n                    {\n                        name: \"NoUserAgent_HEADER\",\n                    },\n                ],\n                name: \"AWSManagedRulesCommonRuleSet\",\n                scopeDownStatement: {\n                    geoMatchStatement: {\n                        countryCodes: [\n                            \"US\",\n                            \"NL\",\n                        ],\n                    },\n                },\n                vendorName: \"AWS\",\n            },\n        },\n        visibilityConfig: {\n            cloudwatchMetricsEnabled: false,\n            metricName: \"friendly-rule-metric-name\",\n            sampledRequestsEnabled: false,\n        },\n    }],\n    scope: \"REGIONAL\",\n    tags: {\n        Tag1: \"Value1\",\n        Tag2: \"Value2\",\n    },\n    visibilityConfig: {\n        cloudwatchMetricsEnabled: false,\n        metricName: \"friendly-metric-name\",\n        sampledRequestsEnabled: false,\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.wafv2.WebAcl(\"example\",\n    default_action=aws.wafv2.WebAclDefaultActionArgs(\n        allow=aws.wafv2.WebAclDefaultActionAllowArgs(),\n    ),\n    description=\"Example of a managed rule.\",\n    rules=[aws.wafv2.WebAclRuleArgs(\n        name=\"rule-1\",\n        override_action=aws.wafv2.WebAclRuleOverrideActionArgs(\n            count=aws.wafv2.WebAclRuleOverrideActionCountArgs(),\n        ),\n        priority=1,\n        statement=aws.wafv2.WebAclRuleStatementArgs(\n            managed_rule_group_statement=aws.wafv2.WebAclRuleStatementManagedRuleGroupStatementArgs(\n                excluded_rule=[\n                    {\n                        \"name\": \"SizeRestrictions_QUERYSTRING\",\n                    },\n                    {\n                        \"name\": \"NoUserAgent_HEADER\",\n                    },\n                ],\n                name=\"AWSManagedRulesCommonRuleSet\",\n                scope_down_statement=aws.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs(\n                    geo_match_statement=aws.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs(\n                        country_codes=[\n                            \"US\",\n                            \"NL\",\n                        ],\n                    ),\n                ),\n                vendor_name=\"AWS\",\n            ),\n        ),\n        visibility_config=aws.wafv2.WebAclRuleVisibilityConfigArgs(\n            cloudwatch_metrics_enabled=False,\n            metric_name=\"friendly-rule-metric-name\",\n            sampled_requests_enabled=False,\n        ),\n    )],\n    scope=\"REGIONAL\",\n    tags={\n        \"Tag1\": \"Value1\",\n        \"Tag2\": \"Value2\",\n    },\n    visibility_config=aws.wafv2.WebAclVisibilityConfigArgs(\n        cloudwatch_metrics_enabled=False,\n        metric_name=\"friendly-metric-name\",\n        sampled_requests_enabled=False,\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.WafV2.WebAcl(\"example\", new Aws.WafV2.WebAclArgs\n        {\n            DefaultAction = new Aws.WafV2.Inputs.WebAclDefaultActionArgs\n            {\n                Allow = ,\n            },\n            Description = \"Example of a managed rule.\",\n            Rules = \n            {\n                new Aws.WafV2.Inputs.WebAclRuleArgs\n                {\n                    Name = \"rule-1\",\n                    OverrideAction = new Aws.WafV2.Inputs.WebAclRuleOverrideActionArgs\n                    {\n                        Count = ,\n                    },\n                    Priority = 1,\n                    Statement = new Aws.WafV2.Inputs.WebAclRuleStatementArgs\n                    {\n                        ManagedRuleGroupStatement = new Aws.WafV2.Inputs.WebAclRuleStatementManagedRuleGroupStatementArgs\n                        {\n                            ExcludedRule = \n                            {\n                                \n                                {\n                                    { \"name\", \"SizeRestrictions_QUERYSTRING\" },\n                                },\n                                \n                                {\n                                    { \"name\", \"NoUserAgent_HEADER\" },\n                                },\n                            },\n                            Name = \"AWSManagedRulesCommonRuleSet\",\n                            ScopeDownStatement = new Aws.WafV2.Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs\n                            {\n                                GeoMatchStatement = new Aws.WafV2.Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs\n                                {\n                                    CountryCodes = \n                                    {\n                                        \"US\",\n                                        \"NL\",\n                                    },\n                                },\n                            },\n                            VendorName = \"AWS\",\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.WebAclRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n            },\n            Scope = \"REGIONAL\",\n            Tags = \n            {\n                { \"Tag1\", \"Value1\" },\n                { \"Tag2\", \"Value2\" },\n            },\n            VisibilityConfig = new Aws.WafV2.Inputs.WebAclVisibilityConfigArgs\n            {\n                CloudwatchMetricsEnabled = false,\n                MetricName = \"friendly-metric-name\",\n                SampledRequestsEnabled = false,\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/wafv2\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := wafv2.NewWebAcl(ctx, \"example\", \u0026wafv2.WebAclArgs{\n\t\t\tDefaultAction: \u0026wafv2.WebAclDefaultActionArgs{\n\t\t\t\tAllow: nil,\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"Example of a managed rule.\"),\n\t\t\tRules: wafv2.WebAclRuleArray{\n\t\t\t\t\u0026wafv2.WebAclRuleArgs{\n\t\t\t\t\tName: pulumi.String(\"rule-1\"),\n\t\t\t\t\tOverrideAction: \u0026wafv2.WebAclRuleOverrideActionArgs{\n\t\t\t\t\t\tCount: nil,\n\t\t\t\t\t},\n\t\t\t\t\tPriority: pulumi.Int(1),\n\t\t\t\t\tStatement: \u0026wafv2.WebAclRuleStatementArgs{\n\t\t\t\t\t\tManagedRuleGroupStatement: \u0026wafv2.WebAclRuleStatementManagedRuleGroupStatementArgs{\n\t\t\t\t\t\t\tExcludedRule: []map[string]interface{}{\n\t\t\t\t\t\t\t\tmap[string]interface{}{\n\t\t\t\t\t\t\t\t\t\"name\": \"SizeRestrictions_QUERYSTRING\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tmap[string]interface{}{\n\t\t\t\t\t\t\t\t\t\"name\": \"NoUserAgent_HEADER\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tName: pulumi.String(\"AWSManagedRulesCommonRuleSet\"),\n\t\t\t\t\t\t\tScopeDownStatement: \u0026wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs{\n\t\t\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\t\t\tpulumi.String(\"US\"),\n\t\t\t\t\t\t\t\t\t\tpulumi.String(\"NL\"),\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tVendorName: pulumi.String(\"AWS\"),\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.WebAclRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tScope: pulumi.String(\"REGIONAL\"),\n\t\t\tTags: pulumi.StringMap{\n\t\t\t\t\"Tag1\": pulumi.String(\"Value1\"),\n\t\t\t\t\"Tag2\": pulumi.String(\"Value2\"),\n\t\t\t},\n\t\t\tVisibilityConfig: \u0026wafv2.WebAclVisibilityConfigArgs{\n\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\tMetricName:               pulumi.String(\"friendly-metric-name\"),\n\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Rate Based\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.wafv2.WebAcl(\"example\", {\n    defaultAction: {\n        block: {},\n    },\n    description: \"Example of a rate based statement.\",\n    rules: [{\n        action: {\n            count: {},\n        },\n        name: \"rule-1\",\n        priority: 1,\n        statement: {\n            rateBasedStatement: {\n                aggregateKeyType: \"IP\",\n                limit: 10000,\n                scopeDownStatement: {\n                    geoMatchStatement: {\n                        countryCodes: [\n                            \"US\",\n                            \"NL\",\n                        ],\n                    },\n                },\n            },\n        },\n        visibilityConfig: {\n            cloudwatchMetricsEnabled: false,\n            metricName: \"friendly-rule-metric-name\",\n            sampledRequestsEnabled: false,\n        },\n    }],\n    scope: \"REGIONAL\",\n    tags: {\n        Tag1: \"Value1\",\n        Tag2: \"Value2\",\n    },\n    visibilityConfig: {\n        cloudwatchMetricsEnabled: false,\n        metricName: \"friendly-metric-name\",\n        sampledRequestsEnabled: false,\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.wafv2.WebAcl(\"example\",\n    default_action=aws.wafv2.WebAclDefaultActionArgs(\n        block=aws.wafv2.WebAclDefaultActionBlockArgs(),\n    ),\n    description=\"Example of a rate based statement.\",\n    rules=[aws.wafv2.WebAclRuleArgs(\n        action=aws.wafv2.WebAclRuleActionArgs(\n            count=aws.wafv2.WebAclRuleActionCountArgs(),\n        ),\n        name=\"rule-1\",\n        priority=1,\n        statement=aws.wafv2.WebAclRuleStatementArgs(\n            rate_based_statement=aws.wafv2.WebAclRuleStatementRateBasedStatementArgs(\n                aggregate_key_type=\"IP\",\n                limit=10000,\n                scope_down_statement=aws.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementArgs(\n                    geo_match_statement=aws.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs(\n                        country_codes=[\n                            \"US\",\n                            \"NL\",\n                        ],\n                    ),\n                ),\n            ),\n        ),\n        visibility_config=aws.wafv2.WebAclRuleVisibilityConfigArgs(\n            cloudwatch_metrics_enabled=False,\n            metric_name=\"friendly-rule-metric-name\",\n            sampled_requests_enabled=False,\n        ),\n    )],\n    scope=\"REGIONAL\",\n    tags={\n        \"Tag1\": \"Value1\",\n        \"Tag2\": \"Value2\",\n    },\n    visibility_config=aws.wafv2.WebAclVisibilityConfigArgs(\n        cloudwatch_metrics_enabled=False,\n        metric_name=\"friendly-metric-name\",\n        sampled_requests_enabled=False,\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.WafV2.WebAcl(\"example\", new Aws.WafV2.WebAclArgs\n        {\n            DefaultAction = new Aws.WafV2.Inputs.WebAclDefaultActionArgs\n            {\n                Block = ,\n            },\n            Description = \"Example of a rate based statement.\",\n            Rules = \n            {\n                new Aws.WafV2.Inputs.WebAclRuleArgs\n                {\n                    Action = new Aws.WafV2.Inputs.WebAclRuleActionArgs\n                    {\n                        Count = ,\n                    },\n                    Name = \"rule-1\",\n                    Priority = 1,\n                    Statement = new Aws.WafV2.Inputs.WebAclRuleStatementArgs\n                    {\n                        RateBasedStatement = new Aws.WafV2.Inputs.WebAclRuleStatementRateBasedStatementArgs\n                        {\n                            AggregateKeyType = \"IP\",\n                            Limit = 10000,\n                            ScopeDownStatement = new Aws.WafV2.Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementArgs\n                            {\n                                GeoMatchStatement = new Aws.WafV2.Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs\n                                {\n                                    CountryCodes = \n                                    {\n                                        \"US\",\n                                        \"NL\",\n                                    },\n                                },\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.WebAclRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n            },\n            Scope = \"REGIONAL\",\n            Tags = \n            {\n                { \"Tag1\", \"Value1\" },\n                { \"Tag2\", \"Value2\" },\n            },\n            VisibilityConfig = new Aws.WafV2.Inputs.WebAclVisibilityConfigArgs\n            {\n                CloudwatchMetricsEnabled = false,\n                MetricName = \"friendly-metric-name\",\n                SampledRequestsEnabled = false,\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/wafv2\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := wafv2.NewWebAcl(ctx, \"example\", \u0026wafv2.WebAclArgs{\n\t\t\tDefaultAction: \u0026wafv2.WebAclDefaultActionArgs{\n\t\t\t\tBlock: nil,\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"Example of a rate based statement.\"),\n\t\t\tRules: wafv2.WebAclRuleArray{\n\t\t\t\t\u0026wafv2.WebAclRuleArgs{\n\t\t\t\t\tAction: \u0026wafv2.WebAclRuleActionArgs{\n\t\t\t\t\t\tCount: nil,\n\t\t\t\t\t},\n\t\t\t\t\tName:     pulumi.String(\"rule-1\"),\n\t\t\t\t\tPriority: pulumi.Int(1),\n\t\t\t\t\tStatement: \u0026wafv2.WebAclRuleStatementArgs{\n\t\t\t\t\t\tRateBasedStatement: \u0026wafv2.WebAclRuleStatementRateBasedStatementArgs{\n\t\t\t\t\t\t\tAggregateKeyType: pulumi.String(\"IP\"),\n\t\t\t\t\t\t\tLimit:            pulumi.Int(10000),\n\t\t\t\t\t\t\tScopeDownStatement: \u0026wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementArgs{\n\t\t\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\t\t\tpulumi.String(\"US\"),\n\t\t\t\t\t\t\t\t\t\tpulumi.String(\"NL\"),\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.WebAclRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tScope: pulumi.String(\"REGIONAL\"),\n\t\t\tTags: pulumi.StringMap{\n\t\t\t\t\"Tag1\": pulumi.String(\"Value1\"),\n\t\t\t\t\"Tag2\": pulumi.String(\"Value2\"),\n\t\t\t},\n\t\t\tVisibilityConfig: \u0026wafv2.WebAclVisibilityConfigArgs{\n\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\tMetricName:               pulumi.String(\"friendly-metric-name\"),\n\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Rule Group Reference\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.wafv2.RuleGroup(\"example\", {\n    capacity: 10,\n    scope: \"REGIONAL\",\n    rules: [\n        {\n            name: \"rule-1\",\n            priority: 1,\n            action: {\n                count: {},\n            },\n            statement: {\n                geoMatchStatement: {\n                    countryCodes: [\"NL\"],\n                },\n            },\n            visibilityConfig: {\n                cloudwatchMetricsEnabled: false,\n                metricName: \"friendly-rule-metric-name\",\n                sampledRequestsEnabled: false,\n            },\n        },\n        {\n            name: \"rule-to-exclude-a\",\n            priority: 10,\n            action: {\n                allow: {},\n            },\n            statement: {\n                geoMatchStatement: {\n                    countryCodes: [\"US\"],\n                },\n            },\n            visibilityConfig: {\n                cloudwatchMetricsEnabled: false,\n                metricName: \"friendly-rule-metric-name\",\n                sampledRequestsEnabled: false,\n            },\n        },\n        {\n            name: \"rule-to-exclude-b\",\n            priority: 15,\n            action: {\n                allow: {},\n            },\n            statement: {\n                geoMatchStatement: {\n                    countryCodes: [\"GB\"],\n                },\n            },\n            visibilityConfig: {\n                cloudwatchMetricsEnabled: false,\n                metricName: \"friendly-rule-metric-name\",\n                sampledRequestsEnabled: false,\n            },\n        },\n    ],\n    visibilityConfig: {\n        cloudwatchMetricsEnabled: false,\n        metricName: \"friendly-metric-name\",\n        sampledRequestsEnabled: false,\n    },\n});\nconst test = new aws.wafv2.WebAcl(\"test\", {\n    scope: \"REGIONAL\",\n    defaultAction: {\n        block: {},\n    },\n    rules: [{\n        name: \"rule-1\",\n        priority: 1,\n        overrideAction: {\n            count: {},\n        },\n        statement: {\n            ruleGroupReferenceStatement: {\n                arn: example.arn,\n                excludedRules: [\n                    {\n                        name: \"rule-to-exclude-b\",\n                    },\n                    {\n                        name: \"rule-to-exclude-a\",\n                    },\n                ],\n            },\n        },\n        visibilityConfig: {\n            cloudwatchMetricsEnabled: false,\n            metricName: \"friendly-rule-metric-name\",\n            sampledRequestsEnabled: false,\n        },\n    }],\n    tags: {\n        Tag1: \"Value1\",\n        Tag2: \"Value2\",\n    },\n    visibilityConfig: {\n        cloudwatchMetricsEnabled: false,\n        metricName: \"friendly-metric-name\",\n        sampledRequestsEnabled: false,\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.wafv2.RuleGroup(\"example\",\n    capacity=10,\n    scope=\"REGIONAL\",\n    rules=[\n        aws.wafv2.RuleGroupRuleArgs(\n            name=\"rule-1\",\n            priority=1,\n            action=aws.wafv2.RuleGroupRuleActionArgs(\n                count=aws.wafv2.RuleGroupRuleActionCountArgs(),\n            ),\n            statement=aws.wafv2.RuleGroupRuleStatementArgs(\n                geo_match_statement=aws.wafv2.RuleGroupRuleStatementGeoMatchStatementArgs(\n                    country_codes=[\"NL\"],\n                ),\n            ),\n            visibility_config=aws.wafv2.RuleGroupRuleVisibilityConfigArgs(\n                cloudwatch_metrics_enabled=False,\n                metric_name=\"friendly-rule-metric-name\",\n                sampled_requests_enabled=False,\n            ),\n        ),\n        aws.wafv2.RuleGroupRuleArgs(\n            name=\"rule-to-exclude-a\",\n            priority=10,\n            action=aws.wafv2.RuleGroupRuleActionArgs(\n                allow=aws.wafv2.RuleGroupRuleActionAllowArgs(),\n            ),\n            statement=aws.wafv2.RuleGroupRuleStatementArgs(\n                geo_match_statement=aws.wafv2.RuleGroupRuleStatementGeoMatchStatementArgs(\n                    country_codes=[\"US\"],\n                ),\n            ),\n            visibility_config=aws.wafv2.RuleGroupRuleVisibilityConfigArgs(\n                cloudwatch_metrics_enabled=False,\n                metric_name=\"friendly-rule-metric-name\",\n                sampled_requests_enabled=False,\n            ),\n        ),\n        aws.wafv2.RuleGroupRuleArgs(\n            name=\"rule-to-exclude-b\",\n            priority=15,\n            action=aws.wafv2.RuleGroupRuleActionArgs(\n                allow=aws.wafv2.RuleGroupRuleActionAllowArgs(),\n            ),\n            statement=aws.wafv2.RuleGroupRuleStatementArgs(\n                geo_match_statement=aws.wafv2.RuleGroupRuleStatementGeoMatchStatementArgs(\n                    country_codes=[\"GB\"],\n                ),\n            ),\n            visibility_config=aws.wafv2.RuleGroupRuleVisibilityConfigArgs(\n                cloudwatch_metrics_enabled=False,\n                metric_name=\"friendly-rule-metric-name\",\n                sampled_requests_enabled=False,\n            ),\n        ),\n    ],\n    visibility_config=aws.wafv2.RuleGroupVisibilityConfigArgs(\n        cloudwatch_metrics_enabled=False,\n        metric_name=\"friendly-metric-name\",\n        sampled_requests_enabled=False,\n    ))\ntest = aws.wafv2.WebAcl(\"test\",\n    scope=\"REGIONAL\",\n    default_action=aws.wafv2.WebAclDefaultActionArgs(\n        block=aws.wafv2.WebAclDefaultActionBlockArgs(),\n    ),\n    rules=[aws.wafv2.WebAclRuleArgs(\n        name=\"rule-1\",\n        priority=1,\n        override_action=aws.wafv2.WebAclRuleOverrideActionArgs(\n            count=aws.wafv2.WebAclRuleOverrideActionCountArgs(),\n        ),\n        statement=aws.wafv2.WebAclRuleStatementArgs(\n            rule_group_reference_statement=aws.wafv2.WebAclRuleStatementRuleGroupReferenceStatementArgs(\n                arn=example.arn,\n                excluded_rules=[\n                    aws.wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs(\n                        name=\"rule-to-exclude-b\",\n                    ),\n                    aws.wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs(\n                        name=\"rule-to-exclude-a\",\n                    ),\n                ],\n            ),\n        ),\n        visibility_config=aws.wafv2.WebAclRuleVisibilityConfigArgs(\n            cloudwatch_metrics_enabled=False,\n            metric_name=\"friendly-rule-metric-name\",\n            sampled_requests_enabled=False,\n        ),\n    )],\n    tags={\n        \"Tag1\": \"Value1\",\n        \"Tag2\": \"Value2\",\n    },\n    visibility_config=aws.wafv2.WebAclVisibilityConfigArgs(\n        cloudwatch_metrics_enabled=False,\n        metric_name=\"friendly-metric-name\",\n        sampled_requests_enabled=False,\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.WafV2.RuleGroup(\"example\", new Aws.WafV2.RuleGroupArgs\n        {\n            Capacity = 10,\n            Scope = \"REGIONAL\",\n            Rules = \n            {\n                new Aws.WafV2.Inputs.RuleGroupRuleArgs\n                {\n                    Name = \"rule-1\",\n                    Priority = 1,\n                    Action = new Aws.WafV2.Inputs.RuleGroupRuleActionArgs\n                    {\n                        Count = ,\n                    },\n                    Statement = new Aws.WafV2.Inputs.RuleGroupRuleStatementArgs\n                    {\n                        GeoMatchStatement = new Aws.WafV2.Inputs.RuleGroupRuleStatementGeoMatchStatementArgs\n                        {\n                            CountryCodes = \n                            {\n                                \"NL\",\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.RuleGroupRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n                new Aws.WafV2.Inputs.RuleGroupRuleArgs\n                {\n                    Name = \"rule-to-exclude-a\",\n                    Priority = 10,\n                    Action = new Aws.WafV2.Inputs.RuleGroupRuleActionArgs\n                    {\n                        Allow = ,\n                    },\n                    Statement = new Aws.WafV2.Inputs.RuleGroupRuleStatementArgs\n                    {\n                        GeoMatchStatement = new Aws.WafV2.Inputs.RuleGroupRuleStatementGeoMatchStatementArgs\n                        {\n                            CountryCodes = \n                            {\n                                \"US\",\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.RuleGroupRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n                new Aws.WafV2.Inputs.RuleGroupRuleArgs\n                {\n                    Name = \"rule-to-exclude-b\",\n                    Priority = 15,\n                    Action = new Aws.WafV2.Inputs.RuleGroupRuleActionArgs\n                    {\n                        Allow = ,\n                    },\n                    Statement = new Aws.WafV2.Inputs.RuleGroupRuleStatementArgs\n                    {\n                        GeoMatchStatement = new Aws.WafV2.Inputs.RuleGroupRuleStatementGeoMatchStatementArgs\n                        {\n                            CountryCodes = \n                            {\n                                \"GB\",\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.RuleGroupRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n            },\n            VisibilityConfig = new Aws.WafV2.Inputs.RuleGroupVisibilityConfigArgs\n            {\n                CloudwatchMetricsEnabled = false,\n                MetricName = \"friendly-metric-name\",\n                SampledRequestsEnabled = false,\n            },\n        });\n        var test = new Aws.WafV2.WebAcl(\"test\", new Aws.WafV2.WebAclArgs\n        {\n            Scope = \"REGIONAL\",\n            DefaultAction = new Aws.WafV2.Inputs.WebAclDefaultActionArgs\n            {\n                Block = ,\n            },\n            Rules = \n            {\n                new Aws.WafV2.Inputs.WebAclRuleArgs\n                {\n                    Name = \"rule-1\",\n                    Priority = 1,\n                    OverrideAction = new Aws.WafV2.Inputs.WebAclRuleOverrideActionArgs\n                    {\n                        Count = ,\n                    },\n                    Statement = new Aws.WafV2.Inputs.WebAclRuleStatementArgs\n                    {\n                        RuleGroupReferenceStatement = new Aws.WafV2.Inputs.WebAclRuleStatementRuleGroupReferenceStatementArgs\n                        {\n                            Arn = example.Arn,\n                            ExcludedRules = \n                            {\n                                new Aws.WafV2.Inputs.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs\n                                {\n                                    Name = \"rule-to-exclude-b\",\n                                },\n                                new Aws.WafV2.Inputs.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs\n                                {\n                                    Name = \"rule-to-exclude-a\",\n                                },\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.WebAclRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n            },\n            Tags = \n            {\n                { \"Tag1\", \"Value1\" },\n                { \"Tag2\", \"Value2\" },\n            },\n            VisibilityConfig = new Aws.WafV2.Inputs.WebAclVisibilityConfigArgs\n            {\n                CloudwatchMetricsEnabled = false,\n                MetricName = \"friendly-metric-name\",\n                SampledRequestsEnabled = false,\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/wafv2\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := wafv2.NewRuleGroup(ctx, \"example\", \u0026wafv2.RuleGroupArgs{\n\t\t\tCapacity: pulumi.Int(10),\n\t\t\tScope:    pulumi.String(\"REGIONAL\"),\n\t\t\tRules: wafv2.RuleGroupRuleArray{\n\t\t\t\t\u0026wafv2.RuleGroupRuleArgs{\n\t\t\t\t\tName:     pulumi.String(\"rule-1\"),\n\t\t\t\t\tPriority: pulumi.Int(1),\n\t\t\t\t\tAction: \u0026wafv2.RuleGroupRuleActionArgs{\n\t\t\t\t\t\tCount: nil,\n\t\t\t\t\t},\n\t\t\t\t\tStatement: \u0026wafv2.RuleGroupRuleStatementArgs{\n\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.RuleGroupRuleStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\tpulumi.String(\"NL\"),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.RuleGroupRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\t\u0026wafv2.RuleGroupRuleArgs{\n\t\t\t\t\tName:     pulumi.String(\"rule-to-exclude-a\"),\n\t\t\t\t\tPriority: pulumi.Int(10),\n\t\t\t\t\tAction: \u0026wafv2.RuleGroupRuleActionArgs{\n\t\t\t\t\t\tAllow: nil,\n\t\t\t\t\t},\n\t\t\t\t\tStatement: \u0026wafv2.RuleGroupRuleStatementArgs{\n\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.RuleGroupRuleStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\tpulumi.String(\"US\"),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.RuleGroupRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\t\u0026wafv2.RuleGroupRuleArgs{\n\t\t\t\t\tName:     pulumi.String(\"rule-to-exclude-b\"),\n\t\t\t\t\tPriority: pulumi.Int(15),\n\t\t\t\t\tAction: \u0026wafv2.RuleGroupRuleActionArgs{\n\t\t\t\t\t\tAllow: nil,\n\t\t\t\t\t},\n\t\t\t\t\tStatement: \u0026wafv2.RuleGroupRuleStatementArgs{\n\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.RuleGroupRuleStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\tpulumi.String(\"GB\"),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.RuleGroupRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tVisibilityConfig: \u0026wafv2.RuleGroupVisibilityConfigArgs{\n\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\tMetricName:               pulumi.String(\"friendly-metric-name\"),\n\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = wafv2.NewWebAcl(ctx, \"test\", \u0026wafv2.WebAclArgs{\n\t\t\tScope: pulumi.String(\"REGIONAL\"),\n\t\t\tDefaultAction: \u0026wafv2.WebAclDefaultActionArgs{\n\t\t\t\tBlock: nil,\n\t\t\t},\n\t\t\tRules: wafv2.WebAclRuleArray{\n\t\t\t\t\u0026wafv2.WebAclRuleArgs{\n\t\t\t\t\tName:     pulumi.String(\"rule-1\"),\n\t\t\t\t\tPriority: pulumi.Int(1),\n\t\t\t\t\tOverrideAction: \u0026wafv2.WebAclRuleOverrideActionArgs{\n\t\t\t\t\t\tCount: nil,\n\t\t\t\t\t},\n\t\t\t\t\tStatement: \u0026wafv2.WebAclRuleStatementArgs{\n\t\t\t\t\t\tRuleGroupReferenceStatement: \u0026wafv2.WebAclRuleStatementRuleGroupReferenceStatementArgs{\n\t\t\t\t\t\t\tArn: example.Arn,\n\t\t\t\t\t\t\tExcludedRules: wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArray{\n\t\t\t\t\t\t\t\t\u0026wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs{\n\t\t\t\t\t\t\t\t\tName: pulumi.String(\"rule-to-exclude-b\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\u0026wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs{\n\t\t\t\t\t\t\t\t\tName: pulumi.String(\"rule-to-exclude-a\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.WebAclRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tTags: pulumi.StringMap{\n\t\t\t\t\"Tag1\": pulumi.String(\"Value1\"),\n\t\t\t\t\"Tag2\": pulumi.String(\"Value2\"),\n\t\t\t},\n\t\t\tVisibilityConfig: \u0026wafv2.WebAclVisibilityConfigArgs{\n\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\tMetricName:               pulumi.String(\"friendly-metric-name\"),\n\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nWAFv2 Web ACLs can be imported using `ID/Name/Scope` e.g.,\n\n```sh\n $ pulumi import aws:wafv2/webAcl:WebAcl example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL\n```\n\n ",
+            "description": "Creates a WAFv2 Web ACL resource.\n\n{{% examples %}}\n## Example Usage\n\nThis resource is based on `aws.wafv2.RuleGroup`, check the documentation of the `aws.wafv2.RuleGroup` resource to see examples of the various available statements.\n\n{{% example %}}\n### Managed Rule\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.wafv2.WebAcl(\"example\", {\n    defaultAction: {\n        allow: {},\n    },\n    description: \"Example of a managed rule.\",\n    rules: [{\n        name: \"rule-1\",\n        overrideAction: {\n            count: {},\n        },\n        priority: 1,\n        statement: {\n            managedRuleGroupStatement: {\n                excludedRules: [\n                    {\n                        name: \"SizeRestrictions_QUERYSTRING\",\n                    },\n                    {\n                        name: \"NoUserAgent_HEADER\",\n                    },\n                ],\n                name: \"AWSManagedRulesCommonRuleSet\",\n                scopeDownStatement: {\n                    geoMatchStatement: {\n                        countryCodes: [\n                            \"US\",\n                            \"NL\",\n                        ],\n                    },\n                },\n                vendorName: \"AWS\",\n            },\n        },\n        visibilityConfig: {\n            cloudwatchMetricsEnabled: false,\n            metricName: \"friendly-rule-metric-name\",\n            sampledRequestsEnabled: false,\n        },\n    }],\n    scope: \"REGIONAL\",\n    tags: {\n        Tag1: \"Value1\",\n        Tag2: \"Value2\",\n    },\n    visibilityConfig: {\n        cloudwatchMetricsEnabled: false,\n        metricName: \"friendly-metric-name\",\n        sampledRequestsEnabled: false,\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.wafv2.WebAcl(\"example\",\n    default_action=aws.wafv2.WebAclDefaultActionArgs(\n        allow=aws.wafv2.WebAclDefaultActionAllowArgs(),\n    ),\n    description=\"Example of a managed rule.\",\n    rules=[aws.wafv2.WebAclRuleArgs(\n        name=\"rule-1\",\n        override_action=aws.wafv2.WebAclRuleOverrideActionArgs(\n            count=aws.wafv2.WebAclRuleOverrideActionCountArgs(),\n        ),\n        priority=1,\n        statement=aws.wafv2.WebAclRuleStatementArgs(\n            managed_rule_group_statement=aws.wafv2.WebAclRuleStatementManagedRuleGroupStatementArgs(\n                excluded_rule=[\n                    {\n                        \"name\": \"SizeRestrictions_QUERYSTRING\",\n                    },\n                    {\n                        \"name\": \"NoUserAgent_HEADER\",\n                    },\n                ],\n                name=\"AWSManagedRulesCommonRuleSet\",\n                scope_down_statement=aws.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs(\n                    geo_match_statement=aws.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs(\n                        country_codes=[\n                            \"US\",\n                            \"NL\",\n                        ],\n                    ),\n                ),\n                vendor_name=\"AWS\",\n            ),\n        ),\n        visibility_config=aws.wafv2.WebAclRuleVisibilityConfigArgs(\n            cloudwatch_metrics_enabled=False,\n            metric_name=\"friendly-rule-metric-name\",\n            sampled_requests_enabled=False,\n        ),\n    )],\n    scope=\"REGIONAL\",\n    tags={\n        \"Tag1\": \"Value1\",\n        \"Tag2\": \"Value2\",\n    },\n    visibility_config=aws.wafv2.WebAclVisibilityConfigArgs(\n        cloudwatch_metrics_enabled=False,\n        metric_name=\"friendly-metric-name\",\n        sampled_requests_enabled=False,\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.WafV2.WebAcl(\"example\", new Aws.WafV2.WebAclArgs\n        {\n            DefaultAction = new Aws.WafV2.Inputs.WebAclDefaultActionArgs\n            {\n                Allow = ,\n            },\n            Description = \"Example of a managed rule.\",\n            Rules = \n            {\n                new Aws.WafV2.Inputs.WebAclRuleArgs\n                {\n                    Name = \"rule-1\",\n                    OverrideAction = new Aws.WafV2.Inputs.WebAclRuleOverrideActionArgs\n                    {\n                        Count = ,\n                    },\n                    Priority = 1,\n                    Statement = new Aws.WafV2.Inputs.WebAclRuleStatementArgs\n                    {\n                        ManagedRuleGroupStatement = new Aws.WafV2.Inputs.WebAclRuleStatementManagedRuleGroupStatementArgs\n                        {\n                            ExcludedRule = \n                            {\n                                \n                                {\n                                    { \"name\", \"SizeRestrictions_QUERYSTRING\" },\n                                },\n                                \n                                {\n                                    { \"name\", \"NoUserAgent_HEADER\" },\n                                },\n                            },\n                            Name = \"AWSManagedRulesCommonRuleSet\",\n                            ScopeDownStatement = new Aws.WafV2.Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs\n                            {\n                                GeoMatchStatement = new Aws.WafV2.Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs\n                                {\n                                    CountryCodes = \n                                    {\n                                        \"US\",\n                                        \"NL\",\n                                    },\n                                },\n                            },\n                            VendorName = \"AWS\",\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.WebAclRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n            },\n            Scope = \"REGIONAL\",\n            Tags = \n            {\n                { \"Tag1\", \"Value1\" },\n                { \"Tag2\", \"Value2\" },\n            },\n            VisibilityConfig = new Aws.WafV2.Inputs.WebAclVisibilityConfigArgs\n            {\n                CloudwatchMetricsEnabled = false,\n                MetricName = \"friendly-metric-name\",\n                SampledRequestsEnabled = false,\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/wafv2\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := wafv2.NewWebAcl(ctx, \"example\", \u0026wafv2.WebAclArgs{\n\t\t\tDefaultAction: \u0026wafv2.WebAclDefaultActionArgs{\n\t\t\t\tAllow: nil,\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"Example of a managed rule.\"),\n\t\t\tRules: wafv2.WebAclRuleArray{\n\t\t\t\t\u0026wafv2.WebAclRuleArgs{\n\t\t\t\t\tName: pulumi.String(\"rule-1\"),\n\t\t\t\t\tOverrideAction: \u0026wafv2.WebAclRuleOverrideActionArgs{\n\t\t\t\t\t\tCount: nil,\n\t\t\t\t\t},\n\t\t\t\t\tPriority: pulumi.Int(1),\n\t\t\t\t\tStatement: \u0026wafv2.WebAclRuleStatementArgs{\n\t\t\t\t\t\tManagedRuleGroupStatement: \u0026wafv2.WebAclRuleStatementManagedRuleGroupStatementArgs{\n\t\t\t\t\t\t\tExcludedRule: []map[string]interface{}{\n\t\t\t\t\t\t\t\tmap[string]interface{}{\n\t\t\t\t\t\t\t\t\t\"name\": \"SizeRestrictions_QUERYSTRING\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tmap[string]interface{}{\n\t\t\t\t\t\t\t\t\t\"name\": \"NoUserAgent_HEADER\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tName: pulumi.String(\"AWSManagedRulesCommonRuleSet\"),\n\t\t\t\t\t\t\tScopeDownStatement: \u0026wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs{\n\t\t\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\t\t\tpulumi.String(\"US\"),\n\t\t\t\t\t\t\t\t\t\tpulumi.String(\"NL\"),\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tVendorName: pulumi.String(\"AWS\"),\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.WebAclRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tScope: pulumi.String(\"REGIONAL\"),\n\t\t\tTags: pulumi.StringMap{\n\t\t\t\t\"Tag1\": pulumi.String(\"Value1\"),\n\t\t\t\t\"Tag2\": pulumi.String(\"Value2\"),\n\t\t\t},\n\t\t\tVisibilityConfig: \u0026wafv2.WebAclVisibilityConfigArgs{\n\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\tMetricName:               pulumi.String(\"friendly-metric-name\"),\n\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Rate Based\nRate-limit US and NL-based clients to 10,000 requests for every 5 minutes.\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.wafv2.WebAcl(\"example\", {\n    defaultAction: {\n        allow: {},\n    },\n    description: \"Example of a Cloudfront rate based statement.\",\n    rules: [{\n        action: {\n            block: {},\n        },\n        name: \"rule-1\",\n        priority: 1,\n        statement: {\n            rateBasedStatement: {\n                aggregateKeyType: \"IP\",\n                limit: 10000,\n                scopeDownStatement: {\n                    geoMatchStatement: {\n                        countryCodes: [\n                            \"US\",\n                            \"NL\",\n                        ],\n                    },\n                },\n            },\n        },\n        visibilityConfig: {\n            cloudwatchMetricsEnabled: false,\n            metricName: \"friendly-rule-metric-name\",\n            sampledRequestsEnabled: false,\n        },\n    }],\n    scope: \"CLOUDFRONT\",\n    tags: {\n        Tag1: \"Value1\",\n        Tag2: \"Value2\",\n    },\n    visibilityConfig: {\n        cloudwatchMetricsEnabled: false,\n        metricName: \"friendly-metric-name\",\n        sampledRequestsEnabled: false,\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.wafv2.WebAcl(\"example\",\n    default_action=aws.wafv2.WebAclDefaultActionArgs(\n        allow=aws.wafv2.WebAclDefaultActionAllowArgs(),\n    ),\n    description=\"Example of a Cloudfront rate based statement.\",\n    rules=[aws.wafv2.WebAclRuleArgs(\n        action=aws.wafv2.WebAclRuleActionArgs(\n            block=aws.wafv2.WebAclRuleActionBlockArgs(),\n        ),\n        name=\"rule-1\",\n        priority=1,\n        statement=aws.wafv2.WebAclRuleStatementArgs(\n            rate_based_statement=aws.wafv2.WebAclRuleStatementRateBasedStatementArgs(\n                aggregate_key_type=\"IP\",\n                limit=10000,\n                scope_down_statement=aws.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementArgs(\n                    geo_match_statement=aws.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs(\n                        country_codes=[\n                            \"US\",\n                            \"NL\",\n                        ],\n                    ),\n                ),\n            ),\n        ),\n        visibility_config=aws.wafv2.WebAclRuleVisibilityConfigArgs(\n            cloudwatch_metrics_enabled=False,\n            metric_name=\"friendly-rule-metric-name\",\n            sampled_requests_enabled=False,\n        ),\n    )],\n    scope=\"CLOUDFRONT\",\n    tags={\n        \"Tag1\": \"Value1\",\n        \"Tag2\": \"Value2\",\n    },\n    visibility_config=aws.wafv2.WebAclVisibilityConfigArgs(\n        cloudwatch_metrics_enabled=False,\n        metric_name=\"friendly-metric-name\",\n        sampled_requests_enabled=False,\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.WafV2.WebAcl(\"example\", new Aws.WafV2.WebAclArgs\n        {\n            DefaultAction = new Aws.WafV2.Inputs.WebAclDefaultActionArgs\n            {\n                Allow = ,\n            },\n            Description = \"Example of a Cloudfront rate based statement.\",\n            Rules = \n            {\n                new Aws.WafV2.Inputs.WebAclRuleArgs\n                {\n                    Action = new Aws.WafV2.Inputs.WebAclRuleActionArgs\n                    {\n                        Block = ,\n                    },\n                    Name = \"rule-1\",\n                    Priority = 1,\n                    Statement = new Aws.WafV2.Inputs.WebAclRuleStatementArgs\n                    {\n                        RateBasedStatement = new Aws.WafV2.Inputs.WebAclRuleStatementRateBasedStatementArgs\n                        {\n                            AggregateKeyType = \"IP\",\n                            Limit = 10000,\n                            ScopeDownStatement = new Aws.WafV2.Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementArgs\n                            {\n                                GeoMatchStatement = new Aws.WafV2.Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs\n                                {\n                                    CountryCodes = \n                                    {\n                                        \"US\",\n                                        \"NL\",\n                                    },\n                                },\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.WebAclRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n            },\n            Scope = \"CLOUDFRONT\",\n            Tags = \n            {\n                { \"Tag1\", \"Value1\" },\n                { \"Tag2\", \"Value2\" },\n            },\n            VisibilityConfig = new Aws.WafV2.Inputs.WebAclVisibilityConfigArgs\n            {\n                CloudwatchMetricsEnabled = false,\n                MetricName = \"friendly-metric-name\",\n                SampledRequestsEnabled = false,\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/wafv2\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := wafv2.NewWebAcl(ctx, \"example\", \u0026wafv2.WebAclArgs{\n\t\t\tDefaultAction: \u0026wafv2.WebAclDefaultActionArgs{\n\t\t\t\tAllow: nil,\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"Example of a Cloudfront rate based statement.\"),\n\t\t\tRules: wafv2.WebAclRuleArray{\n\t\t\t\t\u0026wafv2.WebAclRuleArgs{\n\t\t\t\t\tAction: \u0026wafv2.WebAclRuleActionArgs{\n\t\t\t\t\t\tBlock: nil,\n\t\t\t\t\t},\n\t\t\t\t\tName:     pulumi.String(\"rule-1\"),\n\t\t\t\t\tPriority: pulumi.Int(1),\n\t\t\t\t\tStatement: \u0026wafv2.WebAclRuleStatementArgs{\n\t\t\t\t\t\tRateBasedStatement: \u0026wafv2.WebAclRuleStatementRateBasedStatementArgs{\n\t\t\t\t\t\t\tAggregateKeyType: pulumi.String(\"IP\"),\n\t\t\t\t\t\t\tLimit:            pulumi.Int(10000),\n\t\t\t\t\t\t\tScopeDownStatement: \u0026wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementArgs{\n\t\t\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\t\t\tpulumi.String(\"US\"),\n\t\t\t\t\t\t\t\t\t\tpulumi.String(\"NL\"),\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.WebAclRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tScope: pulumi.String(\"CLOUDFRONT\"),\n\t\t\tTags: pulumi.StringMap{\n\t\t\t\t\"Tag1\": pulumi.String(\"Value1\"),\n\t\t\t\t\"Tag2\": pulumi.String(\"Value2\"),\n\t\t\t},\n\t\t\tVisibilityConfig: \u0026wafv2.WebAclVisibilityConfigArgs{\n\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\tMetricName:               pulumi.String(\"friendly-metric-name\"),\n\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% example %}}\n### Rule Group Reference\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = new aws.wafv2.RuleGroup(\"example\", {\n    capacity: 10,\n    scope: \"REGIONAL\",\n    rules: [\n        {\n            name: \"rule-1\",\n            priority: 1,\n            action: {\n                count: {},\n            },\n            statement: {\n                geoMatchStatement: {\n                    countryCodes: [\"NL\"],\n                },\n            },\n            visibilityConfig: {\n                cloudwatchMetricsEnabled: false,\n                metricName: \"friendly-rule-metric-name\",\n                sampledRequestsEnabled: false,\n            },\n        },\n        {\n            name: \"rule-to-exclude-a\",\n            priority: 10,\n            action: {\n                allow: {},\n            },\n            statement: {\n                geoMatchStatement: {\n                    countryCodes: [\"US\"],\n                },\n            },\n            visibilityConfig: {\n                cloudwatchMetricsEnabled: false,\n                metricName: \"friendly-rule-metric-name\",\n                sampledRequestsEnabled: false,\n            },\n        },\n        {\n            name: \"rule-to-exclude-b\",\n            priority: 15,\n            action: {\n                allow: {},\n            },\n            statement: {\n                geoMatchStatement: {\n                    countryCodes: [\"GB\"],\n                },\n            },\n            visibilityConfig: {\n                cloudwatchMetricsEnabled: false,\n                metricName: \"friendly-rule-metric-name\",\n                sampledRequestsEnabled: false,\n            },\n        },\n    ],\n    visibilityConfig: {\n        cloudwatchMetricsEnabled: false,\n        metricName: \"friendly-metric-name\",\n        sampledRequestsEnabled: false,\n    },\n});\nconst test = new aws.wafv2.WebAcl(\"test\", {\n    scope: \"REGIONAL\",\n    defaultAction: {\n        block: {},\n    },\n    rules: [{\n        name: \"rule-1\",\n        priority: 1,\n        overrideAction: {\n            count: {},\n        },\n        statement: {\n            ruleGroupReferenceStatement: {\n                arn: example.arn,\n                excludedRules: [\n                    {\n                        name: \"rule-to-exclude-b\",\n                    },\n                    {\n                        name: \"rule-to-exclude-a\",\n                    },\n                ],\n            },\n        },\n        visibilityConfig: {\n            cloudwatchMetricsEnabled: false,\n            metricName: \"friendly-rule-metric-name\",\n            sampledRequestsEnabled: false,\n        },\n    }],\n    tags: {\n        Tag1: \"Value1\",\n        Tag2: \"Value2\",\n    },\n    visibilityConfig: {\n        cloudwatchMetricsEnabled: false,\n        metricName: \"friendly-metric-name\",\n        sampledRequestsEnabled: false,\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.wafv2.RuleGroup(\"example\",\n    capacity=10,\n    scope=\"REGIONAL\",\n    rules=[\n        aws.wafv2.RuleGroupRuleArgs(\n            name=\"rule-1\",\n            priority=1,\n            action=aws.wafv2.RuleGroupRuleActionArgs(\n                count=aws.wafv2.RuleGroupRuleActionCountArgs(),\n            ),\n            statement=aws.wafv2.RuleGroupRuleStatementArgs(\n                geo_match_statement=aws.wafv2.RuleGroupRuleStatementGeoMatchStatementArgs(\n                    country_codes=[\"NL\"],\n                ),\n            ),\n            visibility_config=aws.wafv2.RuleGroupRuleVisibilityConfigArgs(\n                cloudwatch_metrics_enabled=False,\n                metric_name=\"friendly-rule-metric-name\",\n                sampled_requests_enabled=False,\n            ),\n        ),\n        aws.wafv2.RuleGroupRuleArgs(\n            name=\"rule-to-exclude-a\",\n            priority=10,\n            action=aws.wafv2.RuleGroupRuleActionArgs(\n                allow=aws.wafv2.RuleGroupRuleActionAllowArgs(),\n            ),\n            statement=aws.wafv2.RuleGroupRuleStatementArgs(\n                geo_match_statement=aws.wafv2.RuleGroupRuleStatementGeoMatchStatementArgs(\n                    country_codes=[\"US\"],\n                ),\n            ),\n            visibility_config=aws.wafv2.RuleGroupRuleVisibilityConfigArgs(\n                cloudwatch_metrics_enabled=False,\n                metric_name=\"friendly-rule-metric-name\",\n                sampled_requests_enabled=False,\n            ),\n        ),\n        aws.wafv2.RuleGroupRuleArgs(\n            name=\"rule-to-exclude-b\",\n            priority=15,\n            action=aws.wafv2.RuleGroupRuleActionArgs(\n                allow=aws.wafv2.RuleGroupRuleActionAllowArgs(),\n            ),\n            statement=aws.wafv2.RuleGroupRuleStatementArgs(\n                geo_match_statement=aws.wafv2.RuleGroupRuleStatementGeoMatchStatementArgs(\n                    country_codes=[\"GB\"],\n                ),\n            ),\n            visibility_config=aws.wafv2.RuleGroupRuleVisibilityConfigArgs(\n                cloudwatch_metrics_enabled=False,\n                metric_name=\"friendly-rule-metric-name\",\n                sampled_requests_enabled=False,\n            ),\n        ),\n    ],\n    visibility_config=aws.wafv2.RuleGroupVisibilityConfigArgs(\n        cloudwatch_metrics_enabled=False,\n        metric_name=\"friendly-metric-name\",\n        sampled_requests_enabled=False,\n    ))\ntest = aws.wafv2.WebAcl(\"test\",\n    scope=\"REGIONAL\",\n    default_action=aws.wafv2.WebAclDefaultActionArgs(\n        block=aws.wafv2.WebAclDefaultActionBlockArgs(),\n    ),\n    rules=[aws.wafv2.WebAclRuleArgs(\n        name=\"rule-1\",\n        priority=1,\n        override_action=aws.wafv2.WebAclRuleOverrideActionArgs(\n            count=aws.wafv2.WebAclRuleOverrideActionCountArgs(),\n        ),\n        statement=aws.wafv2.WebAclRuleStatementArgs(\n            rule_group_reference_statement=aws.wafv2.WebAclRuleStatementRuleGroupReferenceStatementArgs(\n                arn=example.arn,\n                excluded_rules=[\n                    aws.wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs(\n                        name=\"rule-to-exclude-b\",\n                    ),\n                    aws.wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs(\n                        name=\"rule-to-exclude-a\",\n                    ),\n                ],\n            ),\n        ),\n        visibility_config=aws.wafv2.WebAclRuleVisibilityConfigArgs(\n            cloudwatch_metrics_enabled=False,\n            metric_name=\"friendly-rule-metric-name\",\n            sampled_requests_enabled=False,\n        ),\n    )],\n    tags={\n        \"Tag1\": \"Value1\",\n        \"Tag2\": \"Value2\",\n    },\n    visibility_config=aws.wafv2.WebAclVisibilityConfigArgs(\n        cloudwatch_metrics_enabled=False,\n        metric_name=\"friendly-metric-name\",\n        sampled_requests_enabled=False,\n    ))\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = new Aws.WafV2.RuleGroup(\"example\", new Aws.WafV2.RuleGroupArgs\n        {\n            Capacity = 10,\n            Scope = \"REGIONAL\",\n            Rules = \n            {\n                new Aws.WafV2.Inputs.RuleGroupRuleArgs\n                {\n                    Name = \"rule-1\",\n                    Priority = 1,\n                    Action = new Aws.WafV2.Inputs.RuleGroupRuleActionArgs\n                    {\n                        Count = ,\n                    },\n                    Statement = new Aws.WafV2.Inputs.RuleGroupRuleStatementArgs\n                    {\n                        GeoMatchStatement = new Aws.WafV2.Inputs.RuleGroupRuleStatementGeoMatchStatementArgs\n                        {\n                            CountryCodes = \n                            {\n                                \"NL\",\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.RuleGroupRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n                new Aws.WafV2.Inputs.RuleGroupRuleArgs\n                {\n                    Name = \"rule-to-exclude-a\",\n                    Priority = 10,\n                    Action = new Aws.WafV2.Inputs.RuleGroupRuleActionArgs\n                    {\n                        Allow = ,\n                    },\n                    Statement = new Aws.WafV2.Inputs.RuleGroupRuleStatementArgs\n                    {\n                        GeoMatchStatement = new Aws.WafV2.Inputs.RuleGroupRuleStatementGeoMatchStatementArgs\n                        {\n                            CountryCodes = \n                            {\n                                \"US\",\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.RuleGroupRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n                new Aws.WafV2.Inputs.RuleGroupRuleArgs\n                {\n                    Name = \"rule-to-exclude-b\",\n                    Priority = 15,\n                    Action = new Aws.WafV2.Inputs.RuleGroupRuleActionArgs\n                    {\n                        Allow = ,\n                    },\n                    Statement = new Aws.WafV2.Inputs.RuleGroupRuleStatementArgs\n                    {\n                        GeoMatchStatement = new Aws.WafV2.Inputs.RuleGroupRuleStatementGeoMatchStatementArgs\n                        {\n                            CountryCodes = \n                            {\n                                \"GB\",\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.RuleGroupRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n            },\n            VisibilityConfig = new Aws.WafV2.Inputs.RuleGroupVisibilityConfigArgs\n            {\n                CloudwatchMetricsEnabled = false,\n                MetricName = \"friendly-metric-name\",\n                SampledRequestsEnabled = false,\n            },\n        });\n        var test = new Aws.WafV2.WebAcl(\"test\", new Aws.WafV2.WebAclArgs\n        {\n            Scope = \"REGIONAL\",\n            DefaultAction = new Aws.WafV2.Inputs.WebAclDefaultActionArgs\n            {\n                Block = ,\n            },\n            Rules = \n            {\n                new Aws.WafV2.Inputs.WebAclRuleArgs\n                {\n                    Name = \"rule-1\",\n                    Priority = 1,\n                    OverrideAction = new Aws.WafV2.Inputs.WebAclRuleOverrideActionArgs\n                    {\n                        Count = ,\n                    },\n                    Statement = new Aws.WafV2.Inputs.WebAclRuleStatementArgs\n                    {\n                        RuleGroupReferenceStatement = new Aws.WafV2.Inputs.WebAclRuleStatementRuleGroupReferenceStatementArgs\n                        {\n                            Arn = example.Arn,\n                            ExcludedRules = \n                            {\n                                new Aws.WafV2.Inputs.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs\n                                {\n                                    Name = \"rule-to-exclude-b\",\n                                },\n                                new Aws.WafV2.Inputs.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs\n                                {\n                                    Name = \"rule-to-exclude-a\",\n                                },\n                            },\n                        },\n                    },\n                    VisibilityConfig = new Aws.WafV2.Inputs.WebAclRuleVisibilityConfigArgs\n                    {\n                        CloudwatchMetricsEnabled = false,\n                        MetricName = \"friendly-rule-metric-name\",\n                        SampledRequestsEnabled = false,\n                    },\n                },\n            },\n            Tags = \n            {\n                { \"Tag1\", \"Value1\" },\n                { \"Tag2\", \"Value2\" },\n            },\n            VisibilityConfig = new Aws.WafV2.Inputs.WebAclVisibilityConfigArgs\n            {\n                CloudwatchMetricsEnabled = false,\n                MetricName = \"friendly-metric-name\",\n                SampledRequestsEnabled = false,\n            },\n        });\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/wafv2\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := wafv2.NewRuleGroup(ctx, \"example\", \u0026wafv2.RuleGroupArgs{\n\t\t\tCapacity: pulumi.Int(10),\n\t\t\tScope:    pulumi.String(\"REGIONAL\"),\n\t\t\tRules: wafv2.RuleGroupRuleArray{\n\t\t\t\t\u0026wafv2.RuleGroupRuleArgs{\n\t\t\t\t\tName:     pulumi.String(\"rule-1\"),\n\t\t\t\t\tPriority: pulumi.Int(1),\n\t\t\t\t\tAction: \u0026wafv2.RuleGroupRuleActionArgs{\n\t\t\t\t\t\tCount: nil,\n\t\t\t\t\t},\n\t\t\t\t\tStatement: \u0026wafv2.RuleGroupRuleStatementArgs{\n\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.RuleGroupRuleStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\tpulumi.String(\"NL\"),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.RuleGroupRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\t\u0026wafv2.RuleGroupRuleArgs{\n\t\t\t\t\tName:     pulumi.String(\"rule-to-exclude-a\"),\n\t\t\t\t\tPriority: pulumi.Int(10),\n\t\t\t\t\tAction: \u0026wafv2.RuleGroupRuleActionArgs{\n\t\t\t\t\t\tAllow: nil,\n\t\t\t\t\t},\n\t\t\t\t\tStatement: \u0026wafv2.RuleGroupRuleStatementArgs{\n\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.RuleGroupRuleStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\tpulumi.String(\"US\"),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.RuleGroupRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\t\u0026wafv2.RuleGroupRuleArgs{\n\t\t\t\t\tName:     pulumi.String(\"rule-to-exclude-b\"),\n\t\t\t\t\tPriority: pulumi.Int(15),\n\t\t\t\t\tAction: \u0026wafv2.RuleGroupRuleActionArgs{\n\t\t\t\t\t\tAllow: nil,\n\t\t\t\t\t},\n\t\t\t\t\tStatement: \u0026wafv2.RuleGroupRuleStatementArgs{\n\t\t\t\t\t\tGeoMatchStatement: \u0026wafv2.RuleGroupRuleStatementGeoMatchStatementArgs{\n\t\t\t\t\t\t\tCountryCodes: pulumi.StringArray{\n\t\t\t\t\t\t\t\tpulumi.String(\"GB\"),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.RuleGroupRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tVisibilityConfig: \u0026wafv2.RuleGroupVisibilityConfigArgs{\n\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\tMetricName:               pulumi.String(\"friendly-metric-name\"),\n\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = wafv2.NewWebAcl(ctx, \"test\", \u0026wafv2.WebAclArgs{\n\t\t\tScope: pulumi.String(\"REGIONAL\"),\n\t\t\tDefaultAction: \u0026wafv2.WebAclDefaultActionArgs{\n\t\t\t\tBlock: nil,\n\t\t\t},\n\t\t\tRules: wafv2.WebAclRuleArray{\n\t\t\t\t\u0026wafv2.WebAclRuleArgs{\n\t\t\t\t\tName:     pulumi.String(\"rule-1\"),\n\t\t\t\t\tPriority: pulumi.Int(1),\n\t\t\t\t\tOverrideAction: \u0026wafv2.WebAclRuleOverrideActionArgs{\n\t\t\t\t\t\tCount: nil,\n\t\t\t\t\t},\n\t\t\t\t\tStatement: \u0026wafv2.WebAclRuleStatementArgs{\n\t\t\t\t\t\tRuleGroupReferenceStatement: \u0026wafv2.WebAclRuleStatementRuleGroupReferenceStatementArgs{\n\t\t\t\t\t\t\tArn: example.Arn,\n\t\t\t\t\t\t\tExcludedRules: wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArray{\n\t\t\t\t\t\t\t\t\u0026wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs{\n\t\t\t\t\t\t\t\t\tName: pulumi.String(\"rule-to-exclude-b\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\u0026wafv2.WebAclRuleStatementRuleGroupReferenceStatementExcludedRuleArgs{\n\t\t\t\t\t\t\t\t\tName: pulumi.String(\"rule-to-exclude-a\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tVisibilityConfig: \u0026wafv2.WebAclRuleVisibilityConfigArgs{\n\t\t\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\t\t\tMetricName:               pulumi.String(\"friendly-rule-metric-name\"),\n\t\t\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tTags: pulumi.StringMap{\n\t\t\t\t\"Tag1\": pulumi.String(\"Value1\"),\n\t\t\t\t\"Tag2\": pulumi.String(\"Value2\"),\n\t\t\t},\n\t\t\tVisibilityConfig: \u0026wafv2.WebAclVisibilityConfigArgs{\n\t\t\t\tCloudwatchMetricsEnabled: pulumi.Bool(false),\n\t\t\t\tMetricName:               pulumi.String(\"friendly-metric-name\"),\n\t\t\t\tSampledRequestsEnabled:   pulumi.Bool(false),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}\n\n## Import\n\nWAFv2 Web ACLs can be imported using `ID/Name/Scope` e.g.,\n\n```sh\n $ pulumi import aws:wafv2/webAcl:WebAcl example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL\n```\n\n ",
             "properties": {
                 "arn": {
                     "type": "string",
@@ -294205,6 +298690,13 @@
                     "type": "integer",
                     "description": "The web ACL capacity units (WCUs) currently being used by this web ACL.\n"
                 },
+                "customResponseBodies": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:wafv2/WebAclCustomResponseBody:WebAclCustomResponseBody"
+                    },
+                    "description": "Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.\n"
+                },
                 "defaultAction": {
                     "$ref": "#/types/aws:wafv2/WebAclDefaultAction:WebAclDefaultAction",
                     "description": "The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.\n"
@@ -294218,7 +298710,7 @@
                 },
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n"
+                    "description": "The label string.\n"
                 },
                 "rules": {
                     "type": "array",
@@ -294261,6 +298753,13 @@
                 "visibilityConfig"
             ],
             "inputProperties": {
+                "customResponseBodies": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/types/aws:wafv2/WebAclCustomResponseBody:WebAclCustomResponseBody"
+                    },
+                    "description": "Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.\n"
+                },
                 "defaultAction": {
                     "$ref": "#/types/aws:wafv2/WebAclDefaultAction:WebAclDefaultAction",
                     "description": "The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.\n"
@@ -294271,7 +298770,7 @@
                 },
                 "name": {
                     "type": "string",
-                    "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n"
+                    "description": "The label string.\n"
                 },
                 "rules": {
                     "type": "array",
@@ -294319,6 +298818,13 @@
                         "type": "integer",
                         "description": "The web ACL capacity units (WCUs) currently being used by this web ACL.\n"
                     },
+                    "customResponseBodies": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/types/aws:wafv2/WebAclCustomResponseBody:WebAclCustomResponseBody"
+                        },
+                        "description": "Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.\n"
+                    },
                     "defaultAction": {
                         "$ref": "#/types/aws:wafv2/WebAclDefaultAction:WebAclDefaultAction",
                         "description": "The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.\n"
@@ -294332,7 +298838,7 @@
                     },
                     "name": {
                         "type": "string",
-                        "description": "The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.\n"
+                        "description": "The label string.\n"
                     },
                     "rules": {
                         "type": "array",
@@ -295943,6 +300449,9 @@
                     "customerOwnedIpv4Pool": {
                         "type": "string"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string"
+                    },
                     "dnsName": {
                         "type": "string"
                     },
@@ -295955,6 +300464,9 @@
                     "enableHttp2": {
                         "type": "boolean"
                     },
+                    "enableWafFailOpen": {
+                        "type": "boolean"
+                    },
                     "id": {
                         "type": "string",
                         "description": "The provider-assigned unique ID for this managed resource.\n"
@@ -296011,10 +300523,12 @@
                     "arn",
                     "arnSuffix",
                     "customerOwnedIpv4Pool",
+                    "desyncMitigationMode",
                     "dnsName",
                     "dropInvalidHeaderFields",
                     "enableDeletionProtection",
                     "enableHttp2",
+                    "enableWafFailOpen",
                     "idleTimeout",
                     "internal",
                     "ipAddressType",
@@ -296827,6 +301341,9 @@
                     "customerOwnedIpv4Pool": {
                         "type": "string"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string"
+                    },
                     "dnsName": {
                         "type": "string"
                     },
@@ -296839,6 +301356,9 @@
                     "enableHttp2": {
                         "type": "boolean"
                     },
+                    "enableWafFailOpen": {
+                        "type": "boolean"
+                    },
                     "id": {
                         "type": "string",
                         "description": "The provider-assigned unique ID for this managed resource.\n"
@@ -296895,10 +301415,12 @@
                     "arn",
                     "arnSuffix",
                     "customerOwnedIpv4Pool",
+                    "desyncMitigationMode",
                     "dnsName",
                     "dropInvalidHeaderFields",
                     "enableDeletionProtection",
                     "enableHttp2",
+                    "enableWafFailOpen",
                     "idleTimeout",
                     "internal",
                     "ipAddressType",
@@ -301896,6 +306418,49 @@
                 ]
             }
         },
+        "aws:ec2/getInstanceTypes:getInstanceTypes": {
+            "description": "Information about EC2 Instance Types.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst test = pulumi.output(aws.ec2.getInstanceTypes({\n    filters: [\n        {\n            name: \"auto-recovery-supported\",\n            values: [\"true\"],\n        },\n        {\n            name: \"network-info.encryption-in-transit-supported\",\n            values: [\"true\"],\n        },\n        {\n            name: \"instance-storage-supported\",\n            values: [\"true\"],\n        },\n        {\n            name: \"instance-type\",\n            values: [\n                \"g5.2xlarge\",\n                \"g5.4xlarge\",\n            ],\n        },\n    ],\n}));\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\ntest = aws.ec2.get_instance_types(filters=[\n    aws.ec2.GetInstanceTypesFilterArgs(\n        name=\"auto-recovery-supported\",\n        values=[\"true\"],\n    ),\n    aws.ec2.GetInstanceTypesFilterArgs(\n        name=\"network-info.encryption-in-transit-supported\",\n        values=[\"true\"],\n    ),\n    aws.ec2.GetInstanceTypesFilterArgs(\n        name=\"instance-storage-supported\",\n        values=[\"true\"],\n    ),\n    aws.ec2.GetInstanceTypesFilterArgs(\n        name=\"instance-type\",\n        values=[\n            \"g5.2xlarge\",\n            \"g5.4xlarge\",\n        ],\n    ),\n])\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var test = Output.Create(Aws.Ec2.GetInstanceTypes.InvokeAsync(new Aws.Ec2.GetInstanceTypesArgs\n        {\n            Filters = \n            {\n                new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs\n                {\n                    Name = \"auto-recovery-supported\",\n                    Values = \n                    {\n                        \"true\",\n                    },\n                },\n                new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs\n                {\n                    Name = \"network-info.encryption-in-transit-supported\",\n                    Values = \n                    {\n                        \"true\",\n                    },\n                },\n                new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs\n                {\n                    Name = \"instance-storage-supported\",\n                    Values = \n                    {\n                        \"true\",\n                    },\n                },\n                new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs\n                {\n                    Name = \"instance-type\",\n                    Values = \n                    {\n                        \"g5.2xlarge\",\n                        \"g5.4xlarge\",\n                    },\n                },\n            },\n        }));\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/ec2\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := ec2.GetInstanceTypes(ctx, \u0026ec2.GetInstanceTypesArgs{\n\t\t\tFilters: []ec2.GetInstanceTypesFilter{\n\t\t\t\tec2.GetInstanceTypesFilter{\n\t\t\t\t\tName: \"auto-recovery-supported\",\n\t\t\t\t\tValues: []string{\n\t\t\t\t\t\t\"true\",\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tec2.GetInstanceTypesFilter{\n\t\t\t\t\tName: \"network-info.encryption-in-transit-supported\",\n\t\t\t\t\tValues: []string{\n\t\t\t\t\t\t\"true\",\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tec2.GetInstanceTypesFilter{\n\t\t\t\t\tName: \"instance-storage-supported\",\n\t\t\t\t\tValues: []string{\n\t\t\t\t\t\t\"true\",\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tec2.GetInstanceTypesFilter{\n\t\t\t\t\tName: \"instance-type\",\n\t\t\t\t\tValues: []string{\n\t\t\t\t\t\t\"g5.2xlarge\",\n\t\t\t\t\t\t\"g5.4xlarge\",\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}",
+            "inputs": {
+                "description": "A collection of arguments for invoking getInstanceTypes.\n",
+                "properties": {
+                    "filters": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/types/aws:ec2/getInstanceTypesFilter:getInstanceTypesFilter"
+                        },
+                        "description": "One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.\n"
+                    }
+                },
+                "type": "object"
+            },
+            "outputs": {
+                "description": "A collection of values returned by getInstanceTypes.\n",
+                "properties": {
+                    "filters": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/types/aws:ec2/getInstanceTypesFilter:getInstanceTypesFilter"
+                        }
+                    },
+                    "id": {
+                        "type": "string",
+                        "description": "The provider-assigned unique ID for this managed resource.\n"
+                    },
+                    "instanceTypes": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        },
+                        "description": "List of EC2 Instance Types.\n"
+                    }
+                },
+                "type": "object",
+                "required": [
+                    "instanceTypes",
+                    "id"
+                ]
+            }
+        },
         "aws:ec2/getInstances:getInstances": {
             "description": "Use this data source to get IDs or IPs of Amazon EC2 instances to be referenced elsewhere,\ne.g., to allow easier migration from another management solution\nor to make it easier for an operator to connect through bastion host(s).\n\n\u003e **Note:** It's strongly discouraged to use this data source for querying ephemeral\ninstances (e.g., managed via autoscaling group), as the output may change at any time\nand you'd need to re-run `apply` every time an instance comes up or dies.\n",
             "inputs": {
@@ -307565,6 +312130,9 @@
                     "crossZoneLoadBalancing": {
                         "type": "boolean"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string"
+                    },
                     "dnsName": {
                         "type": "string"
                     },
@@ -307632,6 +312200,7 @@
                     "connectionDraining",
                     "connectionDrainingTimeout",
                     "crossZoneLoadBalancing",
+                    "desyncMitigationMode",
                     "dnsName",
                     "healthCheck",
                     "idleTimeout",
@@ -307806,6 +312375,9 @@
                     "customerOwnedIpv4Pool": {
                         "type": "string"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string"
+                    },
                     "dnsName": {
                         "type": "string"
                     },
@@ -307818,6 +312390,9 @@
                     "enableHttp2": {
                         "type": "boolean"
                     },
+                    "enableWafFailOpen": {
+                        "type": "boolean"
+                    },
                     "id": {
                         "type": "string",
                         "description": "The provider-assigned unique ID for this managed resource.\n"
@@ -307874,10 +312449,12 @@
                     "arn",
                     "arnSuffix",
                     "customerOwnedIpv4Pool",
+                    "desyncMitigationMode",
                     "dnsName",
                     "dropInvalidHeaderFields",
                     "enableDeletionProtection",
                     "enableHttp2",
+                    "enableWafFailOpen",
                     "idleTimeout",
                     "internal",
                     "ipAddressType",
@@ -308248,6 +312825,9 @@
                     "crossZoneLoadBalancing": {
                         "type": "boolean"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string"
+                    },
                     "dnsName": {
                         "type": "string"
                     },
@@ -308315,6 +312895,7 @@
                     "connectionDraining",
                     "connectionDrainingTimeout",
                     "crossZoneLoadBalancing",
+                    "desyncMitigationMode",
                     "dnsName",
                     "healthCheck",
                     "idleTimeout",
@@ -310145,6 +314726,64 @@
                 ]
             }
         },
+        "aws:imagebuilder/getImageRecipes:getImageRecipes": {
+            "description": "Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = pulumi.output(aws.imagebuilder.getImageRecipes({\n    filters: [{\n        name: \"platform\",\n        values: [\"Linux\"],\n    }],\n    owner: \"Self\",\n}));\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.imagebuilder.get_image_recipes(filters=[aws.imagebuilder.GetImageRecipesFilterArgs(\n        name=\"platform\",\n        values=[\"Linux\"],\n    )],\n    owner=\"Self\")\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = Output.Create(Aws.ImageBuilder.GetImageRecipes.InvokeAsync(new Aws.ImageBuilder.GetImageRecipesArgs\n        {\n            Filters = \n            {\n                new Aws.ImageBuilder.Inputs.GetImageRecipesFilterArgs\n                {\n                    Name = \"platform\",\n                    Values = \n                    {\n                        \"Linux\",\n                    },\n                },\n            },\n            Owner = \"Self\",\n        }));\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/imagebuilder\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\topt0 := \"Self\"\n\t\t_, err := imagebuilder.GetImageRecipes(ctx, \u0026imagebuilder.GetImageRecipesArgs{\n\t\t\tFilters: []imagebuilder.GetImageRecipesFilter{\n\t\t\t\timagebuilder.GetImageRecipesFilter{\n\t\t\t\t\tName: \"platform\",\n\t\t\t\t\tValues: []string{\n\t\t\t\t\t\t\"Linux\",\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tOwner: \u0026opt0,\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}",
+            "inputs": {
+                "description": "A collection of arguments for invoking getImageRecipes.\n",
+                "properties": {
+                    "filters": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/types/aws:imagebuilder/getImageRecipesFilter:getImageRecipesFilter"
+                        },
+                        "description": "Configuration block(s) for filtering. Detailed below.\n"
+                    },
+                    "owner": {
+                        "type": "string",
+                        "description": "The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.\n"
+                    }
+                },
+                "type": "object"
+            },
+            "outputs": {
+                "description": "A collection of values returned by getImageRecipes.\n",
+                "properties": {
+                    "arns": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        },
+                        "description": "Set of ARNs of the matched Image Builder Image Recipes.\n"
+                    },
+                    "filters": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/types/aws:imagebuilder/getImageRecipesFilter:getImageRecipesFilter"
+                        }
+                    },
+                    "id": {
+                        "type": "string",
+                        "description": "The provider-assigned unique ID for this managed resource.\n"
+                    },
+                    "names": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        },
+                        "description": "Set of names of the matched Image Builder Image Recipes.\n"
+                    },
+                    "owner": {
+                        "type": "string"
+                    }
+                },
+                "type": "object",
+                "required": [
+                    "arns",
+                    "names",
+                    "id"
+                ]
+            }
+        },
         "aws:imagebuilder/getInfrastructureConfiguration:getInfrastructureConfiguration": {
             "description": "Provides details about an Image Builder Infrastructure Configuration.\n\n{{% examples %}}\n## Example Usage\n{{% example %}}\n\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nconst example = pulumi.output(aws.imagebuilder.getInfrastructureConfiguration({\n    arn: \"arn:aws:imagebuilder:us-west-2:aws:infrastructure-configuration/example\",\n}));\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\n\nexample = aws.imagebuilder.get_infrastructure_configuration(arn=\"arn:aws:imagebuilder:us-west-2:aws:infrastructure-configuration/example\")\n```\n```csharp\nusing Pulumi;\nusing Aws = Pulumi.Aws;\n\nclass MyStack : Stack\n{\n    public MyStack()\n    {\n        var example = Output.Create(Aws.ImageBuilder.GetInfrastructureConfiguration.InvokeAsync(new Aws.ImageBuilder.GetInfrastructureConfigurationArgs\n        {\n            Arn = \"arn:aws:imagebuilder:us-west-2:aws:infrastructure-configuration/example\",\n        }));\n    }\n\n}\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/imagebuilder\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := imagebuilder.LookupInfrastructureConfiguration(ctx, \u0026imagebuilder.LookupInfrastructureConfigurationArgs{\n\t\t\tArn: \"arn:aws:imagebuilder:us-west-2:aws:infrastructure-configuration/example\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n{{% /example %}}\n{{% /examples %}}",
             "inputs": {
@@ -312450,6 +317089,10 @@
                         "type": "string",
                         "description": "The provider-assigned unique ID for this managed resource.\n"
                     },
+                    "imageUri": {
+                        "type": "string",
+                        "description": "The URI of the container image.\n"
+                    },
                     "invokeArn": {
                         "type": "string",
                         "description": "The ARN to be used for invoking Lambda Function from API Gateway.\n"
@@ -312542,6 +317185,7 @@
                     "fileSystemConfigs",
                     "functionName",
                     "handler",
+                    "imageUri",
                     "invokeArn",
                     "kmsKeyArn",
                     "lastModified",
@@ -312855,6 +317499,9 @@
                     "customerOwnedIpv4Pool": {
                         "type": "string"
                     },
+                    "desyncMitigationMode": {
+                        "type": "string"
+                    },
                     "dnsName": {
                         "type": "string"
                     },
@@ -312867,6 +317514,9 @@
                     "enableHttp2": {
                         "type": "boolean"
                     },
+                    "enableWafFailOpen": {
+                        "type": "boolean"
+                    },
                     "id": {
                         "type": "string",
                         "description": "The provider-assigned unique ID for this managed resource.\n"
@@ -312923,10 +317573,12 @@
                     "arn",
                     "arnSuffix",
                     "customerOwnedIpv4Pool",
+                    "desyncMitigationMode",
                     "dnsName",
                     "dropInvalidHeaderFields",
                     "enableDeletionProtection",
                     "enableHttp2",
+                    "enableWafFailOpen",
                     "idleTimeout",
                     "internal",
                     "ipAddressType",
@@ -319809,6 +324461,7 @@
             "compatibility": "tfbridge20",
             "namespaces": {
                 "accessanalyzer": "AccessAnalyzer",
+                "account": "Account",
                 "acm": "Acm",
                 "acmpca": "Acmpca",
                 "alb": "Alb",
diff --git a/provider/go.mod b/provider/go.mod
index 3a7631436ad..1678fee8ab8 100644
--- a/provider/go.mod
+++ b/provider/go.mod
@@ -13,7 +13,7 @@ require (
 
 replace (
 	github.com/hashicorp/terraform-plugin-sdk/v2 => github.com/pulumi/terraform-plugin-sdk/v2 v2.0.0-20210629210550-59d24255d71f
-	github.com/hashicorp/terraform-provider-aws => github.com/pulumi/terraform-provider-aws v1.38.1-0.20211119154650-363f3878c1f3
+	github.com/hashicorp/terraform-provider-aws => github.com/pulumi/terraform-provider-aws v1.38.1-0.20211126142250-dc1d1293bc65
 	github.com/hashicorp/terraform-provider-aws/shim => ./shim
 	github.com/hashicorp/vault => github.com/hashicorp/vault v1.2.0
 )
diff --git a/provider/go.sum b/provider/go.sum
index 9d170afc071..938ef1f1480 100644
--- a/provider/go.sum
+++ b/provider/go.sum
@@ -159,8 +159,8 @@ github.com/aws/aws-sdk-go v1.25.37/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpi
 github.com/aws/aws-sdk-go v1.30.27/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
 github.com/aws/aws-sdk-go v1.31.9/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
 github.com/aws/aws-sdk-go v1.38.35/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
-github.com/aws/aws-sdk-go v1.42.5 h1:0xNoQrGh9InmUsT+9qzZ8QLfBEUsnev5BMeED6t6cKI=
-github.com/aws/aws-sdk-go v1.42.5/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
+github.com/aws/aws-sdk-go v1.42.9 h1:8ptAGgA+uC2TUbdvUeOVSfBocIZvGE2NKiLxkAcn1GA=
+github.com/aws/aws-sdk-go v1.42.9/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
 github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
 github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -718,8 +718,8 @@ github.com/pulumi/terraform-diff-reader v0.0.0-20201211191010-ad4715e9285e h1:Di
 github.com/pulumi/terraform-diff-reader v0.0.0-20201211191010-ad4715e9285e/go.mod h1:sZ9FUzGO+yM41hsQHs/yIcj/Y993qMdBxBU5mpDmAfQ=
 github.com/pulumi/terraform-plugin-sdk/v2 v2.0.0-20210629210550-59d24255d71f h1:YWtQ7xeRQvB9h5Uwtrl9wDKRKkyLTXWBzU7x0c9VOZ4=
 github.com/pulumi/terraform-plugin-sdk/v2 v2.0.0-20210629210550-59d24255d71f/go.mod h1:grseeRo9g3yNkYW09iFlV8LG78jTa1ssBgouogQg/RU=
-github.com/pulumi/terraform-provider-aws v1.38.1-0.20211119154650-363f3878c1f3 h1:fpkTPTWOEMUuAbCDVbpPoIPC6aq5rqWuIlleebGpKbk=
-github.com/pulumi/terraform-provider-aws v1.38.1-0.20211119154650-363f3878c1f3/go.mod h1:cO8zE16eeebXY2wZ+jezVWxSXam0CpzdfS3sUTeP8dg=
+github.com/pulumi/terraform-provider-aws v1.38.1-0.20211126142250-dc1d1293bc65 h1:wW2PMxZ4W5W2LF/iUeFRgySj1MSRUoDfQoc6RDjZG54=
+github.com/pulumi/terraform-provider-aws v1.38.1-0.20211126142250-dc1d1293bc65/go.mod h1:yEpM6MJmGJKSB/WHjMnNbYbRWO9ydLwuaN5OkJExysw=
 github.com/rjeczalik/notify v0.9.2 h1:MiTWrPj55mNDHEiIX5YUSKefw/+lCQVoAFmD6oQm5w8=
 github.com/rjeczalik/notify v0.9.2/go.mod h1:aErll2f0sUX9PXZnVNyeiObbmTlk5jnMoCa4QEjJeqM=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
diff --git a/provider/resources.go b/provider/resources.go
index 082af73bf69..5fb636870c2 100644
--- a/provider/resources.go
+++ b/provider/resources.go
@@ -43,6 +43,7 @@ const (
 	awsMod                      = "index"                    // the root index.
 	acmMod                      = "Acm"                      // AWS Certificate Manager
 	acmpcaMod                   = "Acmpca"                   // AWS Private Certificate Authority
+	accountMod                  = "Account"                  // Account
 	accessAnalyzerMod           = "AccessAnalyzer"           // Access Analyzer
 	ampMod                      = "Amp"                      // Amp
 	amplifyMod                  = "Amplify"                  // Amplify
@@ -342,6 +343,8 @@ func Provider() tfbridge.ProviderInfo {
 			"aws_acmpca_certificate_authority_certificate": {
 				Tok: awsResource(acmpcaMod, "CertificateAuthorityCertificate"),
 			},
+			// Account
+			"aws_account_alternate_contact": {Tok: awsResource(accountMod, "AlternativeContact")},
 			// AppSync
 			"aws_appsync_api_key": {
 				Tok: awsResource(appsyncMod, "ApiKey"),
@@ -1475,10 +1478,12 @@ func Provider() tfbridge.ProviderInfo {
 			"aws_emr_managed_scaling_policy": {Tok: awsResource(emrMod, "ManagedScalingPolicy")},
 			"aws_emr_instance_fleet":         {Tok: awsResource(emrMod, "InstanceFleet")},
 			// FSX
-			"aws_fsx_lustre_file_system":  {Tok: awsResource(fsxMod, "LustreFileSystem")},
-			"aws_fsx_windows_file_system": {Tok: awsResource(fsxMod, "WindowsFileSystem")},
-			"aws_fsx_backup":              {Tok: awsResource(fsxMod, "Backup")},
-			"aws_fsx_ontap_file_system":   {Tok: awsResource(fsxMod, "OntapFileSystem")},
+			"aws_fsx_lustre_file_system":            {Tok: awsResource(fsxMod, "LustreFileSystem")},
+			"aws_fsx_windows_file_system":           {Tok: awsResource(fsxMod, "WindowsFileSystem")},
+			"aws_fsx_backup":                        {Tok: awsResource(fsxMod, "Backup")},
+			"aws_fsx_ontap_file_system":             {Tok: awsResource(fsxMod, "OntapFileSystem")},
+			"aws_fsx_ontap_storage_virtual_machine": {Tok: awsResource(fsxMod, "OntapStorageVirtualMachine")},
+			"aws_fsx_ontap_volume":                  {Tok: awsResource(fsxMod, "OntapVolume")},
 			// GameLift
 			"aws_gamelift_alias":              {Tok: awsResource(gameliftMod, "Alias")},
 			"aws_gamelift_build":              {Tok: awsResource(gameliftMod, "Build")},
@@ -2800,10 +2805,13 @@ func Provider() tfbridge.ProviderInfo {
 			"aws_appconfig_deployment":                   {Tok: awsResource(appConfigMod, "Deployment")},
 
 			// AppStream
-			"aws_appstream_stack":            {Tok: awsResource(appStreamMod, "Stack")},
-			"aws_appstream_fleet":            {Tok: awsResource(appStreamMod, "Fleet")},
-			"aws_appstream_image_builder":    {Tok: awsResource(appStreamMod, "ImageBuilder")},
-			"aws_appstream_directory_config": {Tok: awsResource(appStreamMod, "DirectoryConfig")},
+			"aws_appstream_stack":                   {Tok: awsResource(appStreamMod, "Stack")},
+			"aws_appstream_fleet":                   {Tok: awsResource(appStreamMod, "Fleet")},
+			"aws_appstream_image_builder":           {Tok: awsResource(appStreamMod, "ImageBuilder")},
+			"aws_appstream_directory_config":        {Tok: awsResource(appStreamMod, "DirectoryConfig")},
+			"aws_appstream_fleet_stack_association": {Tok: awsResource(appStreamMod, "FleetStackAssociation")},
+			"aws_appstream_user_stack_association":  {Tok: awsResource(appStreamMod, "UserStackAssociation")},
+			"aws_appstream_user":                    {Tok: awsResource(appStreamMod, "User")},
 
 			// mwaa
 			"aws_mwaa_environment": {Tok: awsResource(mwaaMod, "Environment")},
@@ -3962,6 +3970,7 @@ func Provider() tfbridge.ProviderInfo {
 			"aws_ec2_host":                         {Tok: awsDataSource(ec2Mod, "getDedicatedHost")},
 			"aws_ec2_managed_prefix_list":          {Tok: awsDataSource(ec2Mod, "getManagedPrefixList")},
 			"aws_ec2_transit_gateway_route_tables": {Tok: awsDataSource(ec2Mod, "getTransitGatewayRouteTables")},
+			"aws_ec2_instance_types":               {Tok: awsDataSource(ec2Mod, "getInstanceTypes")},
 			// EC2 Transit Gateway
 			"aws_ec2_transit_gateway": {Tok: awsDataSource(ec2TransitGatewayMod, "getTransitGateway")},
 			"aws_ec2_transit_gateway_dx_gateway_attachment": {
@@ -4249,6 +4258,7 @@ func Provider() tfbridge.ProviderInfo {
 			"aws_imagebuilder_image_pipeline": {Tok: awsDataSource(imageBuilderMod, "getImagePipeline")},
 			"aws_imagebuilder_image_recipe":   {Tok: awsDataSource(imageBuilderMod, "getImageRecipe")},
 			"aws_imagebuilder_image":          {Tok: awsDataSource(imageBuilderMod, "getImage")},
+			"aws_imagebuilder_image_recipes":  {Tok: awsDataSource(imageBuilderMod, "getImageRecipes")},
 			//signer
 			"aws_signer_signing_job":     {Tok: awsDataSource(signerMod, "getSigningJob")},
 			"aws_signer_signing_profile": {Tok: awsDataSource(signerMod, "getSigningProfile")},
diff --git a/provider/shim/go.mod b/provider/shim/go.mod
index a6a60bc4944..55cc0167ef4 100644
--- a/provider/shim/go.mod
+++ b/provider/shim/go.mod
@@ -7,4 +7,4 @@ require (
 	github.com/hashicorp/terraform-provider-aws v1.60.1-0.20211105002759-77bad27d9f23
 )
 
-replace github.com/hashicorp/terraform-provider-aws => github.com/pulumi/terraform-provider-aws v1.38.1-0.20211119154650-363f3878c1f3
+replace github.com/hashicorp/terraform-provider-aws => github.com/pulumi/terraform-provider-aws v1.38.1-0.20211126142250-dc1d1293bc65
diff --git a/provider/shim/go.sum b/provider/shim/go.sum
index e05da9e4ed9..97f47632a32 100644
--- a/provider/shim/go.sum
+++ b/provider/shim/go.sum
@@ -66,8 +66,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkY
 github.com/aws/aws-sdk-go v1.15.78/go.mod h1:E3/ieXAlvM0XWO57iftYVDLLvQ824smPP3ATZkfNZeM=
 github.com/aws/aws-sdk-go v1.25.3/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.31.9/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
-github.com/aws/aws-sdk-go v1.42.5 h1:0xNoQrGh9InmUsT+9qzZ8QLfBEUsnev5BMeED6t6cKI=
-github.com/aws/aws-sdk-go v1.42.5/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
+github.com/aws/aws-sdk-go v1.42.9 h1:8ptAGgA+uC2TUbdvUeOVSfBocIZvGE2NKiLxkAcn1GA=
+github.com/aws/aws-sdk-go v1.42.9/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
 github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
 github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
@@ -307,8 +307,8 @@ github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndr
 github.com/pquerna/otp v1.3.0 h1:oJV/SkzR33anKXwQU3Of42rL4wbrffP4uvUf1SvS5Xs=
 github.com/pquerna/otp v1.3.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/pulumi/terraform-provider-aws v1.38.1-0.20211119154650-363f3878c1f3 h1:fpkTPTWOEMUuAbCDVbpPoIPC6aq5rqWuIlleebGpKbk=
-github.com/pulumi/terraform-provider-aws v1.38.1-0.20211119154650-363f3878c1f3/go.mod h1:cO8zE16eeebXY2wZ+jezVWxSXam0CpzdfS3sUTeP8dg=
+github.com/pulumi/terraform-provider-aws v1.38.1-0.20211126142250-dc1d1293bc65 h1:wW2PMxZ4W5W2LF/iUeFRgySj1MSRUoDfQoc6RDjZG54=
+github.com/pulumi/terraform-provider-aws v1.38.1-0.20211126142250-dc1d1293bc65/go.mod h1:yEpM6MJmGJKSB/WHjMnNbYbRWO9ydLwuaN5OkJExysw=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
diff --git a/sdk/dotnet/Account/AlternativeContact.cs b/sdk/dotnet/Account/AlternativeContact.cs
new file mode 100644
index 00000000000..c62f4fd509f
--- /dev/null
+++ b/sdk/dotnet/Account/AlternativeContact.cs
@@ -0,0 +1,195 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Account
+{
+    /// <summary>
+    /// Manages the specified alternate contact attached to an AWS Account.
+    /// 
+    /// ## Example Usage
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         var operations = new Aws.Account.AlternativeContact("operations", new Aws.Account.AlternativeContactArgs
+    ///         {
+    ///             AlternateContactType = "OPERATIONS",
+    ///             EmailAddress = "test@example.com",
+    ///             PhoneNumber = "+1234567890",
+    ///             Title = "Example",
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
+    /// 
+    /// ## Import
+    /// 
+    /// The current Alternate Contact can be imported using the `alternate_contact_type`, e.g.,
+    /// 
+    /// ```sh
+    ///  $ pulumi import aws:account/alternativeContact:AlternativeContact operations OPERATIONS
+    /// ```
+    /// </summary>
+    [AwsResourceType("aws:account/alternativeContact:AlternativeContact")]
+    public partial class AlternativeContact : Pulumi.CustomResource
+    {
+        /// <summary>
+        /// The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        /// </summary>
+        [Output("alternateContactType")]
+        public Output<string> AlternateContactType { get; private set; } = null!;
+
+        /// <summary>
+        /// An email address for the alternate contact.
+        /// </summary>
+        [Output("emailAddress")]
+        public Output<string> EmailAddress { get; private set; } = null!;
+
+        /// <summary>
+        /// The name of the alternate contact.
+        /// </summary>
+        [Output("name")]
+        public Output<string> Name { get; private set; } = null!;
+
+        /// <summary>
+        /// A phone number for the alternate contact.
+        /// </summary>
+        [Output("phoneNumber")]
+        public Output<string> PhoneNumber { get; private set; } = null!;
+
+        /// <summary>
+        /// A title for the alternate contact.
+        /// </summary>
+        [Output("title")]
+        public Output<string> Title { get; private set; } = null!;
+
+
+        /// <summary>
+        /// Create a AlternativeContact resource with the given unique name, arguments, and options.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resource</param>
+        /// <param name="args">The arguments used to populate this resource's properties</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public AlternativeContact(string name, AlternativeContactArgs args, CustomResourceOptions? options = null)
+            : base("aws:account/alternativeContact:AlternativeContact", name, args ?? new AlternativeContactArgs(), MakeResourceOptions(options, ""))
+        {
+        }
+
+        private AlternativeContact(string name, Input<string> id, AlternativeContactState? state = null, CustomResourceOptions? options = null)
+            : base("aws:account/alternativeContact:AlternativeContact", name, state, MakeResourceOptions(options, id))
+        {
+        }
+
+        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
+        {
+            var defaultOptions = new CustomResourceOptions
+            {
+                Version = Utilities.Version,
+            };
+            var merged = CustomResourceOptions.Merge(defaultOptions, options);
+            // Override the ID if one was specified for consistency with other language SDKs.
+            merged.Id = id ?? merged.Id;
+            return merged;
+        }
+        /// <summary>
+        /// Get an existing AlternativeContact resource's state with the given name, ID, and optional extra
+        /// properties used to qualify the lookup.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resulting resource.</param>
+        /// <param name="id">The unique provider ID of the resource to lookup.</param>
+        /// <param name="state">Any extra arguments used during the lookup.</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public static AlternativeContact Get(string name, Input<string> id, AlternativeContactState? state = null, CustomResourceOptions? options = null)
+        {
+            return new AlternativeContact(name, id, state, options);
+        }
+    }
+
+    public sealed class AlternativeContactArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        /// </summary>
+        [Input("alternateContactType", required: true)]
+        public Input<string> AlternateContactType { get; set; } = null!;
+
+        /// <summary>
+        /// An email address for the alternate contact.
+        /// </summary>
+        [Input("emailAddress", required: true)]
+        public Input<string> EmailAddress { get; set; } = null!;
+
+        /// <summary>
+        /// The name of the alternate contact.
+        /// </summary>
+        [Input("name")]
+        public Input<string>? Name { get; set; }
+
+        /// <summary>
+        /// A phone number for the alternate contact.
+        /// </summary>
+        [Input("phoneNumber", required: true)]
+        public Input<string> PhoneNumber { get; set; } = null!;
+
+        /// <summary>
+        /// A title for the alternate contact.
+        /// </summary>
+        [Input("title", required: true)]
+        public Input<string> Title { get; set; } = null!;
+
+        public AlternativeContactArgs()
+        {
+        }
+    }
+
+    public sealed class AlternativeContactState : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        /// </summary>
+        [Input("alternateContactType")]
+        public Input<string>? AlternateContactType { get; set; }
+
+        /// <summary>
+        /// An email address for the alternate contact.
+        /// </summary>
+        [Input("emailAddress")]
+        public Input<string>? EmailAddress { get; set; }
+
+        /// <summary>
+        /// The name of the alternate contact.
+        /// </summary>
+        [Input("name")]
+        public Input<string>? Name { get; set; }
+
+        /// <summary>
+        /// A phone number for the alternate contact.
+        /// </summary>
+        [Input("phoneNumber")]
+        public Input<string>? PhoneNumber { get; set; }
+
+        /// <summary>
+        /// A title for the alternate contact.
+        /// </summary>
+        [Input("title")]
+        public Input<string>? Title { get; set; }
+
+        public AlternativeContactState()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Account/README.md b/sdk/dotnet/Account/README.md
new file mode 100644
index 00000000000..9d868f18f20
--- /dev/null
+++ b/sdk/dotnet/Account/README.md
@@ -0,0 +1 @@
+A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
diff --git a/sdk/dotnet/Alb/GetLoadBalancer.cs b/sdk/dotnet/Alb/GetLoadBalancer.cs
index 45360ddbb21..e3c5d36ead1 100644
--- a/sdk/dotnet/Alb/GetLoadBalancer.cs
+++ b/sdk/dotnet/Alb/GetLoadBalancer.cs
@@ -162,10 +162,12 @@ public sealed class GetLoadBalancerResult
         public readonly string Arn;
         public readonly string ArnSuffix;
         public readonly string CustomerOwnedIpv4Pool;
+        public readonly string DesyncMitigationMode;
         public readonly string DnsName;
         public readonly bool DropInvalidHeaderFields;
         public readonly bool EnableDeletionProtection;
         public readonly bool EnableHttp2;
+        public readonly bool EnableWafFailOpen;
         /// <summary>
         /// The provider-assigned unique ID for this managed resource.
         /// </summary>
@@ -192,6 +194,8 @@ private GetLoadBalancerResult(
 
             string customerOwnedIpv4Pool,
 
+            string desyncMitigationMode,
+
             string dnsName,
 
             bool dropInvalidHeaderFields,
@@ -200,6 +204,8 @@ private GetLoadBalancerResult(
 
             bool enableHttp2,
 
+            bool enableWafFailOpen,
+
             string id,
 
             int idleTimeout,
@@ -228,10 +234,12 @@ private GetLoadBalancerResult(
             Arn = arn;
             ArnSuffix = arnSuffix;
             CustomerOwnedIpv4Pool = customerOwnedIpv4Pool;
+            DesyncMitigationMode = desyncMitigationMode;
             DnsName = dnsName;
             DropInvalidHeaderFields = dropInvalidHeaderFields;
             EnableDeletionProtection = enableDeletionProtection;
             EnableHttp2 = enableHttp2;
+            EnableWafFailOpen = enableWafFailOpen;
             Id = id;
             IdleTimeout = idleTimeout;
             Internal = @internal;
diff --git a/sdk/dotnet/Alb/LoadBalancer.cs b/sdk/dotnet/Alb/LoadBalancer.cs
index 4a8d42bd3f5..688ee8fde89 100644
--- a/sdk/dotnet/Alb/LoadBalancer.cs
+++ b/sdk/dotnet/Alb/LoadBalancer.cs
@@ -175,6 +175,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("customerOwnedIpv4Pool")]
         public Output<string?> CustomerOwnedIpv4Pool { get; private set; } = null!;
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Output("desyncMitigationMode")]
+        public Output<string?> DesyncMitigationMode { get; private set; } = null!;
+
         /// <summary>
         /// The DNS name of the load balancer.
         /// </summary>
@@ -207,6 +213,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("enableHttp2")]
         public Output<bool?> EnableHttp2 { get; private set; } = null!;
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Output("enableWafFailOpen")]
+        public Output<bool?> EnableWafFailOpen { get; private set; } = null!;
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -266,7 +278,7 @@ public partial class LoadBalancer : Pulumi.CustomResource
         public Output<ImmutableArray<string>> Subnets { get; private set; } = null!;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         [Output("tags")]
         public Output<ImmutableDictionary<string, string>?> Tags { get; private set; } = null!;
@@ -349,6 +361,12 @@ public sealed class LoadBalancerArgs : Pulumi.ResourceArgs
         [Input("customerOwnedIpv4Pool")]
         public Input<string>? CustomerOwnedIpv4Pool { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         /// </summary>
@@ -375,6 +393,12 @@ public sealed class LoadBalancerArgs : Pulumi.ResourceArgs
         [Input("enableHttp2")]
         public Input<bool>? EnableHttp2 { get; set; }
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Input("enableWafFailOpen")]
+        public Input<bool>? EnableWafFailOpen { get; set; }
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -455,7 +479,7 @@ public InputList<string> Subnets
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
@@ -494,6 +518,12 @@ public sealed class LoadBalancerState : Pulumi.ResourceArgs
         [Input("customerOwnedIpv4Pool")]
         public Input<string>? CustomerOwnedIpv4Pool { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// The DNS name of the load balancer.
         /// </summary>
@@ -526,6 +556,12 @@ public sealed class LoadBalancerState : Pulumi.ResourceArgs
         [Input("enableHttp2")]
         public Input<bool>? EnableHttp2 { get; set; }
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Input("enableWafFailOpen")]
+        public Input<bool>? EnableWafFailOpen { get; set; }
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -606,7 +642,7 @@ public InputList<string> Subnets
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
diff --git a/sdk/dotnet/AppRunner/Inputs/ServiceInstanceConfigurationArgs.cs b/sdk/dotnet/AppRunner/Inputs/ServiceInstanceConfigurationArgs.cs
index ef492422e6a..295e98b611b 100644
--- a/sdk/dotnet/AppRunner/Inputs/ServiceInstanceConfigurationArgs.cs
+++ b/sdk/dotnet/AppRunner/Inputs/ServiceInstanceConfigurationArgs.cs
@@ -21,8 +21,8 @@ public sealed class ServiceInstanceConfigurationArgs : Pulumi.ResourceArgs
         /// <summary>
         /// The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
         /// </summary>
-        [Input("instanceRoleArn", required: true)]
-        public Input<string> InstanceRoleArn { get; set; } = null!;
+        [Input("instanceRoleArn")]
+        public Input<string>? InstanceRoleArn { get; set; }
 
         /// <summary>
         /// The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
diff --git a/sdk/dotnet/AppRunner/Inputs/ServiceInstanceConfigurationGetArgs.cs b/sdk/dotnet/AppRunner/Inputs/ServiceInstanceConfigurationGetArgs.cs
index 311b2717b85..011d93b882d 100644
--- a/sdk/dotnet/AppRunner/Inputs/ServiceInstanceConfigurationGetArgs.cs
+++ b/sdk/dotnet/AppRunner/Inputs/ServiceInstanceConfigurationGetArgs.cs
@@ -21,8 +21,8 @@ public sealed class ServiceInstanceConfigurationGetArgs : Pulumi.ResourceArgs
         /// <summary>
         /// The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
         /// </summary>
-        [Input("instanceRoleArn", required: true)]
-        public Input<string> InstanceRoleArn { get; set; } = null!;
+        [Input("instanceRoleArn")]
+        public Input<string>? InstanceRoleArn { get; set; }
 
         /// <summary>
         /// The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
diff --git a/sdk/dotnet/AppRunner/Outputs/ServiceInstanceConfiguration.cs b/sdk/dotnet/AppRunner/Outputs/ServiceInstanceConfiguration.cs
index 2051d3664db..6076dd15cdb 100644
--- a/sdk/dotnet/AppRunner/Outputs/ServiceInstanceConfiguration.cs
+++ b/sdk/dotnet/AppRunner/Outputs/ServiceInstanceConfiguration.cs
@@ -20,7 +20,7 @@ public sealed class ServiceInstanceConfiguration
         /// <summary>
         /// The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
         /// </summary>
-        public readonly string InstanceRoleArn;
+        public readonly string? InstanceRoleArn;
         /// <summary>
         /// The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
         /// </summary>
@@ -30,7 +30,7 @@ public sealed class ServiceInstanceConfiguration
         private ServiceInstanceConfiguration(
             string? cpu,
 
-            string instanceRoleArn,
+            string? instanceRoleArn,
 
             string? memory)
         {
diff --git a/sdk/dotnet/AppStream/FleetStackAssociation.cs b/sdk/dotnet/AppStream/FleetStackAssociation.cs
new file mode 100644
index 00000000000..d5ee7354c8b
--- /dev/null
+++ b/sdk/dotnet/AppStream/FleetStackAssociation.cs
@@ -0,0 +1,151 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.AppStream
+{
+    /// <summary>
+    /// Manages an AppStream Fleet Stack association.
+    /// 
+    /// ## Example Usage
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         var exampleFleet = new Aws.AppStream.Fleet("exampleFleet", new Aws.AppStream.FleetArgs
+    ///         {
+    ///             ImageName = "Amazon-AppStream2-Sample-Image-02-04-2019",
+    ///             InstanceType = "stream.standard.small",
+    ///             ComputeCapacity = new Aws.AppStream.Inputs.FleetComputeCapacityArgs
+    ///             {
+    ///                 DesiredInstances = 1,
+    ///             },
+    ///         });
+    ///         var exampleStack = new Aws.AppStream.Stack("exampleStack", new Aws.AppStream.StackArgs
+    ///         {
+    ///         });
+    ///         var exampleFleetStackAssociation = new Aws.AppStream.FleetStackAssociation("exampleFleetStackAssociation", new Aws.AppStream.FleetStackAssociationArgs
+    ///         {
+    ///             FleetName = exampleFleet.Name,
+    ///             StackName = exampleStack.Name,
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
+    /// 
+    /// ## Import
+    /// 
+    /// AppStream Stack Fleet Association can be imported by using the `fleet_name` and `stack_name` separated by a slash (`/`), e.g.,
+    /// 
+    /// ```sh
+    ///  $ pulumi import aws:appstream/fleetStackAssociation:FleetStackAssociation example fleetName/stackName
+    /// ```
+    /// </summary>
+    [AwsResourceType("aws:appstream/fleetStackAssociation:FleetStackAssociation")]
+    public partial class FleetStackAssociation : Pulumi.CustomResource
+    {
+        /// <summary>
+        /// Name of the fleet.
+        /// </summary>
+        [Output("fleetName")]
+        public Output<string> FleetName { get; private set; } = null!;
+
+        /// <summary>
+        /// Name of the stack.
+        /// </summary>
+        [Output("stackName")]
+        public Output<string> StackName { get; private set; } = null!;
+
+
+        /// <summary>
+        /// Create a FleetStackAssociation resource with the given unique name, arguments, and options.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resource</param>
+        /// <param name="args">The arguments used to populate this resource's properties</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public FleetStackAssociation(string name, FleetStackAssociationArgs args, CustomResourceOptions? options = null)
+            : base("aws:appstream/fleetStackAssociation:FleetStackAssociation", name, args ?? new FleetStackAssociationArgs(), MakeResourceOptions(options, ""))
+        {
+        }
+
+        private FleetStackAssociation(string name, Input<string> id, FleetStackAssociationState? state = null, CustomResourceOptions? options = null)
+            : base("aws:appstream/fleetStackAssociation:FleetStackAssociation", name, state, MakeResourceOptions(options, id))
+        {
+        }
+
+        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
+        {
+            var defaultOptions = new CustomResourceOptions
+            {
+                Version = Utilities.Version,
+            };
+            var merged = CustomResourceOptions.Merge(defaultOptions, options);
+            // Override the ID if one was specified for consistency with other language SDKs.
+            merged.Id = id ?? merged.Id;
+            return merged;
+        }
+        /// <summary>
+        /// Get an existing FleetStackAssociation resource's state with the given name, ID, and optional extra
+        /// properties used to qualify the lookup.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resulting resource.</param>
+        /// <param name="id">The unique provider ID of the resource to lookup.</param>
+        /// <param name="state">Any extra arguments used during the lookup.</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public static FleetStackAssociation Get(string name, Input<string> id, FleetStackAssociationState? state = null, CustomResourceOptions? options = null)
+        {
+            return new FleetStackAssociation(name, id, state, options);
+        }
+    }
+
+    public sealed class FleetStackAssociationArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Name of the fleet.
+        /// </summary>
+        [Input("fleetName", required: true)]
+        public Input<string> FleetName { get; set; } = null!;
+
+        /// <summary>
+        /// Name of the stack.
+        /// </summary>
+        [Input("stackName", required: true)]
+        public Input<string> StackName { get; set; } = null!;
+
+        public FleetStackAssociationArgs()
+        {
+        }
+    }
+
+    public sealed class FleetStackAssociationState : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Name of the fleet.
+        /// </summary>
+        [Input("fleetName")]
+        public Input<string>? FleetName { get; set; }
+
+        /// <summary>
+        /// Name of the stack.
+        /// </summary>
+        [Input("stackName")]
+        public Input<string>? StackName { get; set; }
+
+        public FleetStackAssociationState()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/AppStream/User.cs b/sdk/dotnet/AppStream/User.cs
new file mode 100644
index 00000000000..19819316bee
--- /dev/null
+++ b/sdk/dotnet/AppStream/User.cs
@@ -0,0 +1,237 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.AppStream
+{
+    /// <summary>
+    /// Provides an AppStream user.
+    /// 
+    /// ## Example Usage
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         var example = new Aws.AppStream.User("example", new Aws.AppStream.UserArgs
+    ///         {
+    ///             AuthenticationType = "USERPOOL",
+    ///             FirstName = "FIRST NAME",
+    ///             LastName = "LAST NAME",
+    ///             UserName = "EMAIL ADDRESS",
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
+    /// 
+    /// ## Import
+    /// 
+    /// `aws_appstream_user` can be imported using the `user_name` and `authentication_type` separated by a slash (`/`), e.g.,
+    /// 
+    /// ```sh
+    ///  $ pulumi import aws:appstream/user:User example UserName/AuthenticationType
+    /// ```
+    /// </summary>
+    [AwsResourceType("aws:appstream/user:User")]
+    public partial class User : Pulumi.CustomResource
+    {
+        /// <summary>
+        /// ARN of the appstream user.
+        /// </summary>
+        [Output("arn")]
+        public Output<string> Arn { get; private set; } = null!;
+
+        /// <summary>
+        /// Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        /// </summary>
+        [Output("authenticationType")]
+        public Output<string> AuthenticationType { get; private set; } = null!;
+
+        /// <summary>
+        /// Date and time, in UTC and extended RFC 3339 format, when the user was created.
+        /// </summary>
+        [Output("createdTime")]
+        public Output<string> CreatedTime { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies whether the user in the user pool is enabled.
+        /// </summary>
+        [Output("enabled")]
+        public Output<bool?> Enabled { get; private set; } = null!;
+
+        /// <summary>
+        /// First name, or given name, of the user.
+        /// </summary>
+        [Output("firstName")]
+        public Output<string?> FirstName { get; private set; } = null!;
+
+        /// <summary>
+        /// Last name, or surname, of the user.
+        /// </summary>
+        [Output("lastName")]
+        public Output<string?> LastName { get; private set; } = null!;
+
+        /// <summary>
+        /// Send an email notification.
+        /// </summary>
+        [Output("sendEmailNotification")]
+        public Output<bool?> SendEmailNotification { get; private set; } = null!;
+
+        /// <summary>
+        /// Email address of the user.
+        /// </summary>
+        [Output("userName")]
+        public Output<string> UserName { get; private set; } = null!;
+
+
+        /// <summary>
+        /// Create a User resource with the given unique name, arguments, and options.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resource</param>
+        /// <param name="args">The arguments used to populate this resource's properties</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public User(string name, UserArgs args, CustomResourceOptions? options = null)
+            : base("aws:appstream/user:User", name, args ?? new UserArgs(), MakeResourceOptions(options, ""))
+        {
+        }
+
+        private User(string name, Input<string> id, UserState? state = null, CustomResourceOptions? options = null)
+            : base("aws:appstream/user:User", name, state, MakeResourceOptions(options, id))
+        {
+        }
+
+        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
+        {
+            var defaultOptions = new CustomResourceOptions
+            {
+                Version = Utilities.Version,
+            };
+            var merged = CustomResourceOptions.Merge(defaultOptions, options);
+            // Override the ID if one was specified for consistency with other language SDKs.
+            merged.Id = id ?? merged.Id;
+            return merged;
+        }
+        /// <summary>
+        /// Get an existing User resource's state with the given name, ID, and optional extra
+        /// properties used to qualify the lookup.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resulting resource.</param>
+        /// <param name="id">The unique provider ID of the resource to lookup.</param>
+        /// <param name="state">Any extra arguments used during the lookup.</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public static User Get(string name, Input<string> id, UserState? state = null, CustomResourceOptions? options = null)
+        {
+            return new User(name, id, state, options);
+        }
+    }
+
+    public sealed class UserArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        /// </summary>
+        [Input("authenticationType", required: true)]
+        public Input<string> AuthenticationType { get; set; } = null!;
+
+        /// <summary>
+        /// Specifies whether the user in the user pool is enabled.
+        /// </summary>
+        [Input("enabled")]
+        public Input<bool>? Enabled { get; set; }
+
+        /// <summary>
+        /// First name, or given name, of the user.
+        /// </summary>
+        [Input("firstName")]
+        public Input<string>? FirstName { get; set; }
+
+        /// <summary>
+        /// Last name, or surname, of the user.
+        /// </summary>
+        [Input("lastName")]
+        public Input<string>? LastName { get; set; }
+
+        /// <summary>
+        /// Send an email notification.
+        /// </summary>
+        [Input("sendEmailNotification")]
+        public Input<bool>? SendEmailNotification { get; set; }
+
+        /// <summary>
+        /// Email address of the user.
+        /// </summary>
+        [Input("userName", required: true)]
+        public Input<string> UserName { get; set; } = null!;
+
+        public UserArgs()
+        {
+        }
+    }
+
+    public sealed class UserState : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// ARN of the appstream user.
+        /// </summary>
+        [Input("arn")]
+        public Input<string>? Arn { get; set; }
+
+        /// <summary>
+        /// Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        /// </summary>
+        [Input("authenticationType")]
+        public Input<string>? AuthenticationType { get; set; }
+
+        /// <summary>
+        /// Date and time, in UTC and extended RFC 3339 format, when the user was created.
+        /// </summary>
+        [Input("createdTime")]
+        public Input<string>? CreatedTime { get; set; }
+
+        /// <summary>
+        /// Specifies whether the user in the user pool is enabled.
+        /// </summary>
+        [Input("enabled")]
+        public Input<bool>? Enabled { get; set; }
+
+        /// <summary>
+        /// First name, or given name, of the user.
+        /// </summary>
+        [Input("firstName")]
+        public Input<string>? FirstName { get; set; }
+
+        /// <summary>
+        /// Last name, or surname, of the user.
+        /// </summary>
+        [Input("lastName")]
+        public Input<string>? LastName { get; set; }
+
+        /// <summary>
+        /// Send an email notification.
+        /// </summary>
+        [Input("sendEmailNotification")]
+        public Input<bool>? SendEmailNotification { get; set; }
+
+        /// <summary>
+        /// Email address of the user.
+        /// </summary>
+        [Input("userName")]
+        public Input<string>? UserName { get; set; }
+
+        public UserState()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/AppStream/UserStackAssociation.cs b/sdk/dotnet/AppStream/UserStackAssociation.cs
new file mode 100644
index 00000000000..977bcff2d30
--- /dev/null
+++ b/sdk/dotnet/AppStream/UserStackAssociation.cs
@@ -0,0 +1,184 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.AppStream
+{
+    /// <summary>
+    /// Manages an AppStream User Stack association.
+    /// 
+    /// ## Example Usage
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         var testStack = new Aws.AppStream.Stack("testStack", new Aws.AppStream.StackArgs
+    ///         {
+    ///         });
+    ///         var testUser = new Aws.AppStream.User("testUser", new Aws.AppStream.UserArgs
+    ///         {
+    ///             AuthenticationType = "USERPOOL",
+    ///             UserName = "EMAIL",
+    ///         });
+    ///         var testUserStackAssociation = new Aws.AppStream.UserStackAssociation("testUserStackAssociation", new Aws.AppStream.UserStackAssociationArgs
+    ///         {
+    ///             AuthenticationType = testUser.AuthenticationType,
+    ///             StackName = testStack.Name,
+    ///             UserName = testUser.UserName,
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
+    /// 
+    /// ## Import
+    /// 
+    /// AppStream User Stack Association can be imported by using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`), e.g.,
+    /// 
+    /// ```sh
+    ///  $ pulumi import aws:appstream/userStackAssociation:UserStackAssociation example userName/auhtenticationType/stackName
+    /// ```
+    /// </summary>
+    [AwsResourceType("aws:appstream/userStackAssociation:UserStackAssociation")]
+    public partial class UserStackAssociation : Pulumi.CustomResource
+    {
+        /// <summary>
+        /// Authentication type for the user.
+        /// </summary>
+        [Output("authenticationType")]
+        public Output<string> AuthenticationType { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        /// </summary>
+        [Output("sendEmailNotification")]
+        public Output<bool?> SendEmailNotification { get; private set; } = null!;
+
+        /// <summary>
+        /// Name of the stack that is associated with the user.
+        /// </summary>
+        [Output("stackName")]
+        public Output<string> StackName { get; private set; } = null!;
+
+        /// <summary>
+        /// Email address of the user who is associated with the stack.
+        /// </summary>
+        [Output("userName")]
+        public Output<string> UserName { get; private set; } = null!;
+
+
+        /// <summary>
+        /// Create a UserStackAssociation resource with the given unique name, arguments, and options.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resource</param>
+        /// <param name="args">The arguments used to populate this resource's properties</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public UserStackAssociation(string name, UserStackAssociationArgs args, CustomResourceOptions? options = null)
+            : base("aws:appstream/userStackAssociation:UserStackAssociation", name, args ?? new UserStackAssociationArgs(), MakeResourceOptions(options, ""))
+        {
+        }
+
+        private UserStackAssociation(string name, Input<string> id, UserStackAssociationState? state = null, CustomResourceOptions? options = null)
+            : base("aws:appstream/userStackAssociation:UserStackAssociation", name, state, MakeResourceOptions(options, id))
+        {
+        }
+
+        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
+        {
+            var defaultOptions = new CustomResourceOptions
+            {
+                Version = Utilities.Version,
+            };
+            var merged = CustomResourceOptions.Merge(defaultOptions, options);
+            // Override the ID if one was specified for consistency with other language SDKs.
+            merged.Id = id ?? merged.Id;
+            return merged;
+        }
+        /// <summary>
+        /// Get an existing UserStackAssociation resource's state with the given name, ID, and optional extra
+        /// properties used to qualify the lookup.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resulting resource.</param>
+        /// <param name="id">The unique provider ID of the resource to lookup.</param>
+        /// <param name="state">Any extra arguments used during the lookup.</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public static UserStackAssociation Get(string name, Input<string> id, UserStackAssociationState? state = null, CustomResourceOptions? options = null)
+        {
+            return new UserStackAssociation(name, id, state, options);
+        }
+    }
+
+    public sealed class UserStackAssociationArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Authentication type for the user.
+        /// </summary>
+        [Input("authenticationType", required: true)]
+        public Input<string> AuthenticationType { get; set; } = null!;
+
+        /// <summary>
+        /// Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        /// </summary>
+        [Input("sendEmailNotification")]
+        public Input<bool>? SendEmailNotification { get; set; }
+
+        /// <summary>
+        /// Name of the stack that is associated with the user.
+        /// </summary>
+        [Input("stackName", required: true)]
+        public Input<string> StackName { get; set; } = null!;
+
+        /// <summary>
+        /// Email address of the user who is associated with the stack.
+        /// </summary>
+        [Input("userName", required: true)]
+        public Input<string> UserName { get; set; } = null!;
+
+        public UserStackAssociationArgs()
+        {
+        }
+    }
+
+    public sealed class UserStackAssociationState : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Authentication type for the user.
+        /// </summary>
+        [Input("authenticationType")]
+        public Input<string>? AuthenticationType { get; set; }
+
+        /// <summary>
+        /// Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        /// </summary>
+        [Input("sendEmailNotification")]
+        public Input<bool>? SendEmailNotification { get; set; }
+
+        /// <summary>
+        /// Name of the stack that is associated with the user.
+        /// </summary>
+        [Input("stackName")]
+        public Input<string>? StackName { get; set; }
+
+        /// <summary>
+        /// Email address of the user who is associated with the stack.
+        /// </summary>
+        [Input("userName")]
+        public Input<string>? UserName { get; set; }
+
+        public UserStackAssociationState()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/ApplicationLoadBalancing/GetLoadBalancer.cs b/sdk/dotnet/ApplicationLoadBalancing/GetLoadBalancer.cs
index f65774bd4e5..da443002e54 100644
--- a/sdk/dotnet/ApplicationLoadBalancing/GetLoadBalancer.cs
+++ b/sdk/dotnet/ApplicationLoadBalancing/GetLoadBalancer.cs
@@ -163,10 +163,12 @@ public sealed class GetLoadBalancerResult
         public readonly string Arn;
         public readonly string ArnSuffix;
         public readonly string CustomerOwnedIpv4Pool;
+        public readonly string DesyncMitigationMode;
         public readonly string DnsName;
         public readonly bool DropInvalidHeaderFields;
         public readonly bool EnableDeletionProtection;
         public readonly bool EnableHttp2;
+        public readonly bool EnableWafFailOpen;
         /// <summary>
         /// The provider-assigned unique ID for this managed resource.
         /// </summary>
@@ -193,6 +195,8 @@ private GetLoadBalancerResult(
 
             string customerOwnedIpv4Pool,
 
+            string desyncMitigationMode,
+
             string dnsName,
 
             bool dropInvalidHeaderFields,
@@ -201,6 +205,8 @@ private GetLoadBalancerResult(
 
             bool enableHttp2,
 
+            bool enableWafFailOpen,
+
             string id,
 
             int idleTimeout,
@@ -229,10 +235,12 @@ private GetLoadBalancerResult(
             Arn = arn;
             ArnSuffix = arnSuffix;
             CustomerOwnedIpv4Pool = customerOwnedIpv4Pool;
+            DesyncMitigationMode = desyncMitigationMode;
             DnsName = dnsName;
             DropInvalidHeaderFields = dropInvalidHeaderFields;
             EnableDeletionProtection = enableDeletionProtection;
             EnableHttp2 = enableHttp2;
+            EnableWafFailOpen = enableWafFailOpen;
             Id = id;
             IdleTimeout = idleTimeout;
             Internal = @internal;
diff --git a/sdk/dotnet/ApplicationLoadBalancing/LoadBalancer.cs b/sdk/dotnet/ApplicationLoadBalancing/LoadBalancer.cs
index 720c96535f1..6ae526c7eb0 100644
--- a/sdk/dotnet/ApplicationLoadBalancing/LoadBalancer.cs
+++ b/sdk/dotnet/ApplicationLoadBalancing/LoadBalancer.cs
@@ -176,6 +176,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("customerOwnedIpv4Pool")]
         public Output<string?> CustomerOwnedIpv4Pool { get; private set; } = null!;
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Output("desyncMitigationMode")]
+        public Output<string?> DesyncMitigationMode { get; private set; } = null!;
+
         /// <summary>
         /// The DNS name of the load balancer.
         /// </summary>
@@ -208,6 +214,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("enableHttp2")]
         public Output<bool?> EnableHttp2 { get; private set; } = null!;
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Output("enableWafFailOpen")]
+        public Output<bool?> EnableWafFailOpen { get; private set; } = null!;
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -267,7 +279,7 @@ public partial class LoadBalancer : Pulumi.CustomResource
         public Output<ImmutableArray<string>> Subnets { get; private set; } = null!;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         [Output("tags")]
         public Output<ImmutableDictionary<string, string>?> Tags { get; private set; } = null!;
@@ -346,6 +358,12 @@ public sealed class LoadBalancerArgs : Pulumi.ResourceArgs
         [Input("customerOwnedIpv4Pool")]
         public Input<string>? CustomerOwnedIpv4Pool { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         /// </summary>
@@ -372,6 +390,12 @@ public sealed class LoadBalancerArgs : Pulumi.ResourceArgs
         [Input("enableHttp2")]
         public Input<bool>? EnableHttp2 { get; set; }
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Input("enableWafFailOpen")]
+        public Input<bool>? EnableWafFailOpen { get; set; }
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -452,7 +476,7 @@ public InputList<string> Subnets
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
@@ -491,6 +515,12 @@ public sealed class LoadBalancerState : Pulumi.ResourceArgs
         [Input("customerOwnedIpv4Pool")]
         public Input<string>? CustomerOwnedIpv4Pool { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// The DNS name of the load balancer.
         /// </summary>
@@ -523,6 +553,12 @@ public sealed class LoadBalancerState : Pulumi.ResourceArgs
         [Input("enableHttp2")]
         public Input<bool>? EnableHttp2 { get; set; }
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Input("enableWafFailOpen")]
+        public Input<bool>? EnableWafFailOpen { get; set; }
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -603,7 +639,7 @@ public InputList<string> Subnets
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
diff --git a/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationArgs.cs b/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationArgs.cs
index fa43d6638e7..7356cb09f20 100644
--- a/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationArgs.cs
+++ b/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationArgs.cs
@@ -24,6 +24,12 @@ public sealed class WorkgroupConfigurationArgs : Pulumi.ResourceArgs
         [Input("enforceWorkgroupConfiguration")]
         public Input<bool>? EnforceWorkgroupConfiguration { get; set; }
 
+        /// <summary>
+        /// Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+        /// </summary>
+        [Input("engineVersion")]
+        public Input<Inputs.WorkgroupConfigurationEngineVersionArgs>? EngineVersion { get; set; }
+
         /// <summary>
         /// Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
         /// </summary>
diff --git a/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationEngineVersionArgs.cs b/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationEngineVersionArgs.cs
new file mode 100644
index 00000000000..cee16b3cbc0
--- /dev/null
+++ b/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationEngineVersionArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Athena.Inputs
+{
+
+    public sealed class WorkgroupConfigurationEngineVersionArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.
+        /// </summary>
+        [Input("effectiveEngineVersion")]
+        public Input<string>? EffectiveEngineVersion { get; set; }
+
+        /// <summary>
+        /// The requested engine version. Defaults to `AUTO`.
+        /// </summary>
+        [Input("selectedEngineVersion")]
+        public Input<string>? SelectedEngineVersion { get; set; }
+
+        public WorkgroupConfigurationEngineVersionArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationEngineVersionGetArgs.cs b/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationEngineVersionGetArgs.cs
new file mode 100644
index 00000000000..3a08c1f9d76
--- /dev/null
+++ b/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationEngineVersionGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Athena.Inputs
+{
+
+    public sealed class WorkgroupConfigurationEngineVersionGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.
+        /// </summary>
+        [Input("effectiveEngineVersion")]
+        public Input<string>? EffectiveEngineVersion { get; set; }
+
+        /// <summary>
+        /// The requested engine version. Defaults to `AUTO`.
+        /// </summary>
+        [Input("selectedEngineVersion")]
+        public Input<string>? SelectedEngineVersion { get; set; }
+
+        public WorkgroupConfigurationEngineVersionGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationGetArgs.cs b/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationGetArgs.cs
index 1be90bf3568..4d0cbe8d75f 100644
--- a/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationGetArgs.cs
+++ b/sdk/dotnet/Athena/Inputs/WorkgroupConfigurationGetArgs.cs
@@ -24,6 +24,12 @@ public sealed class WorkgroupConfigurationGetArgs : Pulumi.ResourceArgs
         [Input("enforceWorkgroupConfiguration")]
         public Input<bool>? EnforceWorkgroupConfiguration { get; set; }
 
+        /// <summary>
+        /// Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+        /// </summary>
+        [Input("engineVersion")]
+        public Input<Inputs.WorkgroupConfigurationEngineVersionGetArgs>? EngineVersion { get; set; }
+
         /// <summary>
         /// Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
         /// </summary>
diff --git a/sdk/dotnet/Athena/Outputs/WorkgroupConfiguration.cs b/sdk/dotnet/Athena/Outputs/WorkgroupConfiguration.cs
index 6d33166e5a7..e4903c9c190 100644
--- a/sdk/dotnet/Athena/Outputs/WorkgroupConfiguration.cs
+++ b/sdk/dotnet/Athena/Outputs/WorkgroupConfiguration.cs
@@ -22,6 +22,10 @@ public sealed class WorkgroupConfiguration
         /// </summary>
         public readonly bool? EnforceWorkgroupConfiguration;
         /// <summary>
+        /// Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+        /// </summary>
+        public readonly Outputs.WorkgroupConfigurationEngineVersion? EngineVersion;
+        /// <summary>
         /// Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
         /// </summary>
         public readonly bool? PublishCloudwatchMetricsEnabled;
@@ -40,6 +44,8 @@ private WorkgroupConfiguration(
 
             bool? enforceWorkgroupConfiguration,
 
+            Outputs.WorkgroupConfigurationEngineVersion? engineVersion,
+
             bool? publishCloudwatchMetricsEnabled,
 
             bool? requesterPaysEnabled,
@@ -48,6 +54,7 @@ private WorkgroupConfiguration(
         {
             BytesScannedCutoffPerQuery = bytesScannedCutoffPerQuery;
             EnforceWorkgroupConfiguration = enforceWorkgroupConfiguration;
+            EngineVersion = engineVersion;
             PublishCloudwatchMetricsEnabled = publishCloudwatchMetricsEnabled;
             RequesterPaysEnabled = requesterPaysEnabled;
             ResultConfiguration = resultConfiguration;
diff --git a/sdk/dotnet/Athena/Outputs/WorkgroupConfigurationEngineVersion.cs b/sdk/dotnet/Athena/Outputs/WorkgroupConfigurationEngineVersion.cs
new file mode 100644
index 00000000000..91a3f68822a
--- /dev/null
+++ b/sdk/dotnet/Athena/Outputs/WorkgroupConfigurationEngineVersion.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Athena.Outputs
+{
+
+    [OutputType]
+    public sealed class WorkgroupConfigurationEngineVersion
+    {
+        /// <summary>
+        /// The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.
+        /// </summary>
+        public readonly string? EffectiveEngineVersion;
+        /// <summary>
+        /// The requested engine version. Defaults to `AUTO`.
+        /// </summary>
+        public readonly string? SelectedEngineVersion;
+
+        [OutputConstructor]
+        private WorkgroupConfigurationEngineVersion(
+            string? effectiveEngineVersion,
+
+            string? selectedEngineVersion)
+        {
+            EffectiveEngineVersion = effectiveEngineVersion;
+            SelectedEngineVersion = selectedEngineVersion;
+        }
+    }
+}
diff --git a/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsArgs.cs b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsArgs.cs
new file mode 100644
index 00000000000..535885a38c0
--- /dev/null
+++ b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsArgs.cs
@@ -0,0 +1,25 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Cfg.Inputs
+{
+
+    public sealed class RemediationConfigurationExecutionControlsArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Configuration block for SSM controls. See below.
+        /// </summary>
+        [Input("ssmControls")]
+        public Input<Inputs.RemediationConfigurationExecutionControlsSsmControlsArgs>? SsmControls { get; set; }
+
+        public RemediationConfigurationExecutionControlsArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsGetArgs.cs b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsGetArgs.cs
new file mode 100644
index 00000000000..caea162cb7c
--- /dev/null
+++ b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsGetArgs.cs
@@ -0,0 +1,25 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Cfg.Inputs
+{
+
+    public sealed class RemediationConfigurationExecutionControlsGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Configuration block for SSM controls. See below.
+        /// </summary>
+        [Input("ssmControls")]
+        public Input<Inputs.RemediationConfigurationExecutionControlsSsmControlsGetArgs>? SsmControls { get; set; }
+
+        public RemediationConfigurationExecutionControlsGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsSsmControlsArgs.cs b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsSsmControlsArgs.cs
new file mode 100644
index 00000000000..df4b5e9dea3
--- /dev/null
+++ b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsSsmControlsArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Cfg.Inputs
+{
+
+    public sealed class RemediationConfigurationExecutionControlsSsmControlsArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+        /// </summary>
+        [Input("concurrentExecutionRatePercentage")]
+        public Input<int>? ConcurrentExecutionRatePercentage { get; set; }
+
+        /// <summary>
+        /// Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+        /// </summary>
+        [Input("errorPercentage")]
+        public Input<int>? ErrorPercentage { get; set; }
+
+        public RemediationConfigurationExecutionControlsSsmControlsArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsSsmControlsGetArgs.cs b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsSsmControlsGetArgs.cs
new file mode 100644
index 00000000000..9210d134d85
--- /dev/null
+++ b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationExecutionControlsSsmControlsGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Cfg.Inputs
+{
+
+    public sealed class RemediationConfigurationExecutionControlsSsmControlsGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+        /// </summary>
+        [Input("concurrentExecutionRatePercentage")]
+        public Input<int>? ConcurrentExecutionRatePercentage { get; set; }
+
+        /// <summary>
+        /// Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+        /// </summary>
+        [Input("errorPercentage")]
+        public Input<int>? ErrorPercentage { get; set; }
+
+        public RemediationConfigurationExecutionControlsSsmControlsGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Cfg/Inputs/RemediationConfigurationParameterArgs.cs b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationParameterArgs.cs
index 688ef5eb090..e31a5258116 100644
--- a/sdk/dotnet/Cfg/Inputs/RemediationConfigurationParameterArgs.cs
+++ b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationParameterArgs.cs
@@ -13,19 +13,19 @@ namespace Pulumi.Aws.Cfg.Inputs
     public sealed class RemediationConfigurationParameterArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the attribute.
+        /// Name of the attribute.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
 
         /// <summary>
-        /// The value is dynamic and changes at run-time.
+        /// Value is dynamic and changes at run-time.
         /// </summary>
         [Input("resourceValue")]
         public Input<string>? ResourceValue { get; set; }
 
         /// <summary>
-        /// The value is static and does not change at run-time.
+        /// Value is static and does not change at run-time.
         /// </summary>
         [Input("staticValue")]
         public Input<string>? StaticValue { get; set; }
diff --git a/sdk/dotnet/Cfg/Inputs/RemediationConfigurationParameterGetArgs.cs b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationParameterGetArgs.cs
index b91d2ddb6a5..5a4b83ab13b 100644
--- a/sdk/dotnet/Cfg/Inputs/RemediationConfigurationParameterGetArgs.cs
+++ b/sdk/dotnet/Cfg/Inputs/RemediationConfigurationParameterGetArgs.cs
@@ -13,19 +13,19 @@ namespace Pulumi.Aws.Cfg.Inputs
     public sealed class RemediationConfigurationParameterGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the attribute.
+        /// Name of the attribute.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
 
         /// <summary>
-        /// The value is dynamic and changes at run-time.
+        /// Value is dynamic and changes at run-time.
         /// </summary>
         [Input("resourceValue")]
         public Input<string>? ResourceValue { get; set; }
 
         /// <summary>
-        /// The value is static and does not change at run-time.
+        /// Value is static and does not change at run-time.
         /// </summary>
         [Input("staticValue")]
         public Input<string>? StaticValue { get; set; }
diff --git a/sdk/dotnet/Cfg/Outputs/RemediationConfigurationExecutionControls.cs b/sdk/dotnet/Cfg/Outputs/RemediationConfigurationExecutionControls.cs
new file mode 100644
index 00000000000..3e7da00bd34
--- /dev/null
+++ b/sdk/dotnet/Cfg/Outputs/RemediationConfigurationExecutionControls.cs
@@ -0,0 +1,27 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Cfg.Outputs
+{
+
+    [OutputType]
+    public sealed class RemediationConfigurationExecutionControls
+    {
+        /// <summary>
+        /// Configuration block for SSM controls. See below.
+        /// </summary>
+        public readonly Outputs.RemediationConfigurationExecutionControlsSsmControls? SsmControls;
+
+        [OutputConstructor]
+        private RemediationConfigurationExecutionControls(Outputs.RemediationConfigurationExecutionControlsSsmControls? ssmControls)
+        {
+            SsmControls = ssmControls;
+        }
+    }
+}
diff --git a/sdk/dotnet/Cfg/Outputs/RemediationConfigurationExecutionControlsSsmControls.cs b/sdk/dotnet/Cfg/Outputs/RemediationConfigurationExecutionControlsSsmControls.cs
new file mode 100644
index 00000000000..f9bfd737982
--- /dev/null
+++ b/sdk/dotnet/Cfg/Outputs/RemediationConfigurationExecutionControlsSsmControls.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Cfg.Outputs
+{
+
+    [OutputType]
+    public sealed class RemediationConfigurationExecutionControlsSsmControls
+    {
+        /// <summary>
+        /// Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+        /// </summary>
+        public readonly int? ConcurrentExecutionRatePercentage;
+        /// <summary>
+        /// Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+        /// </summary>
+        public readonly int? ErrorPercentage;
+
+        [OutputConstructor]
+        private RemediationConfigurationExecutionControlsSsmControls(
+            int? concurrentExecutionRatePercentage,
+
+            int? errorPercentage)
+        {
+            ConcurrentExecutionRatePercentage = concurrentExecutionRatePercentage;
+            ErrorPercentage = errorPercentage;
+        }
+    }
+}
diff --git a/sdk/dotnet/Cfg/Outputs/RemediationConfigurationParameter.cs b/sdk/dotnet/Cfg/Outputs/RemediationConfigurationParameter.cs
index 0a7816b134e..f0650f884ac 100644
--- a/sdk/dotnet/Cfg/Outputs/RemediationConfigurationParameter.cs
+++ b/sdk/dotnet/Cfg/Outputs/RemediationConfigurationParameter.cs
@@ -14,15 +14,15 @@ namespace Pulumi.Aws.Cfg.Outputs
     public sealed class RemediationConfigurationParameter
     {
         /// <summary>
-        /// The name of the attribute.
+        /// Name of the attribute.
         /// </summary>
         public readonly string Name;
         /// <summary>
-        /// The value is dynamic and changes at run-time.
+        /// Value is dynamic and changes at run-time.
         /// </summary>
         public readonly string? ResourceValue;
         /// <summary>
-        /// The value is static and does not change at run-time.
+        /// Value is static and does not change at run-time.
         /// </summary>
         public readonly string? StaticValue;
 
diff --git a/sdk/dotnet/Cfg/RemediationConfiguration.cs b/sdk/dotnet/Cfg/RemediationConfiguration.cs
index 219dfca33d0..1e4320f3714 100644
--- a/sdk/dotnet/Cfg/RemediationConfiguration.cs
+++ b/sdk/dotnet/Cfg/RemediationConfiguration.cs
@@ -59,6 +59,17 @@ namespace Pulumi.Aws.Cfg
     ///                     StaticValue = "AES256",
     ///                 },
     ///             },
+    ///             Automatic = true,
+    ///             MaximumAutomaticAttempts = 10,
+    ///             RetryAttemptSeconds = 600,
+    ///             ExecutionControls = new Aws.Cfg.Inputs.RemediationConfigurationExecutionControlsArgs
+    ///             {
+    ///                 SsmControls = new Aws.Cfg.Inputs.RemediationConfigurationExecutionControlsSsmControlsArgs
+    ///                 {
+    ///                     ConcurrentExecutionRatePercentage = 25,
+    ///                     ErrorPercentage = 20,
+    ///                 },
+    ///             },
     ///         });
     ///     }
     /// 
@@ -77,38 +88,61 @@ namespace Pulumi.Aws.Cfg
     public partial class RemediationConfiguration : Pulumi.CustomResource
     {
         /// <summary>
-        /// Amazon Resource Name (ARN) of the Config Remediation Configuration.
+        /// ARN of the Config Remediation Configuration.
         /// </summary>
         [Output("arn")]
         public Output<string> Arn { get; private set; } = null!;
 
         /// <summary>
-        /// The name of the AWS Config rule
+        /// Remediation is triggered automatically if `true`.
+        /// </summary>
+        [Output("automatic")]
+        public Output<bool?> Automatic { get; private set; } = null!;
+
+        /// <summary>
+        /// Name of the AWS Config rule.
         /// </summary>
         [Output("configRuleName")]
         public Output<string> ConfigRuleName { get; private set; } = null!;
 
         /// <summary>
-        /// Can be specified multiple times for each
-        /// parameter. Each parameter block supports fields documented below.
+        /// Configuration block for execution controls. See below.
+        /// </summary>
+        [Output("executionControls")]
+        public Output<Outputs.RemediationConfigurationExecutionControls?> ExecutionControls { get; private set; } = null!;
+
+        /// <summary>
+        /// Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        /// </summary>
+        [Output("maximumAutomaticAttempts")]
+        public Output<int?> MaximumAutomaticAttempts { get; private set; } = null!;
+
+        /// <summary>
+        /// Can be specified multiple times for each parameter. Each parameter block supports arguments below.
         /// </summary>
         [Output("parameters")]
         public Output<ImmutableArray<Outputs.RemediationConfigurationParameter>> Parameters { get; private set; } = null!;
 
         /// <summary>
-        /// The type of a resource
+        /// Type of resource.
         /// </summary>
         [Output("resourceType")]
         public Output<string?> ResourceType { get; private set; } = null!;
 
         /// <summary>
-        /// Target ID is the name of the public document
+        /// Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        /// </summary>
+        [Output("retryAttemptSeconds")]
+        public Output<int?> RetryAttemptSeconds { get; private set; } = null!;
+
+        /// <summary>
+        /// Target ID is the name of the public document.
         /// </summary>
         [Output("targetId")]
         public Output<string> TargetId { get; private set; } = null!;
 
         /// <summary>
-        /// The type of the target. Target executes remediation. For example, SSM document
+        /// Type of the target. Target executes remediation. For example, SSM document.
         /// </summary>
         [Output("targetType")]
         public Output<string> TargetType { get; private set; } = null!;
@@ -166,17 +200,34 @@ public static RemediationConfiguration Get(string name, Input<string> id, Remedi
     public sealed class RemediationConfigurationArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the AWS Config rule
+        /// Remediation is triggered automatically if `true`.
+        /// </summary>
+        [Input("automatic")]
+        public Input<bool>? Automatic { get; set; }
+
+        /// <summary>
+        /// Name of the AWS Config rule.
         /// </summary>
         [Input("configRuleName", required: true)]
         public Input<string> ConfigRuleName { get; set; } = null!;
 
+        /// <summary>
+        /// Configuration block for execution controls. See below.
+        /// </summary>
+        [Input("executionControls")]
+        public Input<Inputs.RemediationConfigurationExecutionControlsArgs>? ExecutionControls { get; set; }
+
+        /// <summary>
+        /// Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        /// </summary>
+        [Input("maximumAutomaticAttempts")]
+        public Input<int>? MaximumAutomaticAttempts { get; set; }
+
         [Input("parameters")]
         private InputList<Inputs.RemediationConfigurationParameterArgs>? _parameters;
 
         /// <summary>
-        /// Can be specified multiple times for each
-        /// parameter. Each parameter block supports fields documented below.
+        /// Can be specified multiple times for each parameter. Each parameter block supports arguments below.
         /// </summary>
         public InputList<Inputs.RemediationConfigurationParameterArgs> Parameters
         {
@@ -185,19 +236,25 @@ public InputList<Inputs.RemediationConfigurationParameterArgs> Parameters
         }
 
         /// <summary>
-        /// The type of a resource
+        /// Type of resource.
         /// </summary>
         [Input("resourceType")]
         public Input<string>? ResourceType { get; set; }
 
         /// <summary>
-        /// Target ID is the name of the public document
+        /// Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        /// </summary>
+        [Input("retryAttemptSeconds")]
+        public Input<int>? RetryAttemptSeconds { get; set; }
+
+        /// <summary>
+        /// Target ID is the name of the public document.
         /// </summary>
         [Input("targetId", required: true)]
         public Input<string> TargetId { get; set; } = null!;
 
         /// <summary>
-        /// The type of the target. Target executes remediation. For example, SSM document
+        /// Type of the target. Target executes remediation. For example, SSM document.
         /// </summary>
         [Input("targetType", required: true)]
         public Input<string> TargetType { get; set; } = null!;
@@ -216,23 +273,40 @@ public RemediationConfigurationArgs()
     public sealed class RemediationConfigurationState : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// Amazon Resource Name (ARN) of the Config Remediation Configuration.
+        /// ARN of the Config Remediation Configuration.
         /// </summary>
         [Input("arn")]
         public Input<string>? Arn { get; set; }
 
         /// <summary>
-        /// The name of the AWS Config rule
+        /// Remediation is triggered automatically if `true`.
+        /// </summary>
+        [Input("automatic")]
+        public Input<bool>? Automatic { get; set; }
+
+        /// <summary>
+        /// Name of the AWS Config rule.
         /// </summary>
         [Input("configRuleName")]
         public Input<string>? ConfigRuleName { get; set; }
 
+        /// <summary>
+        /// Configuration block for execution controls. See below.
+        /// </summary>
+        [Input("executionControls")]
+        public Input<Inputs.RemediationConfigurationExecutionControlsGetArgs>? ExecutionControls { get; set; }
+
+        /// <summary>
+        /// Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        /// </summary>
+        [Input("maximumAutomaticAttempts")]
+        public Input<int>? MaximumAutomaticAttempts { get; set; }
+
         [Input("parameters")]
         private InputList<Inputs.RemediationConfigurationParameterGetArgs>? _parameters;
 
         /// <summary>
-        /// Can be specified multiple times for each
-        /// parameter. Each parameter block supports fields documented below.
+        /// Can be specified multiple times for each parameter. Each parameter block supports arguments below.
         /// </summary>
         public InputList<Inputs.RemediationConfigurationParameterGetArgs> Parameters
         {
@@ -241,19 +315,25 @@ public InputList<Inputs.RemediationConfigurationParameterGetArgs> Parameters
         }
 
         /// <summary>
-        /// The type of a resource
+        /// Type of resource.
         /// </summary>
         [Input("resourceType")]
         public Input<string>? ResourceType { get; set; }
 
         /// <summary>
-        /// Target ID is the name of the public document
+        /// Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        /// </summary>
+        [Input("retryAttemptSeconds")]
+        public Input<int>? RetryAttemptSeconds { get; set; }
+
+        /// <summary>
+        /// Target ID is the name of the public document.
         /// </summary>
         [Input("targetId")]
         public Input<string>? TargetId { get; set; }
 
         /// <summary>
-        /// The type of the target. Target executes remediation. For example, SSM document
+        /// Type of the target. Target executes remediation. For example, SSM document.
         /// </summary>
         [Input("targetType")]
         public Input<string>? TargetType { get; set; }
diff --git a/sdk/dotnet/CloudTrail/Inputs/TrailEventSelectorArgs.cs b/sdk/dotnet/CloudTrail/Inputs/TrailEventSelectorArgs.cs
index fba3a18b082..ae67402bbaf 100644
--- a/sdk/dotnet/CloudTrail/Inputs/TrailEventSelectorArgs.cs
+++ b/sdk/dotnet/CloudTrail/Inputs/TrailEventSelectorArgs.cs
@@ -24,8 +24,20 @@ public InputList<Inputs.TrailEventSelectorDataResourceArgs> DataResources
             set => _dataResources = value;
         }
 
+        [Input("excludeManagementEventSources")]
+        private InputList<string>? _excludeManagementEventSources;
+
+        /// <summary>
+        /// A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.
+        /// </summary>
+        public InputList<string> ExcludeManagementEventSources
+        {
+            get => _excludeManagementEventSources ?? (_excludeManagementEventSources = new InputList<string>());
+            set => _excludeManagementEventSources = value;
+        }
+
         /// <summary>
-        /// Whether to include management events for your trail.
+        /// Whether to include management events for your trail. Defaults to `true`.
         /// </summary>
         [Input("includeManagementEvents")]
         public Input<bool>? IncludeManagementEvents { get; set; }
diff --git a/sdk/dotnet/CloudTrail/Inputs/TrailEventSelectorGetArgs.cs b/sdk/dotnet/CloudTrail/Inputs/TrailEventSelectorGetArgs.cs
index 711277fa546..9457e28a0d2 100644
--- a/sdk/dotnet/CloudTrail/Inputs/TrailEventSelectorGetArgs.cs
+++ b/sdk/dotnet/CloudTrail/Inputs/TrailEventSelectorGetArgs.cs
@@ -24,8 +24,20 @@ public InputList<Inputs.TrailEventSelectorDataResourceGetArgs> DataResources
             set => _dataResources = value;
         }
 
+        [Input("excludeManagementEventSources")]
+        private InputList<string>? _excludeManagementEventSources;
+
+        /// <summary>
+        /// A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.
+        /// </summary>
+        public InputList<string> ExcludeManagementEventSources
+        {
+            get => _excludeManagementEventSources ?? (_excludeManagementEventSources = new InputList<string>());
+            set => _excludeManagementEventSources = value;
+        }
+
         /// <summary>
-        /// Whether to include management events for your trail.
+        /// Whether to include management events for your trail. Defaults to `true`.
         /// </summary>
         [Input("includeManagementEvents")]
         public Input<bool>? IncludeManagementEvents { get; set; }
diff --git a/sdk/dotnet/CloudTrail/Outputs/TrailEventSelector.cs b/sdk/dotnet/CloudTrail/Outputs/TrailEventSelector.cs
index efdc08bc97d..cb9323760dd 100644
--- a/sdk/dotnet/CloudTrail/Outputs/TrailEventSelector.cs
+++ b/sdk/dotnet/CloudTrail/Outputs/TrailEventSelector.cs
@@ -18,7 +18,11 @@ public sealed class TrailEventSelector
         /// </summary>
         public readonly ImmutableArray<Outputs.TrailEventSelectorDataResource> DataResources;
         /// <summary>
-        /// Whether to include management events for your trail.
+        /// A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.
+        /// </summary>
+        public readonly ImmutableArray<string> ExcludeManagementEventSources;
+        /// <summary>
+        /// Whether to include management events for your trail. Defaults to `true`.
         /// </summary>
         public readonly bool? IncludeManagementEvents;
         /// <summary>
@@ -30,11 +34,14 @@ public sealed class TrailEventSelector
         private TrailEventSelector(
             ImmutableArray<Outputs.TrailEventSelectorDataResource> dataResources,
 
+            ImmutableArray<string> excludeManagementEventSources,
+
             bool? includeManagementEvents,
 
             string? readWriteType)
         {
             DataResources = dataResources;
+            ExcludeManagementEventSources = excludeManagementEventSources;
             IncludeManagementEvents = includeManagementEvents;
             ReadWriteType = readWriteType;
         }
diff --git a/sdk/dotnet/Config/Config.cs b/sdk/dotnet/Config/Config.cs
index 3791a1f9dc3..7561ccf1df8 100644
--- a/sdk/dotnet/Config/Config.cs
+++ b/sdk/dotnet/Config/Config.cs
@@ -255,6 +255,7 @@ public class DefaultTags
              public class Endpoints
              {
                 public string? Accessanalyzer { get; set; } = null!;
+                public string? Account { get; set; } = null!;
                 public string? Acm { get; set; } = null!;
                 public string? Acmpca { get; set; } = null!;
                 public string? Alexaforbusiness { get; set; } = null!;
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleArgs.cs
index a6eaeaa0f7e..f761ae68a9d 100644
--- a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleArgs.cs
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.Dlm.Inputs
     public sealed class LifecyclePolicyPolicyDetailsScheduleArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+        /// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
         /// </summary>
         [Input("copyTags")]
         public Input<bool>? CopyTags { get; set; }
@@ -24,6 +24,18 @@ public sealed class LifecyclePolicyPolicyDetailsScheduleArgs : Pulumi.ResourceAr
         [Input("createRule", required: true)]
         public Input<Inputs.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs> CreateRule { get; set; } = null!;
 
+        [Input("crossRegionCopyRules")]
+        private InputList<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs>? _crossRegionCopyRules;
+
+        /// <summary>
+        /// See the `cross_region_copy_rule` block. Max of 3 per schedule.
+        /// </summary>
+        public InputList<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs> CrossRegionCopyRules
+        {
+            get => _crossRegionCopyRules ?? (_crossRegionCopyRules = new InputList<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs>());
+            set => _crossRegionCopyRules = value;
+        }
+
         /// <summary>
         /// A name for the schedule.
         /// </summary>
@@ -31,7 +43,7 @@ public sealed class LifecyclePolicyPolicyDetailsScheduleArgs : Pulumi.ResourceAr
         public Input<string> Name { get; set; } = null!;
 
         /// <summary>
-        /// See the `retain_rule` block. Max of 1 per schedule.
+        /// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
         /// </summary>
         [Input("retainRule", required: true)]
         public Input<Inputs.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs> RetainRule { get; set; } = null!;
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs.cs
index 1741a32fd2f..bb9056fc419 100644
--- a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs.cs
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs.cs
@@ -13,13 +13,13 @@ namespace Pulumi.Aws.Dlm.Inputs
     public sealed class LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
         /// </summary>
         [Input("interval", required: true)]
         public Input<int> Interval { get; set; } = null!;
 
         /// <summary>
-        /// The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
         /// </summary>
         [Input("intervalUnit")]
         public Input<string>? IntervalUnit { get; set; }
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCreateRuleGetArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCreateRuleGetArgs.cs
index d538c29eb59..2b5c920d348 100644
--- a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCreateRuleGetArgs.cs
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCreateRuleGetArgs.cs
@@ -13,13 +13,13 @@ namespace Pulumi.Aws.Dlm.Inputs
     public sealed class LifecyclePolicyPolicyDetailsScheduleCreateRuleGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
         /// </summary>
         [Input("interval", required: true)]
         public Input<int> Interval { get; set; } = null!;
 
         /// <summary>
-        /// The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
         /// </summary>
         [Input("intervalUnit")]
         public Input<string>? IntervalUnit { get; set; }
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs.cs
new file mode 100644
index 00000000000..f87cc39032d
--- /dev/null
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs.cs
@@ -0,0 +1,55 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Inputs
+{
+
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+        /// </summary>
+        [Input("cmkArn")]
+        public Input<string>? CmkArn { get; set; }
+
+        /// <summary>
+        /// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        /// </summary>
+        [Input("copyTags")]
+        public Input<bool>? CopyTags { get; set; }
+
+        /// <summary>
+        /// The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecate_rule` block.
+        /// </summary>
+        [Input("deprecateRule")]
+        public Input<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs>? DeprecateRule { get; set; }
+
+        /// <summary>
+        /// To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+        /// </summary>
+        [Input("encrypted", required: true)]
+        public Input<bool> Encrypted { get; set; } = null!;
+
+        /// <summary>
+        /// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        /// </summary>
+        [Input("retainRule")]
+        public Input<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs>? RetainRule { get; set; }
+
+        /// <summary>
+        /// The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+        /// </summary>
+        [Input("target", required: true)]
+        public Input<string> Target { get; set; } = null!;
+
+        public LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs.cs
new file mode 100644
index 00000000000..c3879c74f1f
--- /dev/null
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Inputs
+{
+
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        /// </summary>
+        [Input("interval", required: true)]
+        public Input<int> Interval { get; set; } = null!;
+
+        /// <summary>
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        /// </summary>
+        [Input("intervalUnit", required: true)]
+        public Input<string> IntervalUnit { get; set; } = null!;
+
+        public LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleGetArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleGetArgs.cs
new file mode 100644
index 00000000000..d3d1ae51367
--- /dev/null
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Inputs
+{
+
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        /// </summary>
+        [Input("interval", required: true)]
+        public Input<int> Interval { get; set; } = null!;
+
+        /// <summary>
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        /// </summary>
+        [Input("intervalUnit", required: true)]
+        public Input<string> IntervalUnit { get; set; } = null!;
+
+        public LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleGetArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleGetArgs.cs
new file mode 100644
index 00000000000..80bbb55d1b4
--- /dev/null
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleGetArgs.cs
@@ -0,0 +1,55 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Inputs
+{
+
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+        /// </summary>
+        [Input("cmkArn")]
+        public Input<string>? CmkArn { get; set; }
+
+        /// <summary>
+        /// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        /// </summary>
+        [Input("copyTags")]
+        public Input<bool>? CopyTags { get; set; }
+
+        /// <summary>
+        /// The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecate_rule` block.
+        /// </summary>
+        [Input("deprecateRule")]
+        public Input<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleGetArgs>? DeprecateRule { get; set; }
+
+        /// <summary>
+        /// To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+        /// </summary>
+        [Input("encrypted", required: true)]
+        public Input<bool> Encrypted { get; set; } = null!;
+
+        /// <summary>
+        /// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        /// </summary>
+        [Input("retainRule")]
+        public Input<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleGetArgs>? RetainRule { get; set; }
+
+        /// <summary>
+        /// The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+        /// </summary>
+        [Input("target", required: true)]
+        public Input<string> Target { get; set; } = null!;
+
+        public LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs.cs
new file mode 100644
index 00000000000..f4e2125722f
--- /dev/null
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Inputs
+{
+
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        /// </summary>
+        [Input("interval", required: true)]
+        public Input<int> Interval { get; set; } = null!;
+
+        /// <summary>
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        /// </summary>
+        [Input("intervalUnit", required: true)]
+        public Input<string> IntervalUnit { get; set; } = null!;
+
+        public LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleGetArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleGetArgs.cs
new file mode 100644
index 00000000000..5fb41171bbd
--- /dev/null
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Inputs
+{
+
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        /// </summary>
+        [Input("interval", required: true)]
+        public Input<int> Interval { get; set; } = null!;
+
+        /// <summary>
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        /// </summary>
+        [Input("intervalUnit", required: true)]
+        public Input<string> IntervalUnit { get; set; } = null!;
+
+        public LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleGetArgs.cs b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleGetArgs.cs
index 02a4e7e11fd..f9ca905f133 100644
--- a/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleGetArgs.cs
+++ b/sdk/dotnet/Dlm/Inputs/LifecyclePolicyPolicyDetailsScheduleGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.Dlm.Inputs
     public sealed class LifecyclePolicyPolicyDetailsScheduleGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+        /// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
         /// </summary>
         [Input("copyTags")]
         public Input<bool>? CopyTags { get; set; }
@@ -24,6 +24,18 @@ public sealed class LifecyclePolicyPolicyDetailsScheduleGetArgs : Pulumi.Resourc
         [Input("createRule", required: true)]
         public Input<Inputs.LifecyclePolicyPolicyDetailsScheduleCreateRuleGetArgs> CreateRule { get; set; } = null!;
 
+        [Input("crossRegionCopyRules")]
+        private InputList<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleGetArgs>? _crossRegionCopyRules;
+
+        /// <summary>
+        /// See the `cross_region_copy_rule` block. Max of 3 per schedule.
+        /// </summary>
+        public InputList<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleGetArgs> CrossRegionCopyRules
+        {
+            get => _crossRegionCopyRules ?? (_crossRegionCopyRules = new InputList<Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleGetArgs>());
+            set => _crossRegionCopyRules = value;
+        }
+
         /// <summary>
         /// A name for the schedule.
         /// </summary>
@@ -31,7 +43,7 @@ public sealed class LifecyclePolicyPolicyDetailsScheduleGetArgs : Pulumi.Resourc
         public Input<string> Name { get; set; } = null!;
 
         /// <summary>
-        /// See the `retain_rule` block. Max of 1 per schedule.
+        /// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
         /// </summary>
         [Input("retainRule", required: true)]
         public Input<Inputs.LifecyclePolicyPolicyDetailsScheduleRetainRuleGetArgs> RetainRule { get; set; } = null!;
diff --git a/sdk/dotnet/Dlm/LifecyclePolicy.cs b/sdk/dotnet/Dlm/LifecyclePolicy.cs
index d1f0394f67b..b5ccd2d7838 100644
--- a/sdk/dotnet/Dlm/LifecyclePolicy.cs
+++ b/sdk/dotnet/Dlm/LifecyclePolicy.cs
@@ -13,6 +13,7 @@ namespace Pulumi.Aws.Dlm
     /// Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
     /// 
     /// ## Example Usage
+    /// ### Basic
     /// 
     /// ```csharp
     /// using Pulumi;
@@ -114,10 +115,105 @@ namespace Pulumi.Aws.Dlm
     /// 
     /// }
     /// ```
+    /// ### Example Cross-Region Snapshot Copy Usage
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         // ...other configuration...
+    ///         var dlmCrossRegionCopyCmk = new Aws.Kms.Key("dlmCrossRegionCopyCmk", new Aws.Kms.KeyArgs
+    ///         {
+    ///             Description = "Example Alternate Region KMS Key",
+    ///             Policy = @"{
+    ///   ""Version"": ""2012-10-17"",
+    ///   ""Id"": ""dlm-cross-region-copy-cmk"",
+    ///   ""Statement"": [
+    ///     {
+    ///       ""Sid"": ""Enable IAM User Permissions"",
+    ///       ""Effect"": ""Allow"",
+    ///       ""Principal"": {
+    ///         ""AWS"": ""*""
+    ///       },
+    ///       ""Action"": ""kms:*"",
+    ///       ""Resource"": ""*""
+    ///     }
+    ///   ]
+    /// }
+    /// ",
+    ///         }, new CustomResourceOptions
+    ///         {
+    ///             Provider = aws.Alternate,
+    ///         });
+    ///         var example = new Aws.Dlm.LifecyclePolicy("example", new Aws.Dlm.LifecyclePolicyArgs
+    ///         {
+    ///             Description = "example DLM lifecycle policy",
+    ///             ExecutionRoleArn = aws_iam_role.Dlm_lifecycle_role.Arn,
+    ///             State = "ENABLED",
+    ///             PolicyDetails = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsArgs
+    ///             {
+    ///                 ResourceTypes = 
+    ///                 {
+    ///                     "VOLUME",
+    ///                 },
+    ///                 Schedules = 
+    ///                 {
+    ///                     new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleArgs
+    ///                     {
+    ///                         Name = "2 weeks of daily snapshots",
+    ///                         CreateRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs
+    ///                         {
+    ///                             Interval = 24,
+    ///                             IntervalUnit = "HOURS",
+    ///                             Times = 
+    ///                             {
+    ///                                 "23:45",
+    ///                             },
+    ///                         },
+    ///                         RetainRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs
+    ///                         {
+    ///                             Count = 14,
+    ///                         },
+    ///                         TagsToAdd = 
+    ///                         {
+    ///                             { "SnapshotCreator", "DLM" },
+    ///                         },
+    ///                         CopyTags = false,
+    ///                         CrossRegionCopyRules = 
+    ///                         {
+    ///                             new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs
+    ///                             {
+    ///                                 Target = "us-west-2",
+    ///                                 Encrypted = true,
+    ///                                 CmkArn = dlmCrossRegionCopyCmk.Arn,
+    ///                                 CopyTags = true,
+    ///                                 RetainRule = new Aws.Dlm.Inputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs
+    ///                                 {
+    ///                                     Interval = 30,
+    ///                                     IntervalUnit = "DAYS",
+    ///                                 },
+    ///                             },
+    ///                         },
+    ///                     },
+    ///                 },
+    ///                 TargetTags = 
+    ///                 {
+    ///                     { "Snapshot", "true" },
+    ///                 },
+    ///             },
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
     /// 
     /// ## Import
     /// 
-    /// DLM lifecyle policies can be imported by their policy ID
+    /// DLM lifecycle policies can be imported by their policy ID
     /// 
     /// ```sh
     ///  $ pulumi import aws:dlm/lifecyclePolicy:LifecyclePolicy example policy-abcdef12345678901
diff --git a/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsSchedule.cs b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsSchedule.cs
index cc185a2e9b4..29c9c881c93 100644
--- a/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsSchedule.cs
+++ b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsSchedule.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.Dlm.Outputs
     public sealed class LifecyclePolicyPolicyDetailsSchedule
     {
         /// <summary>
-        /// Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+        /// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
         /// </summary>
         public readonly bool? CopyTags;
         /// <summary>
@@ -22,11 +22,15 @@ public sealed class LifecyclePolicyPolicyDetailsSchedule
         /// </summary>
         public readonly Outputs.LifecyclePolicyPolicyDetailsScheduleCreateRule CreateRule;
         /// <summary>
+        /// See the `cross_region_copy_rule` block. Max of 3 per schedule.
+        /// </summary>
+        public readonly ImmutableArray<Outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule> CrossRegionCopyRules;
+        /// <summary>
         /// A name for the schedule.
         /// </summary>
         public readonly string Name;
         /// <summary>
-        /// See the `retain_rule` block. Max of 1 per schedule.
+        /// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
         /// </summary>
         public readonly Outputs.LifecyclePolicyPolicyDetailsScheduleRetainRule RetainRule;
         /// <summary>
@@ -40,6 +44,8 @@ private LifecyclePolicyPolicyDetailsSchedule(
 
             Outputs.LifecyclePolicyPolicyDetailsScheduleCreateRule createRule,
 
+            ImmutableArray<Outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule> crossRegionCopyRules,
+
             string name,
 
             Outputs.LifecyclePolicyPolicyDetailsScheduleRetainRule retainRule,
@@ -48,6 +54,7 @@ private LifecyclePolicyPolicyDetailsSchedule(
         {
             CopyTags = copyTags;
             CreateRule = createRule;
+            CrossRegionCopyRules = crossRegionCopyRules;
             Name = name;
             RetainRule = retainRule;
             TagsToAdd = tagsToAdd;
diff --git a/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCreateRule.cs b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCreateRule.cs
index f8806ff1e45..fa55412d26f 100644
--- a/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCreateRule.cs
+++ b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCreateRule.cs
@@ -14,11 +14,11 @@ namespace Pulumi.Aws.Dlm.Outputs
     public sealed class LifecyclePolicyPolicyDetailsScheduleCreateRule
     {
         /// <summary>
-        /// How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
         /// </summary>
         public readonly int Interval;
         /// <summary>
-        /// The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
         /// </summary>
         public readonly string? IntervalUnit;
         /// <summary>
diff --git a/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule.cs b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule.cs
new file mode 100644
index 00000000000..914c98b9031
--- /dev/null
+++ b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule.cs
@@ -0,0 +1,63 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Outputs
+{
+
+    [OutputType]
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule
+    {
+        /// <summary>
+        /// The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+        /// </summary>
+        public readonly string? CmkArn;
+        /// <summary>
+        /// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        /// </summary>
+        public readonly bool? CopyTags;
+        /// <summary>
+        /// The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecate_rule` block.
+        /// </summary>
+        public readonly Outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule? DeprecateRule;
+        /// <summary>
+        /// To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+        /// </summary>
+        public readonly bool Encrypted;
+        /// <summary>
+        /// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        /// </summary>
+        public readonly Outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule? RetainRule;
+        /// <summary>
+        /// The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+        /// </summary>
+        public readonly string Target;
+
+        [OutputConstructor]
+        private LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule(
+            string? cmkArn,
+
+            bool? copyTags,
+
+            Outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule? deprecateRule,
+
+            bool encrypted,
+
+            Outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule? retainRule,
+
+            string target)
+        {
+            CmkArn = cmkArn;
+            CopyTags = copyTags;
+            DeprecateRule = deprecateRule;
+            Encrypted = encrypted;
+            RetainRule = retainRule;
+            Target = target;
+        }
+    }
+}
diff --git a/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule.cs b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule.cs
new file mode 100644
index 00000000000..cf914c202b4
--- /dev/null
+++ b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Outputs
+{
+
+    [OutputType]
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule
+    {
+        /// <summary>
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        /// </summary>
+        public readonly int Interval;
+        /// <summary>
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        /// </summary>
+        public readonly string IntervalUnit;
+
+        [OutputConstructor]
+        private LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule(
+            int interval,
+
+            string intervalUnit)
+        {
+            Interval = interval;
+            IntervalUnit = intervalUnit;
+        }
+    }
+}
diff --git a/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule.cs b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule.cs
new file mode 100644
index 00000000000..fcbcbd71629
--- /dev/null
+++ b/sdk/dotnet/Dlm/Outputs/LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Dlm.Outputs
+{
+
+    [OutputType]
+    public sealed class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule
+    {
+        /// <summary>
+        /// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        /// </summary>
+        public readonly int Interval;
+        /// <summary>
+        /// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        /// </summary>
+        public readonly string IntervalUnit;
+
+        [OutputConstructor]
+        private LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule(
+            int interval,
+
+            string intervalUnit)
+        {
+            Interval = interval;
+            IntervalUnit = intervalUnit;
+        }
+    }
+}
diff --git a/sdk/dotnet/Ec2/GetInstanceTypes.cs b/sdk/dotnet/Ec2/GetInstanceTypes.cs
new file mode 100644
index 00000000000..8d948fbfa10
--- /dev/null
+++ b/sdk/dotnet/Ec2/GetInstanceTypes.cs
@@ -0,0 +1,210 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+using Pulumi.Utilities;
+
+namespace Pulumi.Aws.Ec2
+{
+    public static class GetInstanceTypes
+    {
+        /// <summary>
+        /// Information about EC2 Instance Types.
+        /// 
+        /// {{% examples %}}
+        /// ## Example Usage
+        /// {{% example %}}
+        /// 
+        /// ```csharp
+        /// using Pulumi;
+        /// using Aws = Pulumi.Aws;
+        /// 
+        /// class MyStack : Stack
+        /// {
+        ///     public MyStack()
+        ///     {
+        ///         var test = Output.Create(Aws.Ec2.GetInstanceTypes.InvokeAsync(new Aws.Ec2.GetInstanceTypesArgs
+        ///         {
+        ///             Filters = 
+        ///             {
+        ///                 new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs
+        ///                 {
+        ///                     Name = "auto-recovery-supported",
+        ///                     Values = 
+        ///                     {
+        ///                         "true",
+        ///                     },
+        ///                 },
+        ///                 new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs
+        ///                 {
+        ///                     Name = "network-info.encryption-in-transit-supported",
+        ///                     Values = 
+        ///                     {
+        ///                         "true",
+        ///                     },
+        ///                 },
+        ///                 new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs
+        ///                 {
+        ///                     Name = "instance-storage-supported",
+        ///                     Values = 
+        ///                     {
+        ///                         "true",
+        ///                     },
+        ///                 },
+        ///                 new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs
+        ///                 {
+        ///                     Name = "instance-type",
+        ///                     Values = 
+        ///                     {
+        ///                         "g5.2xlarge",
+        ///                         "g5.4xlarge",
+        ///                     },
+        ///                 },
+        ///             },
+        ///         }));
+        ///     }
+        /// 
+        /// }
+        /// ```
+        /// {{% /example %}}
+        /// {{% /examples %}}
+        /// </summary>
+        public static Task<GetInstanceTypesResult> InvokeAsync(GetInstanceTypesArgs? args = null, InvokeOptions? options = null)
+            => Pulumi.Deployment.Instance.InvokeAsync<GetInstanceTypesResult>("aws:ec2/getInstanceTypes:getInstanceTypes", args ?? new GetInstanceTypesArgs(), options.WithVersion());
+
+        /// <summary>
+        /// Information about EC2 Instance Types.
+        /// 
+        /// {{% examples %}}
+        /// ## Example Usage
+        /// {{% example %}}
+        /// 
+        /// ```csharp
+        /// using Pulumi;
+        /// using Aws = Pulumi.Aws;
+        /// 
+        /// class MyStack : Stack
+        /// {
+        ///     public MyStack()
+        ///     {
+        ///         var test = Output.Create(Aws.Ec2.GetInstanceTypes.InvokeAsync(new Aws.Ec2.GetInstanceTypesArgs
+        ///         {
+        ///             Filters = 
+        ///             {
+        ///                 new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs
+        ///                 {
+        ///                     Name = "auto-recovery-supported",
+        ///                     Values = 
+        ///                     {
+        ///                         "true",
+        ///                     },
+        ///                 },
+        ///                 new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs
+        ///                 {
+        ///                     Name = "network-info.encryption-in-transit-supported",
+        ///                     Values = 
+        ///                     {
+        ///                         "true",
+        ///                     },
+        ///                 },
+        ///                 new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs
+        ///                 {
+        ///                     Name = "instance-storage-supported",
+        ///                     Values = 
+        ///                     {
+        ///                         "true",
+        ///                     },
+        ///                 },
+        ///                 new Aws.Ec2.Inputs.GetInstanceTypesFilterArgs
+        ///                 {
+        ///                     Name = "instance-type",
+        ///                     Values = 
+        ///                     {
+        ///                         "g5.2xlarge",
+        ///                         "g5.4xlarge",
+        ///                     },
+        ///                 },
+        ///             },
+        ///         }));
+        ///     }
+        /// 
+        /// }
+        /// ```
+        /// {{% /example %}}
+        /// {{% /examples %}}
+        /// </summary>
+        public static Output<GetInstanceTypesResult> Invoke(GetInstanceTypesInvokeArgs? args = null, InvokeOptions? options = null)
+            => Pulumi.Deployment.Instance.Invoke<GetInstanceTypesResult>("aws:ec2/getInstanceTypes:getInstanceTypes", args ?? new GetInstanceTypesInvokeArgs(), options.WithVersion());
+    }
+
+
+    public sealed class GetInstanceTypesArgs : Pulumi.InvokeArgs
+    {
+        [Input("filters")]
+        private List<Inputs.GetInstanceTypesFilterArgs>? _filters;
+
+        /// <summary>
+        /// One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
+        /// </summary>
+        public List<Inputs.GetInstanceTypesFilterArgs> Filters
+        {
+            get => _filters ?? (_filters = new List<Inputs.GetInstanceTypesFilterArgs>());
+            set => _filters = value;
+        }
+
+        public GetInstanceTypesArgs()
+        {
+        }
+    }
+
+    public sealed class GetInstanceTypesInvokeArgs : Pulumi.InvokeArgs
+    {
+        [Input("filters")]
+        private InputList<Inputs.GetInstanceTypesFilterInputArgs>? _filters;
+
+        /// <summary>
+        /// One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
+        /// </summary>
+        public InputList<Inputs.GetInstanceTypesFilterInputArgs> Filters
+        {
+            get => _filters ?? (_filters = new InputList<Inputs.GetInstanceTypesFilterInputArgs>());
+            set => _filters = value;
+        }
+
+        public GetInstanceTypesInvokeArgs()
+        {
+        }
+    }
+
+
+    [OutputType]
+    public sealed class GetInstanceTypesResult
+    {
+        public readonly ImmutableArray<Outputs.GetInstanceTypesFilterResult> Filters;
+        /// <summary>
+        /// The provider-assigned unique ID for this managed resource.
+        /// </summary>
+        public readonly string Id;
+        /// <summary>
+        /// List of EC2 Instance Types.
+        /// </summary>
+        public readonly ImmutableArray<string> InstanceTypes;
+
+        [OutputConstructor]
+        private GetInstanceTypesResult(
+            ImmutableArray<Outputs.GetInstanceTypesFilterResult> filters,
+
+            string id,
+
+            ImmutableArray<string> instanceTypes)
+        {
+            Filters = filters;
+            Id = id;
+            InstanceTypes = instanceTypes;
+        }
+    }
+}
diff --git a/sdk/dotnet/Ec2/Inputs/GetInstanceTypesFilter.cs b/sdk/dotnet/Ec2/Inputs/GetInstanceTypesFilter.cs
new file mode 100644
index 00000000000..63b7d59ada5
--- /dev/null
+++ b/sdk/dotnet/Ec2/Inputs/GetInstanceTypesFilter.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Ec2.Inputs
+{
+
+    public sealed class GetInstanceTypesFilterArgs : Pulumi.InvokeArgs
+    {
+        /// <summary>
+        /// Name of the filter.
+        /// </summary>
+        [Input("name", required: true)]
+        public string Name { get; set; } = null!;
+
+        [Input("values", required: true)]
+        private List<string>? _values;
+
+        /// <summary>
+        /// List of one or more values for the filter.
+        /// </summary>
+        public List<string> Values
+        {
+            get => _values ?? (_values = new List<string>());
+            set => _values = value;
+        }
+
+        public GetInstanceTypesFilterArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Ec2/Inputs/GetInstanceTypesFilterArgs.cs b/sdk/dotnet/Ec2/Inputs/GetInstanceTypesFilterArgs.cs
new file mode 100644
index 00000000000..614c927083d
--- /dev/null
+++ b/sdk/dotnet/Ec2/Inputs/GetInstanceTypesFilterArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Ec2.Inputs
+{
+
+    public sealed class GetInstanceTypesFilterInputArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Name of the filter.
+        /// </summary>
+        [Input("name", required: true)]
+        public Input<string> Name { get; set; } = null!;
+
+        [Input("values", required: true)]
+        private InputList<string>? _values;
+
+        /// <summary>
+        /// List of one or more values for the filter.
+        /// </summary>
+        public InputList<string> Values
+        {
+            get => _values ?? (_values = new InputList<string>());
+            set => _values = value;
+        }
+
+        public GetInstanceTypesFilterInputArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Ec2/Outputs/GetInstanceTypesFilterResult.cs b/sdk/dotnet/Ec2/Outputs/GetInstanceTypesFilterResult.cs
new file mode 100644
index 00000000000..a416f4aea6e
--- /dev/null
+++ b/sdk/dotnet/Ec2/Outputs/GetInstanceTypesFilterResult.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Ec2.Outputs
+{
+
+    [OutputType]
+    public sealed class GetInstanceTypesFilterResult
+    {
+        /// <summary>
+        /// Name of the filter.
+        /// </summary>
+        public readonly string Name;
+        /// <summary>
+        /// List of one or more values for the filter.
+        /// </summary>
+        public readonly ImmutableArray<string> Values;
+
+        [OutputConstructor]
+        private GetInstanceTypesFilterResult(
+            string name,
+
+            ImmutableArray<string> values)
+        {
+            Name = name;
+            Values = values;
+        }
+    }
+}
diff --git a/sdk/dotnet/Ecs/CapacityProvider.cs b/sdk/dotnet/Ecs/CapacityProvider.cs
index 08e1145ac5a..96526e5ce79 100644
--- a/sdk/dotnet/Ecs/CapacityProvider.cs
+++ b/sdk/dotnet/Ecs/CapacityProvider.cs
@@ -32,7 +32,7 @@ namespace Pulumi.Aws.Ecs
     ///                 new Aws.AutoScaling.Inputs.GroupTagArgs
     ///                 {
     ///                     Key = "AmazonECSManaged",
-    ///                     Value = "",
+    ///                     Value = "true",
     ///                     PropagateAtLaunch = true,
     ///                 },
     ///             },
diff --git a/sdk/dotnet/Ecs/Service.cs b/sdk/dotnet/Ecs/Service.cs
index aba82e2ce41..5b801aa9d96 100644
--- a/sdk/dotnet/Ecs/Service.cs
+++ b/sdk/dotnet/Ecs/Service.cs
@@ -144,25 +144,25 @@ namespace Pulumi.Aws.Ecs
     public partial class Service : Pulumi.CustomResource
     {
         /// <summary>
-        /// Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+        /// Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
         /// </summary>
         [Output("capacityProviderStrategies")]
         public Output<ImmutableArray<Outputs.ServiceCapacityProviderStrategy>> CapacityProviderStrategies { get; private set; } = null!;
 
         /// <summary>
-        /// ARN of an ECS cluster
+        /// ARN of an ECS cluster.
         /// </summary>
         [Output("cluster")]
         public Output<string> Cluster { get; private set; } = null!;
 
         /// <summary>
-        /// Configuration block for deployment circuit breaker. Detailed below.
+        /// Configuration block for deployment circuit breaker. See below.
         /// </summary>
         [Output("deploymentCircuitBreaker")]
         public Output<Outputs.ServiceDeploymentCircuitBreaker?> DeploymentCircuitBreaker { get; private set; } = null!;
 
         /// <summary>
-        /// Configuration block for deployment controller configuration. Detailed below.
+        /// Configuration block for deployment controller configuration. See below.
         /// </summary>
         [Output("deploymentController")]
         public Output<Outputs.ServiceDeploymentController?> DeploymentController { get; private set; } = null!;
@@ -222,7 +222,7 @@ public partial class Service : Pulumi.CustomResource
         public Output<string> LaunchType { get; private set; } = null!;
 
         /// <summary>
-        /// Configuration block for load balancers. Detailed below.
+        /// Configuration block for load balancers. See below.
         /// </summary>
         [Output("loadBalancers")]
         public Output<ImmutableArray<Outputs.ServiceLoadBalancer>> LoadBalancers { get; private set; } = null!;
@@ -234,19 +234,19 @@ public partial class Service : Pulumi.CustomResource
         public Output<string> Name { get; private set; } = null!;
 
         /// <summary>
-        /// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+        /// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
         /// </summary>
         [Output("networkConfiguration")]
         public Output<Outputs.ServiceNetworkConfiguration?> NetworkConfiguration { get; private set; } = null!;
 
         /// <summary>
-        /// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
+        /// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
         /// </summary>
         [Output("orderedPlacementStrategies")]
         public Output<ImmutableArray<Outputs.ServiceOrderedPlacementStrategy>> OrderedPlacementStrategies { get; private set; } = null!;
 
         /// <summary>
-        /// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        /// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         /// </summary>
         [Output("placementConstraints")]
         public Output<ImmutableArray<Outputs.ServicePlacementConstraint>> PlacementConstraints { get; private set; } = null!;
@@ -270,13 +270,13 @@ public partial class Service : Pulumi.CustomResource
         public Output<string?> SchedulingStrategy { get; private set; } = null!;
 
         /// <summary>
-        /// Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
+        /// Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
         /// </summary>
         [Output("serviceRegistries")]
         public Output<Outputs.ServiceServiceRegistries?> ServiceRegistries { get; private set; } = null!;
 
         /// <summary>
-        /// Key-value map of resource tags.
+        /// Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         [Output("tags")]
         public Output<ImmutableDictionary<string, string>?> Tags { get; private set; } = null!;
@@ -349,7 +349,7 @@ public sealed class ServiceArgs : Pulumi.ResourceArgs
         private InputList<Inputs.ServiceCapacityProviderStrategyArgs>? _capacityProviderStrategies;
 
         /// <summary>
-        /// Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+        /// Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
         /// </summary>
         public InputList<Inputs.ServiceCapacityProviderStrategyArgs> CapacityProviderStrategies
         {
@@ -358,19 +358,19 @@ public InputList<Inputs.ServiceCapacityProviderStrategyArgs> CapacityProviderStr
         }
 
         /// <summary>
-        /// ARN of an ECS cluster
+        /// ARN of an ECS cluster.
         /// </summary>
         [Input("cluster")]
         public Input<string>? Cluster { get; set; }
 
         /// <summary>
-        /// Configuration block for deployment circuit breaker. Detailed below.
+        /// Configuration block for deployment circuit breaker. See below.
         /// </summary>
         [Input("deploymentCircuitBreaker")]
         public Input<Inputs.ServiceDeploymentCircuitBreakerArgs>? DeploymentCircuitBreaker { get; set; }
 
         /// <summary>
-        /// Configuration block for deployment controller configuration. Detailed below.
+        /// Configuration block for deployment controller configuration. See below.
         /// </summary>
         [Input("deploymentController")]
         public Input<Inputs.ServiceDeploymentControllerArgs>? DeploymentController { get; set; }
@@ -433,7 +433,7 @@ public InputList<Inputs.ServiceCapacityProviderStrategyArgs> CapacityProviderStr
         private InputList<Inputs.ServiceLoadBalancerArgs>? _loadBalancers;
 
         /// <summary>
-        /// Configuration block for load balancers. Detailed below.
+        /// Configuration block for load balancers. See below.
         /// </summary>
         public InputList<Inputs.ServiceLoadBalancerArgs> LoadBalancers
         {
@@ -448,7 +448,7 @@ public InputList<Inputs.ServiceLoadBalancerArgs> LoadBalancers
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+        /// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
         /// </summary>
         [Input("networkConfiguration")]
         public Input<Inputs.ServiceNetworkConfigurationArgs>? NetworkConfiguration { get; set; }
@@ -457,7 +457,7 @@ public InputList<Inputs.ServiceLoadBalancerArgs> LoadBalancers
         private InputList<Inputs.ServiceOrderedPlacementStrategyArgs>? _orderedPlacementStrategies;
 
         /// <summary>
-        /// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
+        /// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
         /// </summary>
         public InputList<Inputs.ServiceOrderedPlacementStrategyArgs> OrderedPlacementStrategies
         {
@@ -469,7 +469,7 @@ public InputList<Inputs.ServiceOrderedPlacementStrategyArgs> OrderedPlacementStr
         private InputList<Inputs.ServicePlacementConstraintArgs>? _placementConstraints;
 
         /// <summary>
-        /// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        /// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         /// </summary>
         public InputList<Inputs.ServicePlacementConstraintArgs> PlacementConstraints
         {
@@ -496,7 +496,7 @@ public InputList<Inputs.ServicePlacementConstraintArgs> PlacementConstraints
         public Input<string>? SchedulingStrategy { get; set; }
 
         /// <summary>
-        /// Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
+        /// Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
         /// </summary>
         [Input("serviceRegistries")]
         public Input<Inputs.ServiceServiceRegistriesArgs>? ServiceRegistries { get; set; }
@@ -505,7 +505,7 @@ public InputList<Inputs.ServicePlacementConstraintArgs> PlacementConstraints
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// Key-value map of resource tags.
+        /// Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
@@ -536,7 +536,7 @@ public sealed class ServiceState : Pulumi.ResourceArgs
         private InputList<Inputs.ServiceCapacityProviderStrategyGetArgs>? _capacityProviderStrategies;
 
         /// <summary>
-        /// Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+        /// Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
         /// </summary>
         public InputList<Inputs.ServiceCapacityProviderStrategyGetArgs> CapacityProviderStrategies
         {
@@ -545,19 +545,19 @@ public InputList<Inputs.ServiceCapacityProviderStrategyGetArgs> CapacityProvider
         }
 
         /// <summary>
-        /// ARN of an ECS cluster
+        /// ARN of an ECS cluster.
         /// </summary>
         [Input("cluster")]
         public Input<string>? Cluster { get; set; }
 
         /// <summary>
-        /// Configuration block for deployment circuit breaker. Detailed below.
+        /// Configuration block for deployment circuit breaker. See below.
         /// </summary>
         [Input("deploymentCircuitBreaker")]
         public Input<Inputs.ServiceDeploymentCircuitBreakerGetArgs>? DeploymentCircuitBreaker { get; set; }
 
         /// <summary>
-        /// Configuration block for deployment controller configuration. Detailed below.
+        /// Configuration block for deployment controller configuration. See below.
         /// </summary>
         [Input("deploymentController")]
         public Input<Inputs.ServiceDeploymentControllerGetArgs>? DeploymentController { get; set; }
@@ -620,7 +620,7 @@ public InputList<Inputs.ServiceCapacityProviderStrategyGetArgs> CapacityProvider
         private InputList<Inputs.ServiceLoadBalancerGetArgs>? _loadBalancers;
 
         /// <summary>
-        /// Configuration block for load balancers. Detailed below.
+        /// Configuration block for load balancers. See below.
         /// </summary>
         public InputList<Inputs.ServiceLoadBalancerGetArgs> LoadBalancers
         {
@@ -635,7 +635,7 @@ public InputList<Inputs.ServiceLoadBalancerGetArgs> LoadBalancers
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+        /// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
         /// </summary>
         [Input("networkConfiguration")]
         public Input<Inputs.ServiceNetworkConfigurationGetArgs>? NetworkConfiguration { get; set; }
@@ -644,7 +644,7 @@ public InputList<Inputs.ServiceLoadBalancerGetArgs> LoadBalancers
         private InputList<Inputs.ServiceOrderedPlacementStrategyGetArgs>? _orderedPlacementStrategies;
 
         /// <summary>
-        /// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
+        /// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
         /// </summary>
         public InputList<Inputs.ServiceOrderedPlacementStrategyGetArgs> OrderedPlacementStrategies
         {
@@ -656,7 +656,7 @@ public InputList<Inputs.ServiceOrderedPlacementStrategyGetArgs> OrderedPlacement
         private InputList<Inputs.ServicePlacementConstraintGetArgs>? _placementConstraints;
 
         /// <summary>
-        /// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        /// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         /// </summary>
         public InputList<Inputs.ServicePlacementConstraintGetArgs> PlacementConstraints
         {
@@ -683,7 +683,7 @@ public InputList<Inputs.ServicePlacementConstraintGetArgs> PlacementConstraints
         public Input<string>? SchedulingStrategy { get; set; }
 
         /// <summary>
-        /// Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
+        /// Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
         /// </summary>
         [Input("serviceRegistries")]
         public Input<Inputs.ServiceServiceRegistriesGetArgs>? ServiceRegistries { get; set; }
@@ -692,7 +692,7 @@ public InputList<Inputs.ServicePlacementConstraintGetArgs> PlacementConstraints
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// Key-value map of resource tags.
+        /// Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
diff --git a/sdk/dotnet/ElasticLoadBalancing/GetLoadBalancer.cs b/sdk/dotnet/ElasticLoadBalancing/GetLoadBalancer.cs
index dbfd3722339..ae827fb24f1 100644
--- a/sdk/dotnet/ElasticLoadBalancing/GetLoadBalancer.cs
+++ b/sdk/dotnet/ElasticLoadBalancing/GetLoadBalancer.cs
@@ -141,6 +141,7 @@ public sealed class GetLoadBalancerResult
         public readonly bool ConnectionDraining;
         public readonly int ConnectionDrainingTimeout;
         public readonly bool CrossZoneLoadBalancing;
+        public readonly string DesyncMitigationMode;
         public readonly string DnsName;
         public readonly Outputs.GetLoadBalancerHealthCheckResult HealthCheck;
         /// <summary>
@@ -173,6 +174,8 @@ private GetLoadBalancerResult(
 
             bool crossZoneLoadBalancing,
 
+            string desyncMitigationMode,
+
             string dnsName,
 
             Outputs.GetLoadBalancerHealthCheckResult healthCheck,
@@ -207,6 +210,7 @@ private GetLoadBalancerResult(
             ConnectionDraining = connectionDraining;
             ConnectionDrainingTimeout = connectionDrainingTimeout;
             CrossZoneLoadBalancing = crossZoneLoadBalancing;
+            DesyncMitigationMode = desyncMitigationMode;
             DnsName = dnsName;
             HealthCheck = healthCheck;
             Id = id;
diff --git a/sdk/dotnet/ElasticLoadBalancing/LoadBalancer.cs b/sdk/dotnet/ElasticLoadBalancing/LoadBalancer.cs
index 3d5981e4d0a..f369a0ca723 100644
--- a/sdk/dotnet/ElasticLoadBalancing/LoadBalancer.cs
+++ b/sdk/dotnet/ElasticLoadBalancing/LoadBalancer.cs
@@ -145,6 +145,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("crossZoneLoadBalancing")]
         public Output<bool?> CrossZoneLoadBalancing { get; private set; } = null!;
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Output("desyncMitigationMode")]
+        public Output<string?> DesyncMitigationMode { get; private set; } = null!;
+
         /// <summary>
         /// The DNS name of the ELB
         /// </summary>
@@ -320,6 +326,12 @@ public InputList<string> AvailabilityZones
         [Input("crossZoneLoadBalancing")]
         public Input<bool>? CrossZoneLoadBalancing { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// A health_check block. Health Check documented below.
         /// </summary>
@@ -465,6 +477,12 @@ public InputList<string> AvailabilityZones
         [Input("crossZoneLoadBalancing")]
         public Input<bool>? CrossZoneLoadBalancing { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// The DNS name of the ELB
         /// </summary>
diff --git a/sdk/dotnet/ElasticLoadBalancingV2/GetLoadBalancer.cs b/sdk/dotnet/ElasticLoadBalancingV2/GetLoadBalancer.cs
index 4501869123e..b1b8528f49e 100644
--- a/sdk/dotnet/ElasticLoadBalancingV2/GetLoadBalancer.cs
+++ b/sdk/dotnet/ElasticLoadBalancingV2/GetLoadBalancer.cs
@@ -163,10 +163,12 @@ public sealed class GetLoadBalancerResult
         public readonly string Arn;
         public readonly string ArnSuffix;
         public readonly string CustomerOwnedIpv4Pool;
+        public readonly string DesyncMitigationMode;
         public readonly string DnsName;
         public readonly bool DropInvalidHeaderFields;
         public readonly bool EnableDeletionProtection;
         public readonly bool EnableHttp2;
+        public readonly bool EnableWafFailOpen;
         /// <summary>
         /// The provider-assigned unique ID for this managed resource.
         /// </summary>
@@ -193,6 +195,8 @@ private GetLoadBalancerResult(
 
             string customerOwnedIpv4Pool,
 
+            string desyncMitigationMode,
+
             string dnsName,
 
             bool dropInvalidHeaderFields,
@@ -201,6 +205,8 @@ private GetLoadBalancerResult(
 
             bool enableHttp2,
 
+            bool enableWafFailOpen,
+
             string id,
 
             int idleTimeout,
@@ -229,10 +235,12 @@ private GetLoadBalancerResult(
             Arn = arn;
             ArnSuffix = arnSuffix;
             CustomerOwnedIpv4Pool = customerOwnedIpv4Pool;
+            DesyncMitigationMode = desyncMitigationMode;
             DnsName = dnsName;
             DropInvalidHeaderFields = dropInvalidHeaderFields;
             EnableDeletionProtection = enableDeletionProtection;
             EnableHttp2 = enableHttp2;
+            EnableWafFailOpen = enableWafFailOpen;
             Id = id;
             IdleTimeout = idleTimeout;
             Internal = @internal;
diff --git a/sdk/dotnet/ElasticLoadBalancingV2/LoadBalancer.cs b/sdk/dotnet/ElasticLoadBalancingV2/LoadBalancer.cs
index 1c8a01c7e71..b37ed00c729 100644
--- a/sdk/dotnet/ElasticLoadBalancingV2/LoadBalancer.cs
+++ b/sdk/dotnet/ElasticLoadBalancingV2/LoadBalancer.cs
@@ -176,6 +176,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("customerOwnedIpv4Pool")]
         public Output<string?> CustomerOwnedIpv4Pool { get; private set; } = null!;
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Output("desyncMitigationMode")]
+        public Output<string?> DesyncMitigationMode { get; private set; } = null!;
+
         /// <summary>
         /// The DNS name of the load balancer.
         /// </summary>
@@ -208,6 +214,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("enableHttp2")]
         public Output<bool?> EnableHttp2 { get; private set; } = null!;
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Output("enableWafFailOpen")]
+        public Output<bool?> EnableWafFailOpen { get; private set; } = null!;
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -267,7 +279,7 @@ public partial class LoadBalancer : Pulumi.CustomResource
         public Output<ImmutableArray<string>> Subnets { get; private set; } = null!;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         [Output("tags")]
         public Output<ImmutableDictionary<string, string>?> Tags { get; private set; } = null!;
@@ -346,6 +358,12 @@ public sealed class LoadBalancerArgs : Pulumi.ResourceArgs
         [Input("customerOwnedIpv4Pool")]
         public Input<string>? CustomerOwnedIpv4Pool { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         /// </summary>
@@ -372,6 +390,12 @@ public sealed class LoadBalancerArgs : Pulumi.ResourceArgs
         [Input("enableHttp2")]
         public Input<bool>? EnableHttp2 { get; set; }
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Input("enableWafFailOpen")]
+        public Input<bool>? EnableWafFailOpen { get; set; }
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -452,7 +476,7 @@ public InputList<string> Subnets
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
@@ -491,6 +515,12 @@ public sealed class LoadBalancerState : Pulumi.ResourceArgs
         [Input("customerOwnedIpv4Pool")]
         public Input<string>? CustomerOwnedIpv4Pool { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// The DNS name of the load balancer.
         /// </summary>
@@ -523,6 +553,12 @@ public sealed class LoadBalancerState : Pulumi.ResourceArgs
         [Input("enableHttp2")]
         public Input<bool>? EnableHttp2 { get; set; }
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Input("enableWafFailOpen")]
+        public Input<bool>? EnableWafFailOpen { get; set; }
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -603,7 +639,7 @@ public InputList<string> Subnets
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
diff --git a/sdk/dotnet/Elb/GetLoadBalancer.cs b/sdk/dotnet/Elb/GetLoadBalancer.cs
index d1120dff4d1..7074f2d36f3 100644
--- a/sdk/dotnet/Elb/GetLoadBalancer.cs
+++ b/sdk/dotnet/Elb/GetLoadBalancer.cs
@@ -140,6 +140,7 @@ public sealed class GetLoadBalancerResult
         public readonly bool ConnectionDraining;
         public readonly int ConnectionDrainingTimeout;
         public readonly bool CrossZoneLoadBalancing;
+        public readonly string DesyncMitigationMode;
         public readonly string DnsName;
         public readonly Outputs.GetLoadBalancerHealthCheckResult HealthCheck;
         /// <summary>
@@ -172,6 +173,8 @@ private GetLoadBalancerResult(
 
             bool crossZoneLoadBalancing,
 
+            string desyncMitigationMode,
+
             string dnsName,
 
             Outputs.GetLoadBalancerHealthCheckResult healthCheck,
@@ -206,6 +209,7 @@ private GetLoadBalancerResult(
             ConnectionDraining = connectionDraining;
             ConnectionDrainingTimeout = connectionDrainingTimeout;
             CrossZoneLoadBalancing = crossZoneLoadBalancing;
+            DesyncMitigationMode = desyncMitigationMode;
             DnsName = dnsName;
             HealthCheck = healthCheck;
             Id = id;
diff --git a/sdk/dotnet/Elb/LoadBalancer.cs b/sdk/dotnet/Elb/LoadBalancer.cs
index d649eb637cd..4d578291e83 100644
--- a/sdk/dotnet/Elb/LoadBalancer.cs
+++ b/sdk/dotnet/Elb/LoadBalancer.cs
@@ -144,6 +144,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("crossZoneLoadBalancing")]
         public Output<bool?> CrossZoneLoadBalancing { get; private set; } = null!;
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Output("desyncMitigationMode")]
+        public Output<string?> DesyncMitigationMode { get; private set; } = null!;
+
         /// <summary>
         /// The DNS name of the ELB
         /// </summary>
@@ -323,6 +329,12 @@ public InputList<string> AvailabilityZones
         [Input("crossZoneLoadBalancing")]
         public Input<bool>? CrossZoneLoadBalancing { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// A health_check block. Health Check documented below.
         /// </summary>
@@ -468,6 +480,12 @@ public InputList<string> AvailabilityZones
         [Input("crossZoneLoadBalancing")]
         public Input<bool>? CrossZoneLoadBalancing { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// The DNS name of the ELB
         /// </summary>
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationArgs.cs
new file mode 100644
index 00000000000..6d3b7ea8c31
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationArgs.cs
@@ -0,0 +1,28 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineActiveDirectoryConfigurationArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+        /// </summary>
+        [Input("netbiosName")]
+        public Input<string>? NetbiosName { get; set; }
+
+        [Input("selfManagedActiveDirectoryConfiguration")]
+        public Input<Inputs.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs>? SelfManagedActiveDirectoryConfiguration { get; set; }
+
+        public OntapStorageVirtualMachineActiveDirectoryConfigurationArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationGetArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationGetArgs.cs
new file mode 100644
index 00000000000..b8c2d4fd480
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationGetArgs.cs
@@ -0,0 +1,28 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineActiveDirectoryConfigurationGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+        /// </summary>
+        [Input("netbiosName")]
+        public Input<string>? NetbiosName { get; set; }
+
+        [Input("selfManagedActiveDirectoryConfiguration")]
+        public Input<Inputs.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationGetArgs>? SelfManagedActiveDirectoryConfiguration { get; set; }
+
+        public OntapStorageVirtualMachineActiveDirectoryConfigurationGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs.cs
new file mode 100644
index 00000000000..9380eab801d
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs.cs
@@ -0,0 +1,58 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs : Pulumi.ResourceArgs
+    {
+        [Input("dnsIps", required: true)]
+        private InputList<string>? _dnsIps;
+
+        /// <summary>
+        /// A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+        /// </summary>
+        public InputList<string> DnsIps
+        {
+            get => _dnsIps ?? (_dnsIps = new InputList<string>());
+            set => _dnsIps = value;
+        }
+
+        /// <summary>
+        /// The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+        /// </summary>
+        [Input("domainName", required: true)]
+        public Input<string> DomainName { get; set; } = null!;
+
+        /// <summary>
+        /// The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+        /// </summary>
+        [Input("fileSystemAdministratorsGroup")]
+        public Input<string>? FileSystemAdministratorsGroup { get; set; }
+
+        [Input("organizationalUnitDistinguidshedName")]
+        public Input<string>? OrganizationalUnitDistinguidshedName { get; set; }
+
+        /// <summary>
+        /// The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        /// </summary>
+        [Input("password", required: true)]
+        public Input<string> Password { get; set; } = null!;
+
+        /// <summary>
+        /// The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        /// </summary>
+        [Input("username", required: true)]
+        public Input<string> Username { get; set; } = null!;
+
+        public OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationGetArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationGetArgs.cs
new file mode 100644
index 00000000000..72df8ad9ada
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationGetArgs.cs
@@ -0,0 +1,58 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationGetArgs : Pulumi.ResourceArgs
+    {
+        [Input("dnsIps", required: true)]
+        private InputList<string>? _dnsIps;
+
+        /// <summary>
+        /// A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+        /// </summary>
+        public InputList<string> DnsIps
+        {
+            get => _dnsIps ?? (_dnsIps = new InputList<string>());
+            set => _dnsIps = value;
+        }
+
+        /// <summary>
+        /// The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+        /// </summary>
+        [Input("domainName", required: true)]
+        public Input<string> DomainName { get; set; } = null!;
+
+        /// <summary>
+        /// The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+        /// </summary>
+        [Input("fileSystemAdministratorsGroup")]
+        public Input<string>? FileSystemAdministratorsGroup { get; set; }
+
+        [Input("organizationalUnitDistinguidshedName")]
+        public Input<string>? OrganizationalUnitDistinguidshedName { get; set; }
+
+        /// <summary>
+        /// The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        /// </summary>
+        [Input("password", required: true)]
+        public Input<string> Password { get; set; } = null!;
+
+        /// <summary>
+        /// The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        /// </summary>
+        [Input("username", required: true)]
+        public Input<string> Username { get; set; } = null!;
+
+        public OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointArgs.cs
new file mode 100644
index 00000000000..7aed07209c2
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointArgs.cs
@@ -0,0 +1,67 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointArgs : Pulumi.ResourceArgs
+    {
+        [Input("iscses")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointIscseArgs>? _iscses;
+
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointIscseArgs> Iscses
+        {
+            get => _iscses ?? (_iscses = new InputList<Inputs.OntapStorageVirtualMachineEndpointIscseArgs>());
+            set => _iscses = value;
+        }
+
+        [Input("managements")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointManagementArgs>? _managements;
+
+        /// <summary>
+        /// An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointManagementArgs> Managements
+        {
+            get => _managements ?? (_managements = new InputList<Inputs.OntapStorageVirtualMachineEndpointManagementArgs>());
+            set => _managements = value;
+        }
+
+        [Input("nfs")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointNfArgs>? _nfs;
+
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointNfArgs> Nfs
+        {
+            get => _nfs ?? (_nfs = new InputList<Inputs.OntapStorageVirtualMachineEndpointNfArgs>());
+            set => _nfs = value;
+        }
+
+        [Input("smbs")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointSmbArgs>? _smbs;
+
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See Endpoint.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointSmbArgs> Smbs
+        {
+            get => _smbs ?? (_smbs = new InputList<Inputs.OntapStorageVirtualMachineEndpointSmbArgs>());
+            set => _smbs = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointGetArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointGetArgs.cs
new file mode 100644
index 00000000000..db91f4de543
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointGetArgs.cs
@@ -0,0 +1,67 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointGetArgs : Pulumi.ResourceArgs
+    {
+        [Input("iscses")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointIscseGetArgs>? _iscses;
+
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointIscseGetArgs> Iscses
+        {
+            get => _iscses ?? (_iscses = new InputList<Inputs.OntapStorageVirtualMachineEndpointIscseGetArgs>());
+            set => _iscses = value;
+        }
+
+        [Input("managements")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointManagementGetArgs>? _managements;
+
+        /// <summary>
+        /// An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointManagementGetArgs> Managements
+        {
+            get => _managements ?? (_managements = new InputList<Inputs.OntapStorageVirtualMachineEndpointManagementGetArgs>());
+            set => _managements = value;
+        }
+
+        [Input("nfs")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointNfGetArgs>? _nfs;
+
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointNfGetArgs> Nfs
+        {
+            get => _nfs ?? (_nfs = new InputList<Inputs.OntapStorageVirtualMachineEndpointNfGetArgs>());
+            set => _nfs = value;
+        }
+
+        [Input("smbs")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointSmbGetArgs>? _smbs;
+
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See Endpoint.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointSmbGetArgs> Smbs
+        {
+            get => _smbs ?? (_smbs = new InputList<Inputs.OntapStorageVirtualMachineEndpointSmbGetArgs>());
+            set => _smbs = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointIscseArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointIscseArgs.cs
new file mode 100644
index 00000000000..f14850299e0
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointIscseArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointIscseArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        [Input("dnsName")]
+        public Input<string>? DnsName { get; set; }
+
+        [Input("ipAddresses")]
+        private InputList<string>? _ipAddresses;
+
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public InputList<string> IpAddresses
+        {
+            get => _ipAddresses ?? (_ipAddresses = new InputList<string>());
+            set => _ipAddresses = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointIscseArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointIscseGetArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointIscseGetArgs.cs
new file mode 100644
index 00000000000..bf2fcef38df
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointIscseGetArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointIscseGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        [Input("dnsName")]
+        public Input<string>? DnsName { get; set; }
+
+        [Input("ipAddresses")]
+        private InputList<string>? _ipAddresses;
+
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public InputList<string> IpAddresses
+        {
+            get => _ipAddresses ?? (_ipAddresses = new InputList<string>());
+            set => _ipAddresses = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointIscseGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointManagementArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointManagementArgs.cs
new file mode 100644
index 00000000000..9ea2b47f15c
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointManagementArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointManagementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        [Input("dnsName")]
+        public Input<string>? DnsName { get; set; }
+
+        [Input("ipAddresses")]
+        private InputList<string>? _ipAddresses;
+
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public InputList<string> IpAddresses
+        {
+            get => _ipAddresses ?? (_ipAddresses = new InputList<string>());
+            set => _ipAddresses = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointManagementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointManagementGetArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointManagementGetArgs.cs
new file mode 100644
index 00000000000..5866f2e0a00
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointManagementGetArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointManagementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        [Input("dnsName")]
+        public Input<string>? DnsName { get; set; }
+
+        [Input("ipAddresses")]
+        private InputList<string>? _ipAddresses;
+
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public InputList<string> IpAddresses
+        {
+            get => _ipAddresses ?? (_ipAddresses = new InputList<string>());
+            set => _ipAddresses = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointManagementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointNfArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointNfArgs.cs
new file mode 100644
index 00000000000..b902872b664
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointNfArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointNfArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        [Input("dnsName")]
+        public Input<string>? DnsName { get; set; }
+
+        [Input("ipAddresses")]
+        private InputList<string>? _ipAddresses;
+
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public InputList<string> IpAddresses
+        {
+            get => _ipAddresses ?? (_ipAddresses = new InputList<string>());
+            set => _ipAddresses = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointNfArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointNfGetArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointNfGetArgs.cs
new file mode 100644
index 00000000000..4cd2be74f41
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointNfGetArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointNfGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        [Input("dnsName")]
+        public Input<string>? DnsName { get; set; }
+
+        [Input("ipAddresses")]
+        private InputList<string>? _ipAddresses;
+
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public InputList<string> IpAddresses
+        {
+            get => _ipAddresses ?? (_ipAddresses = new InputList<string>());
+            set => _ipAddresses = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointNfGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointSmbArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointSmbArgs.cs
new file mode 100644
index 00000000000..4543379d78b
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointSmbArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointSmbArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        [Input("dnsName")]
+        public Input<string>? DnsName { get; set; }
+
+        [Input("ipAddresses")]
+        private InputList<string>? _ipAddresses;
+
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public InputList<string> IpAddresses
+        {
+            get => _ipAddresses ?? (_ipAddresses = new InputList<string>());
+            set => _ipAddresses = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointSmbArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointSmbGetArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointSmbGetArgs.cs
new file mode 100644
index 00000000000..1806a317d0b
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapStorageVirtualMachineEndpointSmbGetArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapStorageVirtualMachineEndpointSmbGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        [Input("dnsName")]
+        public Input<string>? DnsName { get; set; }
+
+        [Input("ipAddresses")]
+        private InputList<string>? _ipAddresses;
+
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public InputList<string> IpAddresses
+        {
+            get => _ipAddresses ?? (_ipAddresses = new InputList<string>());
+            set => _ipAddresses = value;
+        }
+
+        public OntapStorageVirtualMachineEndpointSmbGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapVolumeTieringPolicyArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapVolumeTieringPolicyArgs.cs
new file mode 100644
index 00000000000..348bd4bc8b6
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapVolumeTieringPolicyArgs.cs
@@ -0,0 +1,28 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapVolumeTieringPolicyArgs : Pulumi.ResourceArgs
+    {
+        [Input("coolingPeriod")]
+        public Input<int>? CoolingPeriod { get; set; }
+
+        /// <summary>
+        /// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        /// </summary>
+        [Input("name")]
+        public Input<string>? Name { get; set; }
+
+        public OntapVolumeTieringPolicyArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Inputs/OntapVolumeTieringPolicyGetArgs.cs b/sdk/dotnet/Fsx/Inputs/OntapVolumeTieringPolicyGetArgs.cs
new file mode 100644
index 00000000000..0303e8f1844
--- /dev/null
+++ b/sdk/dotnet/Fsx/Inputs/OntapVolumeTieringPolicyGetArgs.cs
@@ -0,0 +1,28 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Inputs
+{
+
+    public sealed class OntapVolumeTieringPolicyGetArgs : Pulumi.ResourceArgs
+    {
+        [Input("coolingPeriod")]
+        public Input<int>? CoolingPeriod { get; set; }
+
+        /// <summary>
+        /// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        /// </summary>
+        [Input("name")]
+        public Input<string>? Name { get; set; }
+
+        public OntapVolumeTieringPolicyGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/OntapStorageVirtualMachine.cs b/sdk/dotnet/Fsx/OntapStorageVirtualMachine.cs
new file mode 100644
index 00000000000..8c88b1b4e3f
--- /dev/null
+++ b/sdk/dotnet/Fsx/OntapStorageVirtualMachine.cs
@@ -0,0 +1,348 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx
+{
+    /// <summary>
+    /// Manages a FSx Storage Virtual Machine.
+    /// See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html) for more information.
+    /// 
+    /// ## Example Usage
+    /// ### Basic Usage
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         var test = new Aws.Fsx.OntapStorageVirtualMachine("test", new Aws.Fsx.OntapStorageVirtualMachineArgs
+    ///         {
+    ///             FileSystemId = aws_fsx_ontap_file_system.Test.Id,
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
+    /// ### Using a Self-Managed Microsoft Active Directory
+    /// 
+    /// Additional information for using AWS Directory Service with ONTAP File Systems can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD.html).
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         var test = new Aws.Fsx.OntapStorageVirtualMachine("test", new Aws.Fsx.OntapStorageVirtualMachineArgs
+    ///         {
+    ///             FileSystemId = aws_fsx_ontap_file_system.Test.Id,
+    ///             ActiveDirectoryConfiguration = new Aws.Fsx.Inputs.OntapStorageVirtualMachineActiveDirectoryConfigurationArgs
+    ///             {
+    ///                 NetbiosName = "mysvm",
+    ///                 SelfManagedActiveDirectoryConfiguration = new Aws.Fsx.Inputs.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs
+    ///                 {
+    ///                     DnsIps = 
+    ///                     {
+    ///                         "10.0.0.111",
+    ///                         "10.0.0.222",
+    ///                     },
+    ///                     DomainName = "corp.example.com",
+    ///                     Password = "avoid-plaintext-passwords",
+    ///                     Username = "Admin",
+    ///                 },
+    ///             },
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
+    /// 
+    /// ## Import
+    /// 
+    /// FSx Storage Virtual Machine can be imported using the `id`, e.g.,
+    /// 
+    /// ```sh
+    ///  $ pulumi import aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine example svm-12345678abcdef123
+    /// ```
+    /// 
+    ///  Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g., terraform resource "aws_fsx_ontap_storage_virtual_machine" "example" {
+    /// 
+    /// # ... other configuration ...
+    /// 
+    ///  svm_admin_password = "avoid-plaintext-passwords"
+    /// 
+    /// # There is no FSx API for reading svm_admin_password
+    /// 
+    ///  lifecycle {
+    /// 
+    ///  ignore_changes = [svm_admin_password]
+    /// 
+    ///  } }
+    /// </summary>
+    [AwsResourceType("aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine")]
+    public partial class OntapStorageVirtualMachine : Pulumi.CustomResource
+    {
+        /// <summary>
+        /// Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        /// </summary>
+        [Output("activeDirectoryConfiguration")]
+        public Output<Outputs.OntapStorageVirtualMachineActiveDirectoryConfiguration?> ActiveDirectoryConfiguration { get; private set; } = null!;
+
+        /// <summary>
+        /// Amazon Resource Name of the storage virtual machine.
+        /// </summary>
+        [Output("arn")]
+        public Output<string> Arn { get; private set; } = null!;
+
+        /// <summary>
+        /// The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+        /// </summary>
+        [Output("endpoints")]
+        public Output<ImmutableArray<Outputs.OntapStorageVirtualMachineEndpoint>> Endpoints { get; private set; } = null!;
+
+        /// <summary>
+        /// The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        /// </summary>
+        [Output("fileSystemId")]
+        public Output<string> FileSystemId { get; private set; } = null!;
+
+        /// <summary>
+        /// The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        /// </summary>
+        [Output("name")]
+        public Output<string> Name { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        /// </summary>
+        [Output("rootVolumeSecurityStyle")]
+        public Output<string?> RootVolumeSecurityStyle { get; private set; } = null!;
+
+        /// <summary>
+        /// Describes the SVM's subtype, e.g. `DEFAULT`
+        /// </summary>
+        [Output("subtype")]
+        public Output<string> Subtype { get; private set; } = null!;
+
+        [Output("svmAdminPassword")]
+        public Output<string?> SvmAdminPassword { get; private set; } = null!;
+
+        /// <summary>
+        /// A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        /// </summary>
+        [Output("tags")]
+        public Output<ImmutableDictionary<string, string>?> Tags { get; private set; } = null!;
+
+        /// <summary>
+        /// A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        /// </summary>
+        [Output("tagsAll")]
+        public Output<ImmutableDictionary<string, string>> TagsAll { get; private set; } = null!;
+
+        /// <summary>
+        /// The SVM's UUID (universally unique identifier).
+        /// </summary>
+        [Output("uuid")]
+        public Output<string> Uuid { get; private set; } = null!;
+
+
+        /// <summary>
+        /// Create a OntapStorageVirtualMachine resource with the given unique name, arguments, and options.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resource</param>
+        /// <param name="args">The arguments used to populate this resource's properties</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public OntapStorageVirtualMachine(string name, OntapStorageVirtualMachineArgs args, CustomResourceOptions? options = null)
+            : base("aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine", name, args ?? new OntapStorageVirtualMachineArgs(), MakeResourceOptions(options, ""))
+        {
+        }
+
+        private OntapStorageVirtualMachine(string name, Input<string> id, OntapStorageVirtualMachineState? state = null, CustomResourceOptions? options = null)
+            : base("aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine", name, state, MakeResourceOptions(options, id))
+        {
+        }
+
+        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
+        {
+            var defaultOptions = new CustomResourceOptions
+            {
+                Version = Utilities.Version,
+            };
+            var merged = CustomResourceOptions.Merge(defaultOptions, options);
+            // Override the ID if one was specified for consistency with other language SDKs.
+            merged.Id = id ?? merged.Id;
+            return merged;
+        }
+        /// <summary>
+        /// Get an existing OntapStorageVirtualMachine resource's state with the given name, ID, and optional extra
+        /// properties used to qualify the lookup.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resulting resource.</param>
+        /// <param name="id">The unique provider ID of the resource to lookup.</param>
+        /// <param name="state">Any extra arguments used during the lookup.</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public static OntapStorageVirtualMachine Get(string name, Input<string> id, OntapStorageVirtualMachineState? state = null, CustomResourceOptions? options = null)
+        {
+            return new OntapStorageVirtualMachine(name, id, state, options);
+        }
+    }
+
+    public sealed class OntapStorageVirtualMachineArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        /// </summary>
+        [Input("activeDirectoryConfiguration")]
+        public Input<Inputs.OntapStorageVirtualMachineActiveDirectoryConfigurationArgs>? ActiveDirectoryConfiguration { get; set; }
+
+        /// <summary>
+        /// The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        /// </summary>
+        [Input("fileSystemId", required: true)]
+        public Input<string> FileSystemId { get; set; } = null!;
+
+        /// <summary>
+        /// The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        /// </summary>
+        [Input("name")]
+        public Input<string>? Name { get; set; }
+
+        /// <summary>
+        /// Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        /// </summary>
+        [Input("rootVolumeSecurityStyle")]
+        public Input<string>? RootVolumeSecurityStyle { get; set; }
+
+        [Input("svmAdminPassword")]
+        public Input<string>? SvmAdminPassword { get; set; }
+
+        [Input("tags")]
+        private InputMap<string>? _tags;
+
+        /// <summary>
+        /// A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        /// </summary>
+        public InputMap<string> Tags
+        {
+            get => _tags ?? (_tags = new InputMap<string>());
+            set => _tags = value;
+        }
+
+        [Input("tagsAll")]
+        private InputMap<string>? _tagsAll;
+
+        /// <summary>
+        /// A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        /// </summary>
+        public InputMap<string> TagsAll
+        {
+            get => _tagsAll ?? (_tagsAll = new InputMap<string>());
+            set => _tagsAll = value;
+        }
+
+        public OntapStorageVirtualMachineArgs()
+        {
+        }
+    }
+
+    public sealed class OntapStorageVirtualMachineState : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        /// </summary>
+        [Input("activeDirectoryConfiguration")]
+        public Input<Inputs.OntapStorageVirtualMachineActiveDirectoryConfigurationGetArgs>? ActiveDirectoryConfiguration { get; set; }
+
+        /// <summary>
+        /// Amazon Resource Name of the storage virtual machine.
+        /// </summary>
+        [Input("arn")]
+        public Input<string>? Arn { get; set; }
+
+        [Input("endpoints")]
+        private InputList<Inputs.OntapStorageVirtualMachineEndpointGetArgs>? _endpoints;
+
+        /// <summary>
+        /// The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+        /// </summary>
+        public InputList<Inputs.OntapStorageVirtualMachineEndpointGetArgs> Endpoints
+        {
+            get => _endpoints ?? (_endpoints = new InputList<Inputs.OntapStorageVirtualMachineEndpointGetArgs>());
+            set => _endpoints = value;
+        }
+
+        /// <summary>
+        /// The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        /// </summary>
+        [Input("fileSystemId")]
+        public Input<string>? FileSystemId { get; set; }
+
+        /// <summary>
+        /// The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        /// </summary>
+        [Input("name")]
+        public Input<string>? Name { get; set; }
+
+        /// <summary>
+        /// Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        /// </summary>
+        [Input("rootVolumeSecurityStyle")]
+        public Input<string>? RootVolumeSecurityStyle { get; set; }
+
+        /// <summary>
+        /// Describes the SVM's subtype, e.g. `DEFAULT`
+        /// </summary>
+        [Input("subtype")]
+        public Input<string>? Subtype { get; set; }
+
+        [Input("svmAdminPassword")]
+        public Input<string>? SvmAdminPassword { get; set; }
+
+        [Input("tags")]
+        private InputMap<string>? _tags;
+
+        /// <summary>
+        /// A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        /// </summary>
+        public InputMap<string> Tags
+        {
+            get => _tags ?? (_tags = new InputMap<string>());
+            set => _tags = value;
+        }
+
+        [Input("tagsAll")]
+        private InputMap<string>? _tagsAll;
+
+        /// <summary>
+        /// A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        /// </summary>
+        public InputMap<string> TagsAll
+        {
+            get => _tagsAll ?? (_tagsAll = new InputMap<string>());
+            set => _tagsAll = value;
+        }
+
+        /// <summary>
+        /// The SVM's UUID (universally unique identifier).
+        /// </summary>
+        [Input("uuid")]
+        public Input<string>? Uuid { get; set; }
+
+        public OntapStorageVirtualMachineState()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/OntapVolume.cs b/sdk/dotnet/Fsx/OntapVolume.cs
new file mode 100644
index 00000000000..df20e81ece2
--- /dev/null
+++ b/sdk/dotnet/Fsx/OntapVolume.cs
@@ -0,0 +1,390 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx
+{
+    /// <summary>
+    /// Manages a FSx ONTAP Volume.
+    /// See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html) for more information.
+    /// 
+    /// ## Example Usage
+    /// ### Basic Usage
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         var test = new Aws.Fsx.OntapVolume("test", new Aws.Fsx.OntapVolumeArgs
+    ///         {
+    ///             JunctionPath = "/test",
+    ///             SizeInMegabytes = 1024,
+    ///             StorageEfficiencyEnabled = true,
+    ///             StorageVirtualMachineId = aws_fsx_ontap_storage_virtual_machine.Test.Id,
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
+    /// ### Using Tiering Policy
+    /// 
+    /// Additional information on tiering policy with ONTAP Volumes can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html).
+    /// 
+    /// ```csharp
+    /// using Pulumi;
+    /// using Aws = Pulumi.Aws;
+    /// 
+    /// class MyStack : Stack
+    /// {
+    ///     public MyStack()
+    ///     {
+    ///         var test = new Aws.Fsx.OntapVolume("test", new Aws.Fsx.OntapVolumeArgs
+    ///         {
+    ///             JunctionPath = "/test",
+    ///             SizeInMegabytes = 1024,
+    ///             StorageEfficiencyEnabled = true,
+    ///             StorageVirtualMachineId = aws_fsx_ontap_storage_virtual_machine.Test.Id,
+    ///             TieringPolicy = new Aws.Fsx.Inputs.OntapVolumeTieringPolicyArgs
+    ///             {
+    ///                 Name = "AUTO",
+    ///                 CoolingPeriod = 31,
+    ///             },
+    ///         });
+    ///     }
+    /// 
+    /// }
+    /// ```
+    /// 
+    /// ## Import
+    /// 
+    /// FSx ONTAP volume can be imported using the `id`, e.g.,
+    /// 
+    /// ```sh
+    ///  $ pulumi import aws:fsx/ontapVolume:OntapVolume example fsvol-12345678abcdef123
+    /// ```
+    /// </summary>
+    [AwsResourceType("aws:fsx/ontapVolume:OntapVolume")]
+    public partial class OntapVolume : Pulumi.CustomResource
+    {
+        /// <summary>
+        /// Amazon Resource Name of the volune.
+        /// </summary>
+        [Output("arn")]
+        public Output<string> Arn { get; private set; } = null!;
+
+        /// <summary>
+        /// Describes the file system for the volume, e.g. `fs-12345679`
+        /// </summary>
+        [Output("fileSystemId")]
+        public Output<string> FileSystemId { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+        /// </summary>
+        [Output("flexcacheEndpointType")]
+        public Output<string> FlexcacheEndpointType { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        /// </summary>
+        [Output("junctionPath")]
+        public Output<string> JunctionPath { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        /// </summary>
+        [Output("name")]
+        public Output<string> Name { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+        /// </summary>
+        [Output("ontapVolumeType")]
+        public Output<string> OntapVolumeType { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        /// </summary>
+        [Output("securityStyle")]
+        public Output<string?> SecurityStyle { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies the size of the volume, in megabytes (MB), that you are creating.
+        /// </summary>
+        [Output("sizeInMegabytes")]
+        public Output<int> SizeInMegabytes { get; private set; } = null!;
+
+        /// <summary>
+        /// Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        /// </summary>
+        [Output("storageEfficiencyEnabled")]
+        public Output<bool> StorageEfficiencyEnabled { get; private set; } = null!;
+
+        /// <summary>
+        /// Specifies the storage virtual machine in which to create the volume.
+        /// </summary>
+        [Output("storageVirtualMachineId")]
+        public Output<string> StorageVirtualMachineId { get; private set; } = null!;
+
+        /// <summary>
+        /// A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        /// </summary>
+        [Output("tags")]
+        public Output<ImmutableDictionary<string, string>?> Tags { get; private set; } = null!;
+
+        /// <summary>
+        /// A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        /// </summary>
+        [Output("tagsAll")]
+        public Output<ImmutableDictionary<string, string>> TagsAll { get; private set; } = null!;
+
+        [Output("tieringPolicy")]
+        public Output<Outputs.OntapVolumeTieringPolicy?> TieringPolicy { get; private set; } = null!;
+
+        /// <summary>
+        /// The Volume's UUID (universally unique identifier).
+        /// </summary>
+        [Output("uuid")]
+        public Output<string> Uuid { get; private set; } = null!;
+
+        /// <summary>
+        /// The type of volume, currently the only valid value is `ONTAP`.
+        /// </summary>
+        [Output("volumeType")]
+        public Output<string?> VolumeType { get; private set; } = null!;
+
+
+        /// <summary>
+        /// Create a OntapVolume resource with the given unique name, arguments, and options.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resource</param>
+        /// <param name="args">The arguments used to populate this resource's properties</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public OntapVolume(string name, OntapVolumeArgs args, CustomResourceOptions? options = null)
+            : base("aws:fsx/ontapVolume:OntapVolume", name, args ?? new OntapVolumeArgs(), MakeResourceOptions(options, ""))
+        {
+        }
+
+        private OntapVolume(string name, Input<string> id, OntapVolumeState? state = null, CustomResourceOptions? options = null)
+            : base("aws:fsx/ontapVolume:OntapVolume", name, state, MakeResourceOptions(options, id))
+        {
+        }
+
+        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
+        {
+            var defaultOptions = new CustomResourceOptions
+            {
+                Version = Utilities.Version,
+            };
+            var merged = CustomResourceOptions.Merge(defaultOptions, options);
+            // Override the ID if one was specified for consistency with other language SDKs.
+            merged.Id = id ?? merged.Id;
+            return merged;
+        }
+        /// <summary>
+        /// Get an existing OntapVolume resource's state with the given name, ID, and optional extra
+        /// properties used to qualify the lookup.
+        /// </summary>
+        ///
+        /// <param name="name">The unique name of the resulting resource.</param>
+        /// <param name="id">The unique provider ID of the resource to lookup.</param>
+        /// <param name="state">Any extra arguments used during the lookup.</param>
+        /// <param name="options">A bag of options that control this resource's behavior</param>
+        public static OntapVolume Get(string name, Input<string> id, OntapVolumeState? state = null, CustomResourceOptions? options = null)
+        {
+            return new OntapVolume(name, id, state, options);
+        }
+    }
+
+    public sealed class OntapVolumeArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        /// </summary>
+        [Input("junctionPath", required: true)]
+        public Input<string> JunctionPath { get; set; } = null!;
+
+        /// <summary>
+        /// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        /// </summary>
+        [Input("name")]
+        public Input<string>? Name { get; set; }
+
+        /// <summary>
+        /// Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        /// </summary>
+        [Input("securityStyle")]
+        public Input<string>? SecurityStyle { get; set; }
+
+        /// <summary>
+        /// Specifies the size of the volume, in megabytes (MB), that you are creating.
+        /// </summary>
+        [Input("sizeInMegabytes", required: true)]
+        public Input<int> SizeInMegabytes { get; set; } = null!;
+
+        /// <summary>
+        /// Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        /// </summary>
+        [Input("storageEfficiencyEnabled", required: true)]
+        public Input<bool> StorageEfficiencyEnabled { get; set; } = null!;
+
+        /// <summary>
+        /// Specifies the storage virtual machine in which to create the volume.
+        /// </summary>
+        [Input("storageVirtualMachineId", required: true)]
+        public Input<string> StorageVirtualMachineId { get; set; } = null!;
+
+        [Input("tags")]
+        private InputMap<string>? _tags;
+
+        /// <summary>
+        /// A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        /// </summary>
+        public InputMap<string> Tags
+        {
+            get => _tags ?? (_tags = new InputMap<string>());
+            set => _tags = value;
+        }
+
+        [Input("tagsAll")]
+        private InputMap<string>? _tagsAll;
+
+        /// <summary>
+        /// A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        /// </summary>
+        public InputMap<string> TagsAll
+        {
+            get => _tagsAll ?? (_tagsAll = new InputMap<string>());
+            set => _tagsAll = value;
+        }
+
+        [Input("tieringPolicy")]
+        public Input<Inputs.OntapVolumeTieringPolicyArgs>? TieringPolicy { get; set; }
+
+        /// <summary>
+        /// The type of volume, currently the only valid value is `ONTAP`.
+        /// </summary>
+        [Input("volumeType")]
+        public Input<string>? VolumeType { get; set; }
+
+        public OntapVolumeArgs()
+        {
+        }
+    }
+
+    public sealed class OntapVolumeState : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// Amazon Resource Name of the volune.
+        /// </summary>
+        [Input("arn")]
+        public Input<string>? Arn { get; set; }
+
+        /// <summary>
+        /// Describes the file system for the volume, e.g. `fs-12345679`
+        /// </summary>
+        [Input("fileSystemId")]
+        public Input<string>? FileSystemId { get; set; }
+
+        /// <summary>
+        /// Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+        /// </summary>
+        [Input("flexcacheEndpointType")]
+        public Input<string>? FlexcacheEndpointType { get; set; }
+
+        /// <summary>
+        /// Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        /// </summary>
+        [Input("junctionPath")]
+        public Input<string>? JunctionPath { get; set; }
+
+        /// <summary>
+        /// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        /// </summary>
+        [Input("name")]
+        public Input<string>? Name { get; set; }
+
+        /// <summary>
+        /// Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+        /// </summary>
+        [Input("ontapVolumeType")]
+        public Input<string>? OntapVolumeType { get; set; }
+
+        /// <summary>
+        /// Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        /// </summary>
+        [Input("securityStyle")]
+        public Input<string>? SecurityStyle { get; set; }
+
+        /// <summary>
+        /// Specifies the size of the volume, in megabytes (MB), that you are creating.
+        /// </summary>
+        [Input("sizeInMegabytes")]
+        public Input<int>? SizeInMegabytes { get; set; }
+
+        /// <summary>
+        /// Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        /// </summary>
+        [Input("storageEfficiencyEnabled")]
+        public Input<bool>? StorageEfficiencyEnabled { get; set; }
+
+        /// <summary>
+        /// Specifies the storage virtual machine in which to create the volume.
+        /// </summary>
+        [Input("storageVirtualMachineId")]
+        public Input<string>? StorageVirtualMachineId { get; set; }
+
+        [Input("tags")]
+        private InputMap<string>? _tags;
+
+        /// <summary>
+        /// A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        /// </summary>
+        public InputMap<string> Tags
+        {
+            get => _tags ?? (_tags = new InputMap<string>());
+            set => _tags = value;
+        }
+
+        [Input("tagsAll")]
+        private InputMap<string>? _tagsAll;
+
+        /// <summary>
+        /// A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        /// </summary>
+        public InputMap<string> TagsAll
+        {
+            get => _tagsAll ?? (_tagsAll = new InputMap<string>());
+            set => _tagsAll = value;
+        }
+
+        [Input("tieringPolicy")]
+        public Input<Inputs.OntapVolumeTieringPolicyGetArgs>? TieringPolicy { get; set; }
+
+        /// <summary>
+        /// The Volume's UUID (universally unique identifier).
+        /// </summary>
+        [Input("uuid")]
+        public Input<string>? Uuid { get; set; }
+
+        /// <summary>
+        /// The type of volume, currently the only valid value is `ONTAP`.
+        /// </summary>
+        [Input("volumeType")]
+        public Input<string>? VolumeType { get; set; }
+
+        public OntapVolumeState()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineActiveDirectoryConfiguration.cs b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineActiveDirectoryConfiguration.cs
new file mode 100644
index 00000000000..3e08b8ec50a
--- /dev/null
+++ b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineActiveDirectoryConfiguration.cs
@@ -0,0 +1,32 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Outputs
+{
+
+    [OutputType]
+    public sealed class OntapStorageVirtualMachineActiveDirectoryConfiguration
+    {
+        /// <summary>
+        /// The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+        /// </summary>
+        public readonly string? NetbiosName;
+        public readonly Outputs.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration? SelfManagedActiveDirectoryConfiguration;
+
+        [OutputConstructor]
+        private OntapStorageVirtualMachineActiveDirectoryConfiguration(
+            string? netbiosName,
+
+            Outputs.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration? selfManagedActiveDirectoryConfiguration)
+        {
+            NetbiosName = netbiosName;
+            SelfManagedActiveDirectoryConfiguration = selfManagedActiveDirectoryConfiguration;
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration.cs b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration.cs
new file mode 100644
index 00000000000..588b0c9a47e
--- /dev/null
+++ b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration.cs
@@ -0,0 +1,60 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Outputs
+{
+
+    [OutputType]
+    public sealed class OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration
+    {
+        /// <summary>
+        /// A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+        /// </summary>
+        public readonly ImmutableArray<string> DnsIps;
+        /// <summary>
+        /// The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+        /// </summary>
+        public readonly string DomainName;
+        /// <summary>
+        /// The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+        /// </summary>
+        public readonly string? FileSystemAdministratorsGroup;
+        public readonly string? OrganizationalUnitDistinguidshedName;
+        /// <summary>
+        /// The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        /// </summary>
+        public readonly string Password;
+        /// <summary>
+        /// The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        /// </summary>
+        public readonly string Username;
+
+        [OutputConstructor]
+        private OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration(
+            ImmutableArray<string> dnsIps,
+
+            string domainName,
+
+            string? fileSystemAdministratorsGroup,
+
+            string? organizationalUnitDistinguidshedName,
+
+            string password,
+
+            string username)
+        {
+            DnsIps = dnsIps;
+            DomainName = domainName;
+            FileSystemAdministratorsGroup = fileSystemAdministratorsGroup;
+            OrganizationalUnitDistinguidshedName = organizationalUnitDistinguidshedName;
+            Password = password;
+            Username = username;
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpoint.cs b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpoint.cs
new file mode 100644
index 00000000000..d7990e3fae5
--- /dev/null
+++ b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpoint.cs
@@ -0,0 +1,49 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Outputs
+{
+
+    [OutputType]
+    public sealed class OntapStorageVirtualMachineEndpoint
+    {
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+        /// </summary>
+        public readonly ImmutableArray<Outputs.OntapStorageVirtualMachineEndpointIscse> Iscses;
+        /// <summary>
+        /// An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+        /// </summary>
+        public readonly ImmutableArray<Outputs.OntapStorageVirtualMachineEndpointManagement> Managements;
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+        /// </summary>
+        public readonly ImmutableArray<Outputs.OntapStorageVirtualMachineEndpointNf> Nfs;
+        /// <summary>
+        /// An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See Endpoint.
+        /// </summary>
+        public readonly ImmutableArray<Outputs.OntapStorageVirtualMachineEndpointSmb> Smbs;
+
+        [OutputConstructor]
+        private OntapStorageVirtualMachineEndpoint(
+            ImmutableArray<Outputs.OntapStorageVirtualMachineEndpointIscse> iscses,
+
+            ImmutableArray<Outputs.OntapStorageVirtualMachineEndpointManagement> managements,
+
+            ImmutableArray<Outputs.OntapStorageVirtualMachineEndpointNf> nfs,
+
+            ImmutableArray<Outputs.OntapStorageVirtualMachineEndpointSmb> smbs)
+        {
+            Iscses = iscses;
+            Managements = managements;
+            Nfs = nfs;
+            Smbs = smbs;
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointIscse.cs b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointIscse.cs
new file mode 100644
index 00000000000..1abb3046a22
--- /dev/null
+++ b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointIscse.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Outputs
+{
+
+    [OutputType]
+    public sealed class OntapStorageVirtualMachineEndpointIscse
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        public readonly string? DnsName;
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public readonly ImmutableArray<string> IpAddresses;
+
+        [OutputConstructor]
+        private OntapStorageVirtualMachineEndpointIscse(
+            string? dnsName,
+
+            ImmutableArray<string> ipAddresses)
+        {
+            DnsName = dnsName;
+            IpAddresses = ipAddresses;
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointManagement.cs b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointManagement.cs
new file mode 100644
index 00000000000..73af3da70b2
--- /dev/null
+++ b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointManagement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Outputs
+{
+
+    [OutputType]
+    public sealed class OntapStorageVirtualMachineEndpointManagement
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        public readonly string? DnsName;
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public readonly ImmutableArray<string> IpAddresses;
+
+        [OutputConstructor]
+        private OntapStorageVirtualMachineEndpointManagement(
+            string? dnsName,
+
+            ImmutableArray<string> ipAddresses)
+        {
+            DnsName = dnsName;
+            IpAddresses = ipAddresses;
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointNf.cs b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointNf.cs
new file mode 100644
index 00000000000..2fef2e37b91
--- /dev/null
+++ b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointNf.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Outputs
+{
+
+    [OutputType]
+    public sealed class OntapStorageVirtualMachineEndpointNf
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        public readonly string? DnsName;
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public readonly ImmutableArray<string> IpAddresses;
+
+        [OutputConstructor]
+        private OntapStorageVirtualMachineEndpointNf(
+            string? dnsName,
+
+            ImmutableArray<string> ipAddresses)
+        {
+            DnsName = dnsName;
+            IpAddresses = ipAddresses;
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointSmb.cs b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointSmb.cs
new file mode 100644
index 00000000000..2760b07fb52
--- /dev/null
+++ b/sdk/dotnet/Fsx/Outputs/OntapStorageVirtualMachineEndpointSmb.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Outputs
+{
+
+    [OutputType]
+    public sealed class OntapStorageVirtualMachineEndpointSmb
+    {
+        /// <summary>
+        /// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        /// </summary>
+        public readonly string? DnsName;
+        /// <summary>
+        /// IP addresses of the storage virtual machine endpoint.
+        /// </summary>
+        public readonly ImmutableArray<string> IpAddresses;
+
+        [OutputConstructor]
+        private OntapStorageVirtualMachineEndpointSmb(
+            string? dnsName,
+
+            ImmutableArray<string> ipAddresses)
+        {
+            DnsName = dnsName;
+            IpAddresses = ipAddresses;
+        }
+    }
+}
diff --git a/sdk/dotnet/Fsx/Outputs/OntapVolumeTieringPolicy.cs b/sdk/dotnet/Fsx/Outputs/OntapVolumeTieringPolicy.cs
new file mode 100644
index 00000000000..67604544bcf
--- /dev/null
+++ b/sdk/dotnet/Fsx/Outputs/OntapVolumeTieringPolicy.cs
@@ -0,0 +1,32 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.Fsx.Outputs
+{
+
+    [OutputType]
+    public sealed class OntapVolumeTieringPolicy
+    {
+        public readonly int? CoolingPeriod;
+        /// <summary>
+        /// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        /// </summary>
+        public readonly string? Name;
+
+        [OutputConstructor]
+        private OntapVolumeTieringPolicy(
+            int? coolingPeriod,
+
+            string? name)
+        {
+            CoolingPeriod = coolingPeriod;
+            Name = name;
+        }
+    }
+}
diff --git a/sdk/dotnet/ImageBuilder/GetImageRecipes.cs b/sdk/dotnet/ImageBuilder/GetImageRecipes.cs
new file mode 100644
index 00000000000..588c1735268
--- /dev/null
+++ b/sdk/dotnet/ImageBuilder/GetImageRecipes.cs
@@ -0,0 +1,185 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+using Pulumi.Utilities;
+
+namespace Pulumi.Aws.ImageBuilder
+{
+    public static class GetImageRecipes
+    {
+        /// <summary>
+        /// Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.
+        /// 
+        /// {{% examples %}}
+        /// ## Example Usage
+        /// {{% example %}}
+        /// 
+        /// ```csharp
+        /// using Pulumi;
+        /// using Aws = Pulumi.Aws;
+        /// 
+        /// class MyStack : Stack
+        /// {
+        ///     public MyStack()
+        ///     {
+        ///         var example = Output.Create(Aws.ImageBuilder.GetImageRecipes.InvokeAsync(new Aws.ImageBuilder.GetImageRecipesArgs
+        ///         {
+        ///             Filters = 
+        ///             {
+        ///                 new Aws.ImageBuilder.Inputs.GetImageRecipesFilterArgs
+        ///                 {
+        ///                     Name = "platform",
+        ///                     Values = 
+        ///                     {
+        ///                         "Linux",
+        ///                     },
+        ///                 },
+        ///             },
+        ///             Owner = "Self",
+        ///         }));
+        ///     }
+        /// 
+        /// }
+        /// ```
+        /// {{% /example %}}
+        /// {{% /examples %}}
+        /// </summary>
+        public static Task<GetImageRecipesResult> InvokeAsync(GetImageRecipesArgs? args = null, InvokeOptions? options = null)
+            => Pulumi.Deployment.Instance.InvokeAsync<GetImageRecipesResult>("aws:imagebuilder/getImageRecipes:getImageRecipes", args ?? new GetImageRecipesArgs(), options.WithVersion());
+
+        /// <summary>
+        /// Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.
+        /// 
+        /// {{% examples %}}
+        /// ## Example Usage
+        /// {{% example %}}
+        /// 
+        /// ```csharp
+        /// using Pulumi;
+        /// using Aws = Pulumi.Aws;
+        /// 
+        /// class MyStack : Stack
+        /// {
+        ///     public MyStack()
+        ///     {
+        ///         var example = Output.Create(Aws.ImageBuilder.GetImageRecipes.InvokeAsync(new Aws.ImageBuilder.GetImageRecipesArgs
+        ///         {
+        ///             Filters = 
+        ///             {
+        ///                 new Aws.ImageBuilder.Inputs.GetImageRecipesFilterArgs
+        ///                 {
+        ///                     Name = "platform",
+        ///                     Values = 
+        ///                     {
+        ///                         "Linux",
+        ///                     },
+        ///                 },
+        ///             },
+        ///             Owner = "Self",
+        ///         }));
+        ///     }
+        /// 
+        /// }
+        /// ```
+        /// {{% /example %}}
+        /// {{% /examples %}}
+        /// </summary>
+        public static Output<GetImageRecipesResult> Invoke(GetImageRecipesInvokeArgs? args = null, InvokeOptions? options = null)
+            => Pulumi.Deployment.Instance.Invoke<GetImageRecipesResult>("aws:imagebuilder/getImageRecipes:getImageRecipes", args ?? new GetImageRecipesInvokeArgs(), options.WithVersion());
+    }
+
+
+    public sealed class GetImageRecipesArgs : Pulumi.InvokeArgs
+    {
+        [Input("filters")]
+        private List<Inputs.GetImageRecipesFilterArgs>? _filters;
+
+        /// <summary>
+        /// Configuration block(s) for filtering. Detailed below.
+        /// </summary>
+        public List<Inputs.GetImageRecipesFilterArgs> Filters
+        {
+            get => _filters ?? (_filters = new List<Inputs.GetImageRecipesFilterArgs>());
+            set => _filters = value;
+        }
+
+        /// <summary>
+        /// The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+        /// </summary>
+        [Input("owner")]
+        public string? Owner { get; set; }
+
+        public GetImageRecipesArgs()
+        {
+        }
+    }
+
+    public sealed class GetImageRecipesInvokeArgs : Pulumi.InvokeArgs
+    {
+        [Input("filters")]
+        private InputList<Inputs.GetImageRecipesFilterInputArgs>? _filters;
+
+        /// <summary>
+        /// Configuration block(s) for filtering. Detailed below.
+        /// </summary>
+        public InputList<Inputs.GetImageRecipesFilterInputArgs> Filters
+        {
+            get => _filters ?? (_filters = new InputList<Inputs.GetImageRecipesFilterInputArgs>());
+            set => _filters = value;
+        }
+
+        /// <summary>
+        /// The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+        /// </summary>
+        [Input("owner")]
+        public Input<string>? Owner { get; set; }
+
+        public GetImageRecipesInvokeArgs()
+        {
+        }
+    }
+
+
+    [OutputType]
+    public sealed class GetImageRecipesResult
+    {
+        /// <summary>
+        /// Set of ARNs of the matched Image Builder Image Recipes.
+        /// </summary>
+        public readonly ImmutableArray<string> Arns;
+        public readonly ImmutableArray<Outputs.GetImageRecipesFilterResult> Filters;
+        /// <summary>
+        /// The provider-assigned unique ID for this managed resource.
+        /// </summary>
+        public readonly string Id;
+        /// <summary>
+        /// Set of names of the matched Image Builder Image Recipes.
+        /// </summary>
+        public readonly ImmutableArray<string> Names;
+        public readonly string? Owner;
+
+        [OutputConstructor]
+        private GetImageRecipesResult(
+            ImmutableArray<string> arns,
+
+            ImmutableArray<Outputs.GetImageRecipesFilterResult> filters,
+
+            string id,
+
+            ImmutableArray<string> names,
+
+            string? owner)
+        {
+            Arns = arns;
+            Filters = filters;
+            Id = id;
+            Names = names;
+            Owner = owner;
+        }
+    }
+}
diff --git a/sdk/dotnet/ImageBuilder/Inputs/GetImageRecipesFilter.cs b/sdk/dotnet/ImageBuilder/Inputs/GetImageRecipesFilter.cs
new file mode 100644
index 00000000000..2032aca6405
--- /dev/null
+++ b/sdk/dotnet/ImageBuilder/Inputs/GetImageRecipesFilter.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.ImageBuilder.Inputs
+{
+
+    public sealed class GetImageRecipesFilterArgs : Pulumi.InvokeArgs
+    {
+        /// <summary>
+        /// The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+        /// </summary>
+        [Input("name", required: true)]
+        public string Name { get; set; } = null!;
+
+        [Input("values", required: true)]
+        private List<string>? _values;
+
+        /// <summary>
+        /// Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+        /// </summary>
+        public List<string> Values
+        {
+            get => _values ?? (_values = new List<string>());
+            set => _values = value;
+        }
+
+        public GetImageRecipesFilterArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/ImageBuilder/Inputs/GetImageRecipesFilterArgs.cs b/sdk/dotnet/ImageBuilder/Inputs/GetImageRecipesFilterArgs.cs
new file mode 100644
index 00000000000..5e891a731a0
--- /dev/null
+++ b/sdk/dotnet/ImageBuilder/Inputs/GetImageRecipesFilterArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.ImageBuilder.Inputs
+{
+
+    public sealed class GetImageRecipesFilterInputArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+        /// </summary>
+        [Input("name", required: true)]
+        public Input<string> Name { get; set; } = null!;
+
+        [Input("values", required: true)]
+        private InputList<string>? _values;
+
+        /// <summary>
+        /// Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+        /// </summary>
+        public InputList<string> Values
+        {
+            get => _values ?? (_values = new InputList<string>());
+            set => _values = value;
+        }
+
+        public GetImageRecipesFilterInputArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/ImageBuilder/Outputs/GetImageRecipesFilterResult.cs b/sdk/dotnet/ImageBuilder/Outputs/GetImageRecipesFilterResult.cs
new file mode 100644
index 00000000000..7593882b4bd
--- /dev/null
+++ b/sdk/dotnet/ImageBuilder/Outputs/GetImageRecipesFilterResult.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.ImageBuilder.Outputs
+{
+
+    [OutputType]
+    public sealed class GetImageRecipesFilterResult
+    {
+        /// <summary>
+        /// The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+        /// </summary>
+        public readonly string Name;
+        /// <summary>
+        /// Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+        /// </summary>
+        public readonly ImmutableArray<string> Values;
+
+        [OutputConstructor]
+        private GetImageRecipesFilterResult(
+            string name,
+
+            ImmutableArray<string> values)
+        {
+            Name = name;
+            Values = values;
+        }
+    }
+}
diff --git a/sdk/dotnet/Inputs/ProviderEndpointArgs.cs b/sdk/dotnet/Inputs/ProviderEndpointArgs.cs
index 6d2b8ca7fae..c359f4b0160 100644
--- a/sdk/dotnet/Inputs/ProviderEndpointArgs.cs
+++ b/sdk/dotnet/Inputs/ProviderEndpointArgs.cs
@@ -15,6 +15,9 @@ public sealed class ProviderEndpointArgs : Pulumi.ResourceArgs
         [Input("accessanalyzer")]
         public Input<string>? Accessanalyzer { get; set; }
 
+        [Input("account")]
+        public Input<string>? Account { get; set; }
+
         [Input("acm")]
         public Input<string>? Acm { get; set; }
 
diff --git a/sdk/dotnet/LB/GetLoadBalancer.cs b/sdk/dotnet/LB/GetLoadBalancer.cs
index eddd0f39f5b..71bbcf290b6 100644
--- a/sdk/dotnet/LB/GetLoadBalancer.cs
+++ b/sdk/dotnet/LB/GetLoadBalancer.cs
@@ -162,10 +162,12 @@ public sealed class GetLoadBalancerResult
         public readonly string Arn;
         public readonly string ArnSuffix;
         public readonly string CustomerOwnedIpv4Pool;
+        public readonly string DesyncMitigationMode;
         public readonly string DnsName;
         public readonly bool DropInvalidHeaderFields;
         public readonly bool EnableDeletionProtection;
         public readonly bool EnableHttp2;
+        public readonly bool EnableWafFailOpen;
         /// <summary>
         /// The provider-assigned unique ID for this managed resource.
         /// </summary>
@@ -192,6 +194,8 @@ private GetLoadBalancerResult(
 
             string customerOwnedIpv4Pool,
 
+            string desyncMitigationMode,
+
             string dnsName,
 
             bool dropInvalidHeaderFields,
@@ -200,6 +204,8 @@ private GetLoadBalancerResult(
 
             bool enableHttp2,
 
+            bool enableWafFailOpen,
+
             string id,
 
             int idleTimeout,
@@ -228,10 +234,12 @@ private GetLoadBalancerResult(
             Arn = arn;
             ArnSuffix = arnSuffix;
             CustomerOwnedIpv4Pool = customerOwnedIpv4Pool;
+            DesyncMitigationMode = desyncMitigationMode;
             DnsName = dnsName;
             DropInvalidHeaderFields = dropInvalidHeaderFields;
             EnableDeletionProtection = enableDeletionProtection;
             EnableHttp2 = enableHttp2;
+            EnableWafFailOpen = enableWafFailOpen;
             Id = id;
             IdleTimeout = idleTimeout;
             Internal = @internal;
diff --git a/sdk/dotnet/LB/LoadBalancer.cs b/sdk/dotnet/LB/LoadBalancer.cs
index deb66c14643..7a224c2d5ba 100644
--- a/sdk/dotnet/LB/LoadBalancer.cs
+++ b/sdk/dotnet/LB/LoadBalancer.cs
@@ -175,6 +175,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("customerOwnedIpv4Pool")]
         public Output<string?> CustomerOwnedIpv4Pool { get; private set; } = null!;
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Output("desyncMitigationMode")]
+        public Output<string?> DesyncMitigationMode { get; private set; } = null!;
+
         /// <summary>
         /// The DNS name of the load balancer.
         /// </summary>
@@ -207,6 +213,12 @@ public partial class LoadBalancer : Pulumi.CustomResource
         [Output("enableHttp2")]
         public Output<bool?> EnableHttp2 { get; private set; } = null!;
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Output("enableWafFailOpen")]
+        public Output<bool?> EnableWafFailOpen { get; private set; } = null!;
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -266,7 +278,7 @@ public partial class LoadBalancer : Pulumi.CustomResource
         public Output<ImmutableArray<string>> Subnets { get; private set; } = null!;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         [Output("tags")]
         public Output<ImmutableDictionary<string, string>?> Tags { get; private set; } = null!;
@@ -349,6 +361,12 @@ public sealed class LoadBalancerArgs : Pulumi.ResourceArgs
         [Input("customerOwnedIpv4Pool")]
         public Input<string>? CustomerOwnedIpv4Pool { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         /// </summary>
@@ -375,6 +393,12 @@ public sealed class LoadBalancerArgs : Pulumi.ResourceArgs
         [Input("enableHttp2")]
         public Input<bool>? EnableHttp2 { get; set; }
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Input("enableWafFailOpen")]
+        public Input<bool>? EnableWafFailOpen { get; set; }
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -455,7 +479,7 @@ public InputList<string> Subnets
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
@@ -494,6 +518,12 @@ public sealed class LoadBalancerState : Pulumi.ResourceArgs
         [Input("customerOwnedIpv4Pool")]
         public Input<string>? CustomerOwnedIpv4Pool { get; set; }
 
+        /// <summary>
+        /// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        /// </summary>
+        [Input("desyncMitigationMode")]
+        public Input<string>? DesyncMitigationMode { get; set; }
+
         /// <summary>
         /// The DNS name of the load balancer.
         /// </summary>
@@ -526,6 +556,12 @@ public sealed class LoadBalancerState : Pulumi.ResourceArgs
         [Input("enableHttp2")]
         public Input<bool>? EnableHttp2 { get; set; }
 
+        /// <summary>
+        /// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        /// </summary>
+        [Input("enableWafFailOpen")]
+        public Input<bool>? EnableWafFailOpen { get; set; }
+
         /// <summary>
         /// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         /// </summary>
@@ -606,7 +642,7 @@ public InputList<string> Subnets
         private InputMap<string>? _tags;
 
         /// <summary>
-        /// A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        /// A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         /// </summary>
         public InputMap<string> Tags
         {
diff --git a/sdk/dotnet/Lambda/GetFunction.cs b/sdk/dotnet/Lambda/GetFunction.cs
index 3942ede514b..707e3c52359 100644
--- a/sdk/dotnet/Lambda/GetFunction.cs
+++ b/sdk/dotnet/Lambda/GetFunction.cs
@@ -172,6 +172,10 @@ public sealed class GetFunctionResult
         /// </summary>
         public readonly string Id;
         /// <summary>
+        /// The URI of the container image.
+        /// </summary>
+        public readonly string ImageUri;
+        /// <summary>
         /// The ARN to be used for invoking Lambda Function from API Gateway.
         /// </summary>
         public readonly string InvokeArn;
@@ -264,6 +268,8 @@ private GetFunctionResult(
 
             string id,
 
+            string imageUri,
+
             string invokeArn,
 
             string kmsKeyArn,
@@ -312,6 +318,7 @@ private GetFunctionResult(
             FunctionName = functionName;
             Handler = handler;
             Id = id;
+            ImageUri = imageUri;
             InvokeArn = invokeArn;
             KmsKeyArn = kmsKeyArn;
             LastModified = lastModified;
diff --git a/sdk/dotnet/Quicksight/User.cs b/sdk/dotnet/Quicksight/User.cs
index ac0a93d29e7..6161787fd0c 100644
--- a/sdk/dotnet/Quicksight/User.cs
+++ b/sdk/dotnet/Quicksight/User.cs
@@ -78,13 +78,13 @@ public partial class User : Pulumi.CustomResource
         public Output<string?> Namespace { get; private set; } = null!;
 
         /// <summary>
-        /// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+        /// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
         /// </summary>
         [Output("sessionName")]
         public Output<string?> SessionName { get; private set; } = null!;
 
         /// <summary>
-        /// The Amazon QuickSight user name that you want to create for the user you are registering.
+        /// The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         /// </summary>
         [Output("userName")]
         public Output<string?> UserName { get; private set; } = null!;
@@ -172,13 +172,13 @@ public sealed class UserArgs : Pulumi.ResourceArgs
         public Input<string>? Namespace { get; set; }
 
         /// <summary>
-        /// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+        /// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
         /// </summary>
         [Input("sessionName")]
         public Input<string>? SessionName { get; set; }
 
         /// <summary>
-        /// The Amazon QuickSight user name that you want to create for the user you are registering.
+        /// The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         /// </summary>
         [Input("userName")]
         public Input<string>? UserName { get; set; }
@@ -233,13 +233,13 @@ public sealed class UserState : Pulumi.ResourceArgs
         public Input<string>? Namespace { get; set; }
 
         /// <summary>
-        /// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+        /// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
         /// </summary>
         [Input("sessionName")]
         public Input<string>? SessionName { get; set; }
 
         /// <summary>
-        /// The Amazon QuickSight user name that you want to create for the user you are registering.
+        /// The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         /// </summary>
         [Input("userName")]
         public Input<string>? UserName { get; set; }
diff --git a/sdk/dotnet/Ssm/Inputs/AssociationOutputLocationArgs.cs b/sdk/dotnet/Ssm/Inputs/AssociationOutputLocationArgs.cs
index 7f387c73079..f41ef336009 100644
--- a/sdk/dotnet/Ssm/Inputs/AssociationOutputLocationArgs.cs
+++ b/sdk/dotnet/Ssm/Inputs/AssociationOutputLocationArgs.cs
@@ -24,6 +24,12 @@ public sealed class AssociationOutputLocationArgs : Pulumi.ResourceArgs
         [Input("s3KeyPrefix")]
         public Input<string>? S3KeyPrefix { get; set; }
 
+        /// <summary>
+        /// The S3 bucket region.
+        /// </summary>
+        [Input("s3Region")]
+        public Input<string>? S3Region { get; set; }
+
         public AssociationOutputLocationArgs()
         {
         }
diff --git a/sdk/dotnet/Ssm/Inputs/AssociationOutputLocationGetArgs.cs b/sdk/dotnet/Ssm/Inputs/AssociationOutputLocationGetArgs.cs
index a2498365de3..142b471db4e 100644
--- a/sdk/dotnet/Ssm/Inputs/AssociationOutputLocationGetArgs.cs
+++ b/sdk/dotnet/Ssm/Inputs/AssociationOutputLocationGetArgs.cs
@@ -24,6 +24,12 @@ public sealed class AssociationOutputLocationGetArgs : Pulumi.ResourceArgs
         [Input("s3KeyPrefix")]
         public Input<string>? S3KeyPrefix { get; set; }
 
+        /// <summary>
+        /// The S3 bucket region.
+        /// </summary>
+        [Input("s3Region")]
+        public Input<string>? S3Region { get; set; }
+
         public AssociationOutputLocationGetArgs()
         {
         }
diff --git a/sdk/dotnet/Ssm/Outputs/AssociationOutputLocation.cs b/sdk/dotnet/Ssm/Outputs/AssociationOutputLocation.cs
index 426df73ae1c..8625b461df0 100644
--- a/sdk/dotnet/Ssm/Outputs/AssociationOutputLocation.cs
+++ b/sdk/dotnet/Ssm/Outputs/AssociationOutputLocation.cs
@@ -21,15 +21,22 @@ public sealed class AssociationOutputLocation
         /// The S3 bucket prefix. Results stored in the root if not configured.
         /// </summary>
         public readonly string? S3KeyPrefix;
+        /// <summary>
+        /// The S3 bucket region.
+        /// </summary>
+        public readonly string? S3Region;
 
         [OutputConstructor]
         private AssociationOutputLocation(
             string s3BucketName,
 
-            string? s3KeyPrefix)
+            string? s3KeyPrefix,
+
+            string? s3Region)
         {
             S3BucketName = s3BucketName;
             S3KeyPrefix = s3KeyPrefix;
+            S3Region = s3Region;
         }
     }
 }
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupCustomResponseBodyArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupCustomResponseBodyArgs.cs
new file mode 100644
index 00000000000..acbbdddca1b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupCustomResponseBodyArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupCustomResponseBodyArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The payload of the custom response.
+        /// </summary>
+        [Input("content", required: true)]
+        public Input<string> Content { get; set; } = null!;
+
+        /// <summary>
+        /// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        /// </summary>
+        [Input("contentType", required: true)]
+        public Input<string> ContentType { get; set; } = null!;
+
+        /// <summary>
+        /// A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        public RuleGroupCustomResponseBodyArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupCustomResponseBodyGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupCustomResponseBodyGetArgs.cs
new file mode 100644
index 00000000000..40f62a350a9
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupCustomResponseBodyGetArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupCustomResponseBodyGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The payload of the custom response.
+        /// </summary>
+        [Input("content", required: true)]
+        public Input<string> Content { get; set; } = null!;
+
+        /// <summary>
+        /// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        /// </summary>
+        [Input("contentType", required: true)]
+        public Input<string> ContentType { get; set; } = null!;
+
+        /// <summary>
+        /// A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        public RuleGroupCustomResponseBodyGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderArgs.cs
index baa246a7353..bdeb7417214 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
index 7a21d3f97a9..353675fffdb 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseArgs.cs
index 31f49f5d11a..5951b12a185 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseArgs.cs
@@ -12,6 +12,12 @@ namespace Pulumi.Aws.WafV2.Inputs
 
     public sealed class RuleGroupRuleActionBlockCustomResponseArgs : Pulumi.ResourceArgs
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        [Input("customResponseBodyKey")]
+        public Input<string>? CustomResponseBodyKey { get; set; }
+
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseGetArgs.cs
index 2c707ba2c3a..5e45e7b7fe5 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseGetArgs.cs
@@ -12,6 +12,12 @@ namespace Pulumi.Aws.WafV2.Inputs
 
     public sealed class RuleGroupRuleActionBlockCustomResponseGetArgs : Pulumi.ResourceArgs
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        [Input("customResponseBodyKey")]
+        public Input<string>? CustomResponseBodyKey { get; set; }
+
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs.cs
index 18610c9eec0..4fa63ad0666 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseResponseHeaderGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseResponseHeaderGetArgs.cs
index 555f0c794a0..ed43c11f357 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseResponseHeaderGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionBlockCustomResponseResponseHeaderGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class RuleGroupRuleActionBlockCustomResponseResponseHeaderGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArgs.cs
index 563955b7fc0..4909f9b0679 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderGetArgs.cs
index 0c90f907af5..0dcbb45b86c 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleArgs.cs
index 3261a40f5f7..9b94613af67 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleArgs.cs
@@ -30,6 +30,18 @@ public sealed class RuleGroupRuleArgs : Pulumi.ResourceArgs
         [Input("priority", required: true)]
         public Input<int> Priority { get; set; } = null!;
 
+        [Input("ruleLabels")]
+        private InputList<Inputs.RuleGroupRuleRuleLabelArgs>? _ruleLabels;
+
+        /// <summary>
+        /// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        /// </summary>
+        public InputList<Inputs.RuleGroupRuleRuleLabelArgs> RuleLabels
+        {
+            get => _ruleLabels ?? (_ruleLabels = new InputList<Inputs.RuleGroupRuleRuleLabelArgs>());
+            set => _ruleLabels = value;
+        }
+
         /// <summary>
         /// The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleGetArgs.cs
index 82015f40bc2..19071f3dba7 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleGetArgs.cs
@@ -30,6 +30,18 @@ public sealed class RuleGroupRuleGetArgs : Pulumi.ResourceArgs
         [Input("priority", required: true)]
         public Input<int> Priority { get; set; } = null!;
 
+        [Input("ruleLabels")]
+        private InputList<Inputs.RuleGroupRuleRuleLabelGetArgs>? _ruleLabels;
+
+        /// <summary>
+        /// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        /// </summary>
+        public InputList<Inputs.RuleGroupRuleRuleLabelGetArgs> RuleLabels
+        {
+            get => _ruleLabels ?? (_ruleLabels = new InputList<Inputs.RuleGroupRuleRuleLabelGetArgs>());
+            set => _ruleLabels = value;
+        }
+
         /// <summary>
         /// The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleRuleLabelArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleRuleLabelArgs.cs
new file mode 100644
index 00000000000..62f209ac70e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleRuleLabelArgs.cs
@@ -0,0 +1,25 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleRuleLabelArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The label string.
+        /// </summary>
+        [Input("name", required: true)]
+        public Input<string> Name { get; set; } = null!;
+
+        public RuleGroupRuleRuleLabelArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleRuleLabelGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleRuleLabelGetArgs.cs
new file mode 100644
index 00000000000..b98e0440b2f
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleRuleLabelGetArgs.cs
@@ -0,0 +1,25 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleRuleLabelGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The label string.
+        /// </summary>
+        [Input("name", required: true)]
+        public Input<string> Name { get; set; } = null!;
+
+        public RuleGroupRuleRuleLabelGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementArgs.cs
index 65301bc472e..a32e8c3188a 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementAndStatementStatementAndStatementState
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementGetArgs.cs
index 085d446df77..71f856e4eb7 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementAndStatementStatementAndStatementState
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..a880069b7d4
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..eb241c43803
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementArgs.cs
index 3beb5781371..a83c48055e9 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class RuleGroupRuleStatementAndStatementStatementArgs : Pulumi.Res
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementGetArgs.cs
index b7fd092c53c..597c6957f58 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class RuleGroupRuleStatementAndStatementStatementGetArgs : Pulumi.
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..1b5aba27653
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..493f9dadda3
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementArgs.cs
index aff020ed186..c1b83d613cb 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementAndStatementStatementNotStatementState
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementGetArgs.cs
index 7e2afd14062..5c30595f7a7 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementAndStatementStatementNotStatementState
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..3ccbae3708f
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..f41773b80e0
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementArgs.cs
index 1d5af6dce22..0c53ed459f6 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementAndStatementStatementOrStatementStatem
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementGetArgs.cs
index 67b4386629d..769e9ac36e8 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementAndStatementStatementOrStatementStatem
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..1ee2ac1c235
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..2f258d65dd3
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementArgs.cs
index 6db8915316c..73c014a1939 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class RuleGroupRuleStatementArgs : Pulumi.ResourceArgs
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementGetArgs.cs
index faac6b71c8c..82629eaf6fe 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class RuleGroupRuleStatementGetArgs : Pulumi.ResourceArgs
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..0d6d2b859ba
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..80f34ba96c1
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementArgs.cs
index 02dc14d982e..d0b1bb72f01 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementNotStatementStatementAndStatementState
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementGetArgs.cs
index c09dfaf9327..0a55ca84354 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementNotStatementStatementAndStatementState
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..3cac80e583c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..72c30208fd4
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementArgs.cs
index 9bad6048fc1..dc59adcfa14 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class RuleGroupRuleStatementNotStatementStatementArgs : Pulumi.Res
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementGetArgs.cs
index 9835606de6a..959a6af3454 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class RuleGroupRuleStatementNotStatementStatementGetArgs : Pulumi.
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..9c9de5f57ae
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..8cffd36376b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementArgs.cs
index 1c49118d902..8512f223c41 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementNotStatementStatementNotStatementState
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementGetArgs.cs
index ff80c57d5e5..b4e05161cc7 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementNotStatementStatementNotStatementState
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..489fec9e9cd
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..78b02f4d2ae
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementArgs.cs
index 5c3c511f59f..f112a311a3b 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementNotStatementStatementOrStatementStatem
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementGetArgs.cs
index cfcc3f99f37..4df8c119b17 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementNotStatementStatementOrStatementStatem
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..32a8a786585
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..46a9aac11bd
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementArgs.cs
index 65015a29f10..0af54971018 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementOrStatementStatementAndStatementStatem
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementGetArgs.cs
index 908e0c4d8c2..6212737709d 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementOrStatementStatementAndStatementStatem
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..9be332cda06
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..63541051aed
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementArgs.cs
index 915f774e28a..6588b747b3f 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class RuleGroupRuleStatementOrStatementStatementArgs : Pulumi.Reso
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementGetArgs.cs
index e2f3417dbbd..9dde360875d 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class RuleGroupRuleStatementOrStatementStatementGetArgs : Pulumi.R
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..986e3b1fe14
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..5b46d65d7a6
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementArgs.cs
index 353f40e949d..77aec8bf152 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementOrStatementStatementNotStatementStatem
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementGetArgs.cs
index 9b26d698080..768a217b56c 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementOrStatementStatementNotStatementStatem
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..dd94f4fd514
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..9ec1940d649
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementArgs.cs
index 5eba644da7d..2eef8be5cda 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementOrStatementStatementOrStatementStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementGetArgs.cs
index 7fc6be672d4..7e9689ace58 100644
--- a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class RuleGroupRuleStatementOrStatementStatementOrStatementStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..d77b9db8d3e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..c7cf1327b25
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclCustomResponseBodyArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclCustomResponseBodyArgs.cs
new file mode 100644
index 00000000000..a3d17c8c9ad
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclCustomResponseBodyArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclCustomResponseBodyArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The payload of the custom response.
+        /// </summary>
+        [Input("content", required: true)]
+        public Input<string> Content { get; set; } = null!;
+
+        /// <summary>
+        /// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        /// </summary>
+        [Input("contentType", required: true)]
+        public Input<string> ContentType { get; set; } = null!;
+
+        /// <summary>
+        /// A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        public WebAclCustomResponseBodyArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclCustomResponseBodyGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclCustomResponseBodyGetArgs.cs
new file mode 100644
index 00000000000..30d32fbfd65
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclCustomResponseBodyGetArgs.cs
@@ -0,0 +1,37 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclCustomResponseBodyGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The payload of the custom response.
+        /// </summary>
+        [Input("content", required: true)]
+        public Input<string> Content { get; set; } = null!;
+
+        /// <summary>
+        /// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        /// </summary>
+        [Input("contentType", required: true)]
+        public Input<string> ContentType { get; set; } = null!;
+
+        /// <summary>
+        /// A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        public WebAclCustomResponseBodyGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderArgs.cs
index 50307def366..ebdd73696bc 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
index 24d4c10c4d8..adc53a34a91 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseArgs.cs
index b26f2ade000..c9270dae8b6 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseArgs.cs
@@ -12,6 +12,12 @@ namespace Pulumi.Aws.WafV2.Inputs
 
     public sealed class WebAclDefaultActionBlockCustomResponseArgs : Pulumi.ResourceArgs
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        [Input("customResponseBodyKey")]
+        public Input<string>? CustomResponseBodyKey { get; set; }
+
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseGetArgs.cs
index 4eddd80be80..fbb2bc3924c 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseGetArgs.cs
@@ -12,6 +12,12 @@ namespace Pulumi.Aws.WafV2.Inputs
 
     public sealed class WebAclDefaultActionBlockCustomResponseGetArgs : Pulumi.ResourceArgs
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        [Input("customResponseBodyKey")]
+        public Input<string>? CustomResponseBodyKey { get; set; }
+
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseResponseHeaderArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseResponseHeaderArgs.cs
index 7b7ac9bf257..e1a1b67f088 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseResponseHeaderArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseResponseHeaderArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclDefaultActionBlockCustomResponseResponseHeaderArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseResponseHeaderGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseResponseHeaderGetArgs.cs
index cd60dde9436..cd9ed56b72f 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseResponseHeaderGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclDefaultActionBlockCustomResponseResponseHeaderGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclDefaultActionBlockCustomResponseResponseHeaderGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeaderArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeaderArgs.cs
index 753001a47f8..ee7c03eddd6 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeaderArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeaderArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclRuleActionAllowCustomRequestHandlingInsertHeaderArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
index c373a23c7a4..29dce7e0440 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclRuleActionAllowCustomRequestHandlingInsertHeaderGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseArgs.cs
index d75c9944a93..14a4ebd1992 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseArgs.cs
@@ -12,6 +12,12 @@ namespace Pulumi.Aws.WafV2.Inputs
 
     public sealed class WebAclRuleActionBlockCustomResponseArgs : Pulumi.ResourceArgs
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        [Input("customResponseBodyKey")]
+        public Input<string>? CustomResponseBodyKey { get; set; }
+
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseGetArgs.cs
index 037e4b0a446..0d6d1830e02 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseGetArgs.cs
@@ -12,6 +12,12 @@ namespace Pulumi.Aws.WafV2.Inputs
 
     public sealed class WebAclRuleActionBlockCustomResponseGetArgs : Pulumi.ResourceArgs
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        [Input("customResponseBodyKey")]
+        public Input<string>? CustomResponseBodyKey { get; set; }
+
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseResponseHeaderArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseResponseHeaderArgs.cs
index ce895342021..d1ac4a6ad9e 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseResponseHeaderArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseResponseHeaderArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclRuleActionBlockCustomResponseResponseHeaderArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseResponseHeaderGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseResponseHeaderGetArgs.cs
index 225e3d36bea..46b9cb21437 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseResponseHeaderGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionBlockCustomResponseResponseHeaderGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclRuleActionBlockCustomResponseResponseHeaderGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionCountCustomRequestHandlingInsertHeaderArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionCountCustomRequestHandlingInsertHeaderArgs.cs
index 58fb57ca534..1db9650f26f 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionCountCustomRequestHandlingInsertHeaderArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionCountCustomRequestHandlingInsertHeaderArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclRuleActionCountCustomRequestHandlingInsertHeaderArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionCountCustomRequestHandlingInsertHeaderGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionCountCustomRequestHandlingInsertHeaderGetArgs.cs
index 5f3973c2904..336cd855c05 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleActionCountCustomRequestHandlingInsertHeaderGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleActionCountCustomRequestHandlingInsertHeaderGetArgs.cs
@@ -13,7 +13,7 @@ namespace Pulumi.Aws.WafV2.Inputs
     public sealed class WebAclRuleActionCountCustomRequestHandlingInsertHeaderGetArgs : Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name", required: true)]
         public Input<string> Name { get; set; } = null!;
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleArgs.cs
index a34ccddd552..841b5a35a66 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleArgs.cs
@@ -36,6 +36,18 @@ public sealed class WebAclRuleArgs : Pulumi.ResourceArgs
         [Input("priority", required: true)]
         public Input<int> Priority { get; set; } = null!;
 
+        [Input("ruleLabels")]
+        private InputList<Inputs.WebAclRuleRuleLabelArgs>? _ruleLabels;
+
+        /// <summary>
+        /// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        /// </summary>
+        public InputList<Inputs.WebAclRuleRuleLabelArgs> RuleLabels
+        {
+            get => _ruleLabels ?? (_ruleLabels = new InputList<Inputs.WebAclRuleRuleLabelArgs>());
+            set => _ruleLabels = value;
+        }
+
         /// <summary>
         /// The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleGetArgs.cs
index 1ab07ff0457..87681bf4eca 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleGetArgs.cs
@@ -36,6 +36,18 @@ public sealed class WebAclRuleGetArgs : Pulumi.ResourceArgs
         [Input("priority", required: true)]
         public Input<int> Priority { get; set; } = null!;
 
+        [Input("ruleLabels")]
+        private InputList<Inputs.WebAclRuleRuleLabelGetArgs>? _ruleLabels;
+
+        /// <summary>
+        /// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        /// </summary>
+        public InputList<Inputs.WebAclRuleRuleLabelGetArgs> RuleLabels
+        {
+            get => _ruleLabels ?? (_ruleLabels = new InputList<Inputs.WebAclRuleRuleLabelGetArgs>());
+            set => _ruleLabels = value;
+        }
+
         /// <summary>
         /// The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleRuleLabelArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleRuleLabelArgs.cs
new file mode 100644
index 00000000000..0590451a243
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleRuleLabelArgs.cs
@@ -0,0 +1,25 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleRuleLabelArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The label string.
+        /// </summary>
+        [Input("name", required: true)]
+        public Input<string> Name { get; set; } = null!;
+
+        public WebAclRuleRuleLabelArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleRuleLabelGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleRuleLabelGetArgs.cs
new file mode 100644
index 00000000000..1229ddaeda6
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleRuleLabelGetArgs.cs
@@ -0,0 +1,25 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleRuleLabelGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The label string.
+        /// </summary>
+        [Input("name", required: true)]
+        public Input<string> Name { get; set; } = null!;
+
+        public WebAclRuleRuleLabelGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementArgs.cs
index c91a444c9eb..9fb7928d59a 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
index 5545326de51..fd7f214a81b 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..1abb3a625c1
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..255f1cda277
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementArgs.cs
index d5e24f2e524..b64c02962b7 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementGetArgs.cs
index 2ed46a8b9b0..ff14900dac7 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..c3172e93432
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..810975e6b28
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementArgs.cs
index 232fb95e80f..25aaf0bb6b4 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
index 1784ecda672..5046a7483c4 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..2e59f8d42a1
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..417f8fe5dbf
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementArgs.cs
index d285f584544..85002dce420 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
index 74b4f2b9f18..d4d2adcc3ba 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..1b131f857e7
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..111c64df8de
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementArgs.cs
index 8ae9b95fd49..bf059b85281 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementAndStatementStatementArgs : Pulumi.Resour
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementGetArgs.cs
index 29acc2d44bd..9c731f0db7f 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementAndStatementStatementGetArgs : Pulumi.Res
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..df06c54f872
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..1e983daf20b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementArgs.cs
index 5d9f0c68cec..ebdcbea4671 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
index c52738e3f70..726949da99c 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..fd3e64f5516
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..051b571ecaa
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementArgs.cs
index e5efe7a2b33..abf2473322e 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementGetArgs.cs
index 25dff2d8184..0a15ec0ecdc 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..a813c330570
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..7a6a4a3965c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementArgs.cs
index 0bba8a49aee..2e6ffbe6667 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
index 4c0c2adc127..7c515cacad6 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..f204a71e991
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..1361d310b13
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementArgs.cs
index 5ed55c401ef..f7c74371b4f 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
index c5eed27c0cf..f657bd8a363 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..31c54fa89c8
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..fa5844f0b59
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementArgs.cs
index 6f10496fd64..05f5d0e20a7 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
index 3ad503b5a66..07ef4ac2705 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..4e29ce4225c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..8937db6b129
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementArgs.cs
index b0897a0c2c1..a75189b8af3 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementGetArgs.cs
index 6aee264e0d2..14003e13e41 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..b81437ef63b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..f10c6b05ce7
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementArgs.cs
index ea72bdf5c40..50b3f7e4b13 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
index 6ed547fcc63..31bb5297668 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..dfc94c19312
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..0be01298985
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementArgs.cs
index acd9cc74803..5aeb182b9f5 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
index 9fb2a66cad8..f6444a4ae52 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..c6366926d67
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..6352c5e9fde
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementArgs.cs
index 05ac5ee456a..16f4f36c57c 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementArgs : Pulumi.ResourceArgs
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementGetArgs.cs
index a9ae6eca688..94ff61b8363 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementGetArgs : Pulumi.ResourceArgs
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..85bb8939ba2
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..45142bfa586
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementArgs.cs
index 421ef8c9c44..67301e43e70 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGetArgs.cs
index 2c43f08ef4c..3dd6e7253ef 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..9125df23ef0
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..a7723521983
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementArgs.cs
index c08d7fcfd2b..0b5eaab3229 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGetArgs.cs
index 0d7fdaf6add..cdc0861c146 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..5ccc9f27bcb
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..d7317d6fc77
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs.cs
index 6a63a5506cb..aee2c8c5747 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGetArgs.cs
index 099f849a6c6..bf2cb44fa70 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..3a9cb490695
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..ee3bde77385
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementArgs.cs
index 354345f7029..14ed3875d00 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGetArgs.cs
index c9c898dbfad..1deb0e4b05a 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..873530626ae
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..b935de37e9e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs.cs
index eb3abcd7253..6c512ad4a85 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGetArgs.cs
index cd7647c8e76..a2b1c4a9db8 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..7ae03d994f4
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..6b25fcc025b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementArgs.cs
index 93117aba32b..0227183b216 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGetArgs.cs
index 0cdbd414490..5c261388501 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..bb86a719f0f
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..7ae1f27c579
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementArgs.cs
index 687bf2faf41..9cc48343465 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGetArgs.cs
index eb95fdccd8d..b55960cbd0b 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..35d8f6bad17
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..0a044c27416
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs.cs
index bebe5df9dea..579156d9b8f 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGetArgs.cs
index bf8025f7465..7ddc2cd65a0 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..8fcf861bea2
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..9c867a9994a
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementArgs.cs
index 617c7b3aec6..f930ab572df 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGetArgs.cs
index 357cf17c371..4a49c5b8a22 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..9764805c172
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..227d3cbfe65
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementArgs.cs
index b15507146e7..0be3b869337 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGetArgs.cs
index 3180205244e..db5c1b68426 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..bfb0da1d84c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..00d2eaf0682
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementArgs.cs
index 51f202c14fd..5a1eae07806 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGetArgs.cs
index 97d0b5e4b41..a5043cc7c4a 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..d662c942248
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..8c130a2f817
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs.cs
index 6ebb41c94ee..9ba560333a5 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGetArgs.cs
index e021c1f40ec..3f7f67f6dcb 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..a6eca6de799
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..46a46a4d9b7
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementArgs.cs
index 3ac2facc0ab..f64c9680ea2 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGetArgs.cs
index 0e54ee7238c..f2c067f4b8f 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..f876dd99c1d
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..9f550d94a7e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementArgs.cs
index 0a154c4cc7f..f47e9434b0d 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
index 61f103ad7c2..bb513a2bbaf 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..a42de372cac
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..41363cc7047
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementArgs.cs
index 697408571fb..9da3efc5ebc 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementGetArgs.cs
index f4de0dd08c3..7dd15c43ace 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..92a08885dbc
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..d3ad9f04eb2
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementArgs.cs
index 110566ba6fd..30cf182e293 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
index 4a458aa2000..9071e9d49ae 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..89526789289
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..be34ad645cc
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementArgs.cs
index b1905d9d725..90119ff6c86 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
index 7b4f79feb8b..1f150a63d25 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..c014d4a3ada
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..7b2b8d73505
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementArgs.cs
index 922deb44f61..5733279b9dc 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementNotStatementStatementArgs : Pulumi.Resour
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementGetArgs.cs
index 812bfd0d4ca..7323bb215c0 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementNotStatementStatementGetArgs : Pulumi.Res
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..ae56c1dbf90
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..37844ac8d54
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementArgs.cs
index be8fa8b161a..e603bfe58e0 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
index f281eceb2e9..235fbe3c151 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..31ba4db3c83
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..b186c4452a8
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementArgs.cs
index 06c55ba5a20..d93591b1bf9 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementGetArgs.cs
index f4b30501b3d..6268846b672 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..617eb575ac1
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..d56a9697841
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementArgs.cs
index 1c370608061..aed321610b2 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
index 643a7f8bd1e..bc25ed61538 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..3c39ca2a9b5
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..fc1bc4978dc
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementArgs.cs
index b80c8e4fa97..b2ad0400d1c 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
index 544a9efe6df..451df1a6af4 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..4cf71b0eb65
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..ff696afa939
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementArgs.cs
index 2f54876bc2b..5562aeddbf7 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
index c0c47297769..f40a77b537a 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..8223868d0a2
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..a865b6f9499
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementArgs.cs
index af7410d0c5b..94ca8f54984 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementGetArgs.cs
index ab0fe47d767..e182621783b 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..7f00ac61bf7
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..0fecc7b1559
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementArgs.cs
index e3417911e3f..4c9e7bfe630 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
index 4a03f3509fb..569c93088e5 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..86991a9027d
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..6fc0edb50af
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementArgs.cs
index 0172eae226b..fe486caede7 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
index b2cc2b239e2..50f4ab4634d 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..489acb4f9e5
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..8995b607613
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementArgs.cs
index 903e90c1730..ee99be50373 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
index d47f0b5baac..64e5b5986ce 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..5ea09f4fd62
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..04333d2527a
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementArgs.cs
index 338ed1d354d..2eeaf7fd560 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementGetArgs.cs
index cb9e8da2544..2a7c95dbb0c 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..3321db6637c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..de0ee326f13
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementArgs.cs
index df1443df898..31d740d0c85 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
index 6ab8481efd1..2722cc29761 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..9c580075f47
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..5ba1622d843
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementArgs.cs
index e355445d89e..cbad9a0e184 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
index bb9ae96f47e..825da0094f6 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..f530925d929
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..cbd8a68d518
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementArgs.cs
index 375b7607ea0..e8af7a8b88b 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementOrStatementStatementArgs : Pulumi.Resourc
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementGetArgs.cs
index 91b5061ffbf..8520984b616 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementOrStatementStatementGetArgs : Pulumi.Reso
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..34f4b95df7d
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..98dee21f8f4
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementArgs.cs
index fd4b8cccd62..cdbb214e91d 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
index 079a1dc17ab..44232a1c21f 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..80079902634
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..8d3e42117c9
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementArgs.cs
index fc202f32be8..2ee88d9d3eb 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementGetArgs.cs
index f255c5e222f..c7f83f09e71 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..ea4d721e8e9
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..b85b33ed55e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementArgs.cs
index f1a8c4f0264..16fd34a30d8 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
index 73a78632ca3..c9f49605669 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..92edb3370c9
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..4d2700e34e2
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementArgs.cs
index 433a4ce30a7..85c97daf101 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
index cd632bad787..b12abbffd17 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..17ef4819d2b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..9885d2d025c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementArgs.cs
index 5922b6cb98d..574003bebbd 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementA
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
index fb72237f3c4..3aa94e28d41 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementA
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..65a177af2e0
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..f220b43013f
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementArgs.cs
index 8de40319bb7..966fe3534a9 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementA
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementGetArgs.cs
index 2ff25b2f522..c0685497925 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementG
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..11c15e95e61
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..ae6c113cd31
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementArgs.cs
index 4339fab7732..2bc483d60d4 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementN
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
index 9abdd708fab..176ec0b9105 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementN
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..0704ed50dd6
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..b27432a999c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementArgs.cs
index 6ffe22ba143..77d2f2be04e 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementO
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
index 9191cc6d3b2..dda9b360540 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementO
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..dfb8435acf4
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..f869fdc5931
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementArgs.cs
index 9ff17fcc7a4..4d74a0f7a05 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGetArgs.cs
index 78009cd101d..fa6f143f2aa 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..c2ec137dd17
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..dd962269cd1
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementArgs.cs
index 5a3477c7be6..e9d45e73cd0 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGetArgs.cs
index fa6071a39aa..159fa55c114 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..ea694ff0e1d
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..21adcc27e70
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs.cs
index ecc8f3840d4..dcab6f885e7 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGetArgs.cs
index 56c3e41981f..d8131a6a3b4 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..94f9e7a7605
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..1258f942a07
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementArgs.cs
index a7a64738ece..08937cb7233 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGetArgs.cs
index e83c4ceacfb..517dc8a47f0 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..7a4e9dfd3ad
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..87310b6a54d
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementArgs.cs
index 504576c56e6..b09b9e47d26 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementArgs
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementGetArgs.cs
index c2238e91dcc..a409751c0d4 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementGetAr
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..e5459d584e0
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..412c894dcde
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementArgs.cs
index 55e24fdb900..d8b47949a27 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGetArgs.cs
index 2f879407af4..a88186b79a2 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..4538a55ffe4
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..c1a64a96516
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementArgs.cs
index 853aa8ce803..13b001243c6 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGetArgs.cs
index a2b3ace1924..cc2d2ca854d 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..2c169e74f55
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..b3bee6e0b4f
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs.cs
index ac40648e46e..0afdc1e6b0e 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGetArgs.cs
index 3c931741c7f..dc77151a3ea 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..012cac342f6
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..4e7b43080ee
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementArgs.cs
index e4a69d4c820..81a5e88e0ab 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGetArgs.cs
index 86e9b6b6bf4..f3f1b71acd3 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..db9da6f5b62
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..edd0d2558db
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementArgs.cs
index 9a87a8cad04..02e387d46d3 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGetArgs.cs
index b343c6bc0dd..e5e24036d17 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..10bec9e7c84
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..f7d38b98b8a
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementArgs.cs
index 37c635f3494..bdfbbe50d49 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGetArgs.cs
index cdb10106dd7..b29f22adce8 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGetArgs.cs
@@ -36,6 +36,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..f40a11a0c6b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..b2bd93c1f22
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs.cs
index c70528aff50..785c22d3c43 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGetArgs.cs
index ddb82ed3ca6..a9e44e707c9 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..57cc6defb73
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..a47eb6aec56
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementArgs.cs
index af06eaaaed9..da77bb52cfc 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGetArgs.cs
index 9301d6db452..55ec128cbb9 100644
--- a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGetArgs.cs
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGetArgs.cs
@@ -30,6 +30,12 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         [Input("ipSetReferenceStatement")]
         public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementGetArgs>? IpSetReferenceStatement { get; set; }
 
+        /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        [Input("labelMatchStatement")]
+        public Input<Inputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs>? LabelMatchStatement { get; set; }
+
         /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
new file mode 100644
index 00000000000..91227c6a3f8
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
new file mode 100644
index 00000000000..df089a91454
--- /dev/null
+++ b/sdk/dotnet/WafV2/Inputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs.cs
@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Inputs
+{
+
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs : Pulumi.ResourceArgs
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        [Input("key", required: true)]
+        public Input<string> Key { get; set; } = null!;
+
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        [Input("scope", required: true)]
+        public Input<string> Scope { get; set; } = null!;
+
+        public WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementGetArgs()
+        {
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupCustomResponseBody.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupCustomResponseBody.cs
new file mode 100644
index 00000000000..e7e08a3336f
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupCustomResponseBody.cs
@@ -0,0 +1,42 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupCustomResponseBody
+    {
+        /// <summary>
+        /// The payload of the custom response.
+        /// </summary>
+        public readonly string Content;
+        /// <summary>
+        /// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        /// </summary>
+        public readonly string ContentType;
+        /// <summary>
+        /// A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        /// </summary>
+        public readonly string Key;
+
+        [OutputConstructor]
+        private RuleGroupCustomResponseBody(
+            string content,
+
+            string contentType,
+
+            string key)
+        {
+            Content = content;
+            ContentType = contentType;
+            Key = key;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRule.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRule.cs
index b5d821442aa..617a96f61b4 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRule.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRule.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRule
         /// </summary>
         public readonly int Priority;
         /// <summary>
+        /// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        /// </summary>
+        public readonly ImmutableArray<Outputs.RuleGroupRuleRuleLabel> RuleLabels;
+        /// <summary>
         /// The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatement Statement;
@@ -42,6 +46,8 @@ private RuleGroupRule(
 
             int priority,
 
+            ImmutableArray<Outputs.RuleGroupRuleRuleLabel> ruleLabels,
+
             Outputs.RuleGroupRuleStatement statement,
 
             Outputs.RuleGroupRuleVisibilityConfig visibilityConfig)
@@ -49,6 +55,7 @@ private RuleGroupRule(
             Action = action;
             Name = name;
             Priority = priority;
+            RuleLabels = ruleLabels;
             Statement = statement;
             VisibilityConfig = visibilityConfig;
         }
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader.cs
index b27e330e125..b05f0ff507e 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.WafV2.Outputs
     public sealed class RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         public readonly string Name;
         /// <summary>
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionBlockCustomResponse.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionBlockCustomResponse.cs
index 36db59a92b9..0e6f9324c89 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionBlockCustomResponse.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionBlockCustomResponse.cs
@@ -13,6 +13,10 @@ namespace Pulumi.Aws.WafV2.Outputs
     [OutputType]
     public sealed class RuleGroupRuleActionBlockCustomResponse
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        public readonly string? CustomResponseBodyKey;
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
@@ -24,10 +28,13 @@ public sealed class RuleGroupRuleActionBlockCustomResponse
 
         [OutputConstructor]
         private RuleGroupRuleActionBlockCustomResponse(
+            string? customResponseBodyKey,
+
             int responseCode,
 
             ImmutableArray<Outputs.RuleGroupRuleActionBlockCustomResponseResponseHeader> responseHeaders)
         {
+            CustomResponseBodyKey = customResponseBodyKey;
             ResponseCode = responseCode;
             ResponseHeaders = responseHeaders;
         }
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionBlockCustomResponseResponseHeader.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionBlockCustomResponseResponseHeader.cs
index 85bc94aab85..5f583555a88 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionBlockCustomResponseResponseHeader.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionBlockCustomResponseResponseHeader.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.WafV2.Outputs
     public sealed class RuleGroupRuleActionBlockCustomResponseResponseHeader
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         public readonly string Name;
         /// <summary>
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeader.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeader.cs
index 1aedc7e72b9..9b7a183cab9 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeader.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleActionCountCustomRequestHandlingInsertHeader.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.WafV2.Outputs
     public sealed class RuleGroupRuleActionCountCustomRequestHandlingInsertHeader
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         public readonly string Name;
         /// <summary>
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleRuleLabel.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleRuleLabel.cs
new file mode 100644
index 00000000000..b5d6cb6e1c0
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleRuleLabel.cs
@@ -0,0 +1,27 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleRuleLabel
+    {
+        /// <summary>
+        /// The label string.
+        /// </summary>
+        public readonly string Name;
+
+        [OutputConstructor]
+        private RuleGroupRuleRuleLabel(string name)
+        {
+            Name = name;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatement.cs
index e6ce7be8f5b..fa99b595894 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatement.cs
@@ -30,6 +30,10 @@ public sealed class RuleGroupRuleStatement
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private RuleGroupRuleStatement(
 
             Outputs.RuleGroupRuleStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementNotStatement? notStatement,
 
             Outputs.RuleGroupRuleStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private RuleGroupRuleStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatement.cs
index cb0b0191046..fdc1197b1a9 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class RuleGroupRuleStatementAndStatementStatement
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementAndStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private RuleGroupRuleStatementAndStatementStatement(
 
             Outputs.RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementAndStatementStatementNotStatement? notStatement,
 
             Outputs.RuleGroupRuleStatementAndStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private RuleGroupRuleStatementAndStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatement.cs
index 6667f11d041..54232034202 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementAndStatementStatementAndStatementState
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementAndStatementStatementAndStatementStatement(
 
             Outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementAndStatementStatementAndStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..d65cc8da031
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..63049d577e4
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatement.cs
index a163a51a739..8956e8d9dfe 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementAndStatementStatementNotStatementState
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementAndStatementStatementNotStatementStatement(
 
             Outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementAndStatementStatementNotStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..5f8d88d94d0
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatement.cs
index 598151547cf..e02b10781ad 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementAndStatementStatementOrStatementStatem
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementAndStatementStatementOrStatementStatement(
 
             Outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementAndStatementStatementOrStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..85ab28e7b81
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..0d97cd37caf
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatement.cs
index a9521b03649..56b4779e633 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class RuleGroupRuleStatementNotStatementStatement
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private RuleGroupRuleStatementNotStatementStatement(
 
             Outputs.RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementNotStatementStatementNotStatement? notStatement,
 
             Outputs.RuleGroupRuleStatementNotStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private RuleGroupRuleStatementNotStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatement.cs
index 5263ba833df..5c121f5e393 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementNotStatementStatementAndStatementState
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementNotStatementStatementAndStatementStatement(
 
             Outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementNotStatementStatementAndStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..709ef8299fc
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..32e611cde19
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatement.cs
index 6b179be1382..65a1eb93cc2 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementNotStatementStatementNotStatementState
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementNotStatementStatementNotStatementStatement(
 
             Outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementNotStatementStatementNotStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..31b0643d127
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatement.cs
index 51cd141d70f..1bce9073a81 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementNotStatementStatementOrStatementStatem
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementNotStatementStatementOrStatementStatement(
 
             Outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementNotStatementStatementOrStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..c688be5ed2b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatement.cs
index a1347829e39..2b8437603f3 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class RuleGroupRuleStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementOrStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private RuleGroupRuleStatementOrStatementStatement(
 
             Outputs.RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementOrStatementStatementNotStatement? notStatement,
 
             Outputs.RuleGroupRuleStatementOrStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private RuleGroupRuleStatementOrStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatement.cs
index 20791eb74a2..a82b06ca4d1 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementOrStatementStatementAndStatementStatem
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementOrStatementStatementAndStatementStatement(
 
             Outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementOrStatementStatementAndStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..7850fc5b55a
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..719ae1653b9
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatement.cs
index 29b5e998dc8..327fdf364bc 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementOrStatementStatementNotStatementStatem
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementOrStatementStatementNotStatementStatement(
 
             Outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementOrStatementStatementNotStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..175dc484123
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatement.cs
index 5d89956dffd..12a5ab78341 100644
--- a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class RuleGroupRuleStatementOrStatementStatementOrStatementStateme
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private RuleGroupRuleStatementOrStatementStatementOrStatementStatement(
 
             Outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private RuleGroupRuleStatementOrStatementStatementOrStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..9404b337f16
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclCustomResponseBody.cs b/sdk/dotnet/WafV2/Outputs/WebAclCustomResponseBody.cs
new file mode 100644
index 00000000000..e6dbc31d8aa
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclCustomResponseBody.cs
@@ -0,0 +1,42 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclCustomResponseBody
+    {
+        /// <summary>
+        /// The payload of the custom response.
+        /// </summary>
+        public readonly string Content;
+        /// <summary>
+        /// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        /// </summary>
+        public readonly string ContentType;
+        /// <summary>
+        /// A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        /// </summary>
+        public readonly string Key;
+
+        [OutputConstructor]
+        private WebAclCustomResponseBody(
+            string content,
+
+            string contentType,
+
+            string key)
+        {
+            Content = content;
+            ContentType = contentType;
+            Key = key;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeader.cs b/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeader.cs
index 5e5d2abe955..d72e6258293 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeader.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionAllowCustomRequestHandlingInsertHeader.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.WafV2.Outputs
     public sealed class WebAclDefaultActionAllowCustomRequestHandlingInsertHeader
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         public readonly string Name;
         /// <summary>
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionBlockCustomResponse.cs b/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionBlockCustomResponse.cs
index ad96e8c7757..7579ddbe1a6 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionBlockCustomResponse.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionBlockCustomResponse.cs
@@ -13,6 +13,10 @@ namespace Pulumi.Aws.WafV2.Outputs
     [OutputType]
     public sealed class WebAclDefaultActionBlockCustomResponse
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        public readonly string? CustomResponseBodyKey;
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
@@ -24,10 +28,13 @@ public sealed class WebAclDefaultActionBlockCustomResponse
 
         [OutputConstructor]
         private WebAclDefaultActionBlockCustomResponse(
+            string? customResponseBodyKey,
+
             int responseCode,
 
             ImmutableArray<Outputs.WebAclDefaultActionBlockCustomResponseResponseHeader> responseHeaders)
         {
+            CustomResponseBodyKey = customResponseBodyKey;
             ResponseCode = responseCode;
             ResponseHeaders = responseHeaders;
         }
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionBlockCustomResponseResponseHeader.cs b/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionBlockCustomResponseResponseHeader.cs
index 2d6a4537b05..403400eb0c5 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionBlockCustomResponseResponseHeader.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclDefaultActionBlockCustomResponseResponseHeader.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.WafV2.Outputs
     public sealed class WebAclDefaultActionBlockCustomResponseResponseHeader
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         public readonly string Name;
         /// <summary>
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRule.cs b/sdk/dotnet/WafV2/Outputs/WebAclRule.cs
index 9c216467a08..ec4a2c74dc1 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRule.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRule.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRule
         /// </summary>
         public readonly int Priority;
         /// <summary>
+        /// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        /// </summary>
+        public readonly ImmutableArray<Outputs.WebAclRuleRuleLabel> RuleLabels;
+        /// <summary>
         /// The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatement Statement;
@@ -48,6 +52,8 @@ private WebAclRule(
 
             int priority,
 
+            ImmutableArray<Outputs.WebAclRuleRuleLabel> ruleLabels,
+
             Outputs.WebAclRuleStatement statement,
 
             Outputs.WebAclRuleVisibilityConfig visibilityConfig)
@@ -56,6 +62,7 @@ private WebAclRule(
             Name = name;
             OverrideAction = overrideAction;
             Priority = priority;
+            RuleLabels = ruleLabels;
             Statement = statement;
             VisibilityConfig = visibilityConfig;
         }
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeader.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeader.cs
index 411ec438ca0..cab99fb0447 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeader.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleActionAllowCustomRequestHandlingInsertHeader.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.WafV2.Outputs
     public sealed class WebAclRuleActionAllowCustomRequestHandlingInsertHeader
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         public readonly string Name;
         /// <summary>
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleActionBlockCustomResponse.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleActionBlockCustomResponse.cs
index bc22d9f41ac..df676b32c3f 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleActionBlockCustomResponse.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleActionBlockCustomResponse.cs
@@ -13,6 +13,10 @@ namespace Pulumi.Aws.WafV2.Outputs
     [OutputType]
     public sealed class WebAclRuleActionBlockCustomResponse
     {
+        /// <summary>
+        /// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        /// </summary>
+        public readonly string? CustomResponseBodyKey;
         /// <summary>
         /// The HTTP status code to return to the client.
         /// </summary>
@@ -24,10 +28,13 @@ public sealed class WebAclRuleActionBlockCustomResponse
 
         [OutputConstructor]
         private WebAclRuleActionBlockCustomResponse(
+            string? customResponseBodyKey,
+
             int responseCode,
 
             ImmutableArray<Outputs.WebAclRuleActionBlockCustomResponseResponseHeader> responseHeaders)
         {
+            CustomResponseBodyKey = customResponseBodyKey;
             ResponseCode = responseCode;
             ResponseHeaders = responseHeaders;
         }
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleActionBlockCustomResponseResponseHeader.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleActionBlockCustomResponseResponseHeader.cs
index f5f37a15b5c..ef63e7decac 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleActionBlockCustomResponseResponseHeader.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleActionBlockCustomResponseResponseHeader.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.WafV2.Outputs
     public sealed class WebAclRuleActionBlockCustomResponseResponseHeader
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         public readonly string Name;
         /// <summary>
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleActionCountCustomRequestHandlingInsertHeader.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleActionCountCustomRequestHandlingInsertHeader.cs
index 49bd9a1aac1..1284f44c6a3 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleActionCountCustomRequestHandlingInsertHeader.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleActionCountCustomRequestHandlingInsertHeader.cs
@@ -14,7 +14,7 @@ namespace Pulumi.Aws.WafV2.Outputs
     public sealed class WebAclRuleActionCountCustomRequestHandlingInsertHeader
     {
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         public readonly string Name;
         /// <summary>
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleRuleLabel.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleRuleLabel.cs
new file mode 100644
index 00000000000..4c11a442033
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleRuleLabel.cs
@@ -0,0 +1,27 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleRuleLabel
+    {
+        /// <summary>
+        /// The label string.
+        /// </summary>
+        public readonly string Name;
+
+        [OutputConstructor]
+        private WebAclRuleRuleLabel(string name)
+        {
+            Name = name;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatement.cs
index f81580c3295..12f131d86f4 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatement? ManagedRuleGroupStatement;
@@ -76,6 +80,8 @@ private WebAclRuleStatement(
 
             Outputs.WebAclRuleStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatement? managedRuleGroupStatement,
 
             Outputs.WebAclRuleStatementNotStatement? notStatement,
@@ -98,6 +104,7 @@ private WebAclRuleStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             ManagedRuleGroupStatement = managedRuleGroupStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatement.cs
index c15fbea6d0f..2bdbee43358 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementAndStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementAndStatementStatement(
 
             Outputs.WebAclRuleStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementAndStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatement.cs
index bb69f0b0ec0..154a035bdfe 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementAndStatementStatementAndStatementStatement(
 
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementAndStatementStatementAndStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatement.cs
index 469cb6fff4a..74e9d0d7a8a 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatemen
 
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..43e1adb537b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..e5b812009b0
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatement.cs
index b8f2a4c128c..b52e5f51024 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatemen
 
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..f259e1d67bb
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatement.cs
index 409730f345e..b011995ff6d 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatement
 
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..59d4bd68420
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..c3e295fcd0a
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatement.cs
index 6ffb5de81cf..84920a7da0d 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementAndStatementStatementNotStatementStatement(
 
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementAndStatementStatementNotStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatement.cs
index 208600e8ca7..9f13a471473 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatemen
 
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..97abe5e9cfa
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..4de87e93454
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatement.cs
index 9adfe797219..446a5b001bd 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatemen
 
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..39e8a6f2d98
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatement.cs
index cb11a02e580..e63a0f51be6 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatement
 
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..d686d7ca880
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatement.cs
index 44d174b6e5b..0c862998569 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementAndStatementStatementOrStatementStatement(
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementAndStatementStatementOrStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatement.cs
index 6e3ade10d5a..085238d1b60 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatement
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..19506dd0f21
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..6001deb2bf3
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatement.cs
index 100b1e4e069..e67cff366e1 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..2073e290865
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatement.cs
index 5ab46aa8ef0..dc0fe20bad7 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementS
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementS
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..891877ae527
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..247f8d77ac4
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement.cs
index 66923c35b84..f96beef0b81 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement(
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatement.cs
index 167313ab9ce..6e8486c3649 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatement.cs
index 6371e980600..dd2a7967d4a 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..f5ff0957cb8
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..db7096dbae6
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatement.cs
index 95b182210d5..76547332f23 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..7a3c6ae7a3e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatement.cs
index 4fec86449dc..86f88ec83d9 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..acb865e4c95
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..1409e9099b7
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatement.cs
index 3ca7ae1b361..47023fe2c79 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatement.cs
index 75d203a3232..46e4411c06a 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..4b634cffd89
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..6b492057e74
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatement.cs
index e7cafd05c46..b84bb10a5e7 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..8d001469ab1
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatement.cs
index dc4e8a7f64d..ee940dfc9c4 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..ecbddab3e10
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatement.cs
index 59c8a6befe8..f32f3244d77 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatement.cs
index af462eaed29..dfd940fe8d1 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..b4dbf0a4c6d
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..c1a74d33bd7
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatement.cs
index 56a94bcaeaa..445596cf29b 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..63e71a9797c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatement.cs
index 67c8ad119ce..2f2d52e85ec 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStateme
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..a476b8a32b1
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatement.cs
index 4be26d3a64b..d09392296b6 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementNotStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementNotStatementStatement(
 
             Outputs.WebAclRuleStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementNotStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatement.cs
index dbdfa7bda67..a6f8299f5b9 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementNotStatementStatementAndStatementStatement(
 
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementNotStatementStatementAndStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatement.cs
index 84d972d444e..e2c5c653eb4 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatemen
 
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..9e87bf6421e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..a7a26736e25
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatement.cs
index 625aa363dd2..aac0e5341ba 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatemen
 
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..f2c099bfe2e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatement.cs
index fe853cb6671..d385160db5e 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatement
 
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..8a248ed9310
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..ec2cc64166f
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatement.cs
index 0e9a0bb8967..53d3a355a50 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementNotStatementStatementNotStatementStatement(
 
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementNotStatementStatementNotStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatement.cs
index d3a5d8a1bed..1a6e7c0da1a 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatemen
 
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..554c38bda27
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..1ff201c4eb5
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatement.cs
index e3b6ff37a02..f65e93c5783 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatemen
 
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatemen
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..7e1a052eaf7
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatement.cs
index b4ffca7ce90..587a35261c0 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatemen
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatement
 
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..26fb974147e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatement.cs
index ea1710ef55b..2b301f32829 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementNotStatementStatementOrStatementStatement(
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementNotStatementStatementOrStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatement.cs
index 149a9d3eb71..abe09ec517d 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatement
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..c6a473c6ab6
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..87894cb2e30
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatement.cs
index 470112e5b2e..a6b14124b8e 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..38e06875cc8
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatement.cs
index 2c8bd8fe400..347711b7f2f 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementS
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementS
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..1dee22b2e55
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatement.cs
index 9345bbe7b93..e1aab3a6de1 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementOrStatementStatement(
 
             Outputs.WebAclRuleStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementOrStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatement.cs
index 7394d16d490..27654499112 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementOrStatementStatementAndStatementStatement(
 
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementOrStatementStatementAndStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatement.cs
index efed6a9ae42..d4528e6f900 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatement
 
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..88956b8455e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..5faaa7e993d
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatement.cs
index bb148376aab..43cefec7457 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement
 
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..132e83cf5e5
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatement.cs
index 33b8c750c4b..1c30527efd9 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementS
 
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementS
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..dc60c5a8ffb
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..e1daf38c47d
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatement.cs
index 999d7fa42e5..e82fbbac367 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementOrStatementStatementNotStatementStatement(
 
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementOrStatementStatementNotStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatement.cs
index 8a086ce5429..2c28933f616 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatement
 
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..76f159b04b7
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..fe36b5fb20e
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatement.cs
index 7fd37ada3d3..2a06aba000e 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement
 
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..8385cb297d6
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatement.cs
index 9d4b9b22f7e..5ceaa77d296 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementS
 
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementS
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..d787084ce57
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatement.cs
index d42ccc5a369..3e7560c751b 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementOrStatementStatementOrStatementStatement(
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementOrStatementStatementOrStatementStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatement.cs
index a00f03ecd79..84540364dec 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementA
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementS
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementS
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..dc60c897b1c
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..5e48646b604
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatement.cs
index 18e32405af7..1cb47f83900 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementN
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementS
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementS
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..c06d8ac3928
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatement.cs
index 4ab0282ba55..7ceaff083ca 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementO
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementSt
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementSt
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..7a5ea2926bd
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatement.cs
index e0e94494b53..b9cbe26582b 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatement
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatement(
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatement(
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatement.cs
index 7c0fe875119..2128ab0aa7b 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatement.cs
index fff9f6695b8..6b16f3c67b5 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..538eea024be
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..cf8658ad074
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatement.cs
index 01335b10831..e92b4dd4f5f 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..7b40c265c81
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatement.cs
index c54bd59a75e..10aee3f50cc 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndSt
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..81dd7748b4f
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..5fc74fc5842
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatement.cs
index 25b6096384e..23a3f33e646 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatement.cs
index 1e75b109b93..926a7ea60e3 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..9764c8eb759
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..4307645d58b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatement.cs
index fd4d58b0e69..dabbbdeeb84 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..98c77ddee7a
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatement.cs
index 4963382fb5e..8298e4f98f2 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotSt
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..2ec310acd36
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement.cs
index 6f2bb29b9a9..b94aa919c5b 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement.cs
@@ -30,6 +30,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement? NotStatement;
@@ -64,6 +68,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement? notStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatement? orStatement,
@@ -80,6 +86,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             NotStatement = notStatement;
             OrStatement = orStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatement.cs
index f1f4a1e599c..bb096a06b55 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..67cefba2f90
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..134d1aea94b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatement.cs
index f0b01257006..308d00bb29f 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..13c04ccf53b
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatement.cs
index 185049adf4f..27574151fb3 100644
--- a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatement.cs
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatement.cs
@@ -26,6 +26,10 @@ public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrSta
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? IpSetReferenceStatement;
         /// <summary>
+        /// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        /// </summary>
+        public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement? LabelMatchStatement;
+        /// <summary>
         /// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         /// </summary>
         public readonly Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? RegexPatternSetReferenceStatement;
@@ -50,6 +54,8 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement? ipSetReferenceStatement,
 
+            Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement? labelMatchStatement,
+
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement? regexPatternSetReferenceStatement,
 
             Outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatement? sizeConstraintStatement,
@@ -61,6 +67,7 @@ private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
             ByteMatchStatement = byteMatchStatement;
             GeoMatchStatement = geoMatchStatement;
             IpSetReferenceStatement = ipSetReferenceStatement;
+            LabelMatchStatement = labelMatchStatement;
             RegexPatternSetReferenceStatement = regexPatternSetReferenceStatement;
             SizeConstraintStatement = sizeConstraintStatement;
             SqliMatchStatement = sqliMatchStatement;
diff --git a/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
new file mode 100644
index 00000000000..e24378e3ab6
--- /dev/null
+++ b/sdk/dotnet/WafV2/Outputs/WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement.cs
@@ -0,0 +1,35 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Threading.Tasks;
+using Pulumi.Serialization;
+
+namespace Pulumi.Aws.WafV2.Outputs
+{
+
+    [OutputType]
+    public sealed class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+    {
+        /// <summary>
+        /// The string to match against.
+        /// </summary>
+        public readonly string Key;
+        /// <summary>
+        /// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        /// </summary>
+        public readonly string Scope;
+
+        [OutputConstructor]
+        private WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement(
+            string key,
+
+            string scope)
+        {
+            Key = key;
+            Scope = scope;
+        }
+    }
+}
diff --git a/sdk/dotnet/WafV2/RuleGroup.cs b/sdk/dotnet/WafV2/RuleGroup.cs
index b7b6f082ca8..62655a0c4cd 100644
--- a/sdk/dotnet/WafV2/RuleGroup.cs
+++ b/sdk/dotnet/WafV2/RuleGroup.cs
@@ -375,6 +375,12 @@ public partial class RuleGroup : Pulumi.CustomResource
         [Output("capacity")]
         public Output<int> Capacity { get; private set; } = null!;
 
+        /// <summary>
+        /// Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        /// </summary>
+        [Output("customResponseBodies")]
+        public Output<ImmutableArray<Outputs.RuleGroupCustomResponseBody>> CustomResponseBodies { get; private set; } = null!;
+
         /// <summary>
         /// A friendly description of the rule group.
         /// </summary>
@@ -385,7 +391,7 @@ public partial class RuleGroup : Pulumi.CustomResource
         public Output<string> LockToken { get; private set; } = null!;
 
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
@@ -472,6 +478,18 @@ public sealed class RuleGroupArgs : Pulumi.ResourceArgs
         [Input("capacity", required: true)]
         public Input<int> Capacity { get; set; } = null!;
 
+        [Input("customResponseBodies")]
+        private InputList<Inputs.RuleGroupCustomResponseBodyArgs>? _customResponseBodies;
+
+        /// <summary>
+        /// Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        /// </summary>
+        public InputList<Inputs.RuleGroupCustomResponseBodyArgs> CustomResponseBodies
+        {
+            get => _customResponseBodies ?? (_customResponseBodies = new InputList<Inputs.RuleGroupCustomResponseBodyArgs>());
+            set => _customResponseBodies = value;
+        }
+
         /// <summary>
         /// A friendly description of the rule group.
         /// </summary>
@@ -479,7 +497,7 @@ public sealed class RuleGroupArgs : Pulumi.ResourceArgs
         public Input<string>? Description { get; set; }
 
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
@@ -551,6 +569,18 @@ public sealed class RuleGroupState : Pulumi.ResourceArgs
         [Input("capacity")]
         public Input<int>? Capacity { get; set; }
 
+        [Input("customResponseBodies")]
+        private InputList<Inputs.RuleGroupCustomResponseBodyGetArgs>? _customResponseBodies;
+
+        /// <summary>
+        /// Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        /// </summary>
+        public InputList<Inputs.RuleGroupCustomResponseBodyGetArgs> CustomResponseBodies
+        {
+            get => _customResponseBodies ?? (_customResponseBodies = new InputList<Inputs.RuleGroupCustomResponseBodyGetArgs>());
+            set => _customResponseBodies = value;
+        }
+
         /// <summary>
         /// A friendly description of the rule group.
         /// </summary>
@@ -561,7 +591,7 @@ public sealed class RuleGroupState : Pulumi.ResourceArgs
         public Input<string>? LockToken { get; set; }
 
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
diff --git a/sdk/dotnet/WafV2/WebAcl.cs b/sdk/dotnet/WafV2/WebAcl.cs
index 13472cf1eec..00d25bc5024 100644
--- a/sdk/dotnet/WafV2/WebAcl.cs
+++ b/sdk/dotnet/WafV2/WebAcl.cs
@@ -98,6 +98,7 @@ namespace Pulumi.Aws.WafV2
     /// }
     /// ```
     /// ### Rate Based
+    /// Rate-limit US and NL-based clients to 10,000 requests for every 5 minutes.
     /// 
     /// ```csharp
     /// using Pulumi;
@@ -111,16 +112,16 @@ namespace Pulumi.Aws.WafV2
     ///         {
     ///             DefaultAction = new Aws.WafV2.Inputs.WebAclDefaultActionArgs
     ///             {
-    ///                 Block = ,
+    ///                 Allow = ,
     ///             },
-    ///             Description = "Example of a rate based statement.",
+    ///             Description = "Example of a Cloudfront rate based statement.",
     ///             Rules = 
     ///             {
     ///                 new Aws.WafV2.Inputs.WebAclRuleArgs
     ///                 {
     ///                     Action = new Aws.WafV2.Inputs.WebAclRuleActionArgs
     ///                     {
-    ///                         Count = ,
+    ///                         Block = ,
     ///                     },
     ///                     Name = "rule-1",
     ///                     Priority = 1,
@@ -151,7 +152,7 @@ namespace Pulumi.Aws.WafV2
     ///                     },
     ///                 },
     ///             },
-    ///             Scope = "REGIONAL",
+    ///             Scope = "CLOUDFRONT",
     ///             Tags = 
     ///             {
     ///                 { "Tag1", "Value1" },
@@ -350,6 +351,12 @@ public partial class WebAcl : Pulumi.CustomResource
         [Output("capacity")]
         public Output<int> Capacity { get; private set; } = null!;
 
+        /// <summary>
+        /// Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        /// </summary>
+        [Output("customResponseBodies")]
+        public Output<ImmutableArray<Outputs.WebAclCustomResponseBody>> CustomResponseBodies { get; private set; } = null!;
+
         /// <summary>
         /// The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
         /// </summary>
@@ -366,7 +373,7 @@ public partial class WebAcl : Pulumi.CustomResource
         public Output<string> LockToken { get; private set; } = null!;
 
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
@@ -447,6 +454,18 @@ public static WebAcl Get(string name, Input<string> id, WebAclState? state = nul
 
     public sealed class WebAclArgs : Pulumi.ResourceArgs
     {
+        [Input("customResponseBodies")]
+        private InputList<Inputs.WebAclCustomResponseBodyArgs>? _customResponseBodies;
+
+        /// <summary>
+        /// Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        /// </summary>
+        public InputList<Inputs.WebAclCustomResponseBodyArgs> CustomResponseBodies
+        {
+            get => _customResponseBodies ?? (_customResponseBodies = new InputList<Inputs.WebAclCustomResponseBodyArgs>());
+            set => _customResponseBodies = value;
+        }
+
         /// <summary>
         /// The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
         /// </summary>
@@ -460,7 +479,7 @@ public sealed class WebAclArgs : Pulumi.ResourceArgs
         public Input<string>? Description { get; set; }
 
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
@@ -532,6 +551,18 @@ public sealed class WebAclState : Pulumi.ResourceArgs
         [Input("capacity")]
         public Input<int>? Capacity { get; set; }
 
+        [Input("customResponseBodies")]
+        private InputList<Inputs.WebAclCustomResponseBodyGetArgs>? _customResponseBodies;
+
+        /// <summary>
+        /// Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        /// </summary>
+        public InputList<Inputs.WebAclCustomResponseBodyGetArgs> CustomResponseBodies
+        {
+            get => _customResponseBodies ?? (_customResponseBodies = new InputList<Inputs.WebAclCustomResponseBodyGetArgs>());
+            set => _customResponseBodies = value;
+        }
+
         /// <summary>
         /// The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
         /// </summary>
@@ -548,7 +579,7 @@ public sealed class WebAclState : Pulumi.ResourceArgs
         public Input<string>? LockToken { get; set; }
 
         /// <summary>
-        /// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        /// The label string.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
diff --git a/sdk/go/aws/account/alternativeContact.go b/sdk/go/aws/account/alternativeContact.go
new file mode 100644
index 00000000000..0b78a2175fe
--- /dev/null
+++ b/sdk/go/aws/account/alternativeContact.go
@@ -0,0 +1,360 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package account
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/pkg/errors"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+// Manages the specified alternate contact attached to an AWS Account.
+//
+// ## Example Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/account"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		_, err := account.NewAlternativeContact(ctx, "operations", &account.AlternativeContactArgs{
+// 			AlternateContactType: pulumi.String("OPERATIONS"),
+// 			EmailAddress:         pulumi.String("test@example.com"),
+// 			PhoneNumber:          pulumi.String("+1234567890"),
+// 			Title:                pulumi.String("Example"),
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+//
+// ## Import
+//
+// The current Alternate Contact can be imported using the `alternate_contact_type`, e.g.,
+//
+// ```sh
+//  $ pulumi import aws:account/alternativeContact:AlternativeContact operations OPERATIONS
+// ```
+type AlternativeContact struct {
+	pulumi.CustomResourceState
+
+	// The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+	AlternateContactType pulumi.StringOutput `pulumi:"alternateContactType"`
+	// An email address for the alternate contact.
+	EmailAddress pulumi.StringOutput `pulumi:"emailAddress"`
+	// The name of the alternate contact.
+	Name pulumi.StringOutput `pulumi:"name"`
+	// A phone number for the alternate contact.
+	PhoneNumber pulumi.StringOutput `pulumi:"phoneNumber"`
+	// A title for the alternate contact.
+	Title pulumi.StringOutput `pulumi:"title"`
+}
+
+// NewAlternativeContact registers a new resource with the given unique name, arguments, and options.
+func NewAlternativeContact(ctx *pulumi.Context,
+	name string, args *AlternativeContactArgs, opts ...pulumi.ResourceOption) (*AlternativeContact, error) {
+	if args == nil {
+		return nil, errors.New("missing one or more required arguments")
+	}
+
+	if args.AlternateContactType == nil {
+		return nil, errors.New("invalid value for required argument 'AlternateContactType'")
+	}
+	if args.EmailAddress == nil {
+		return nil, errors.New("invalid value for required argument 'EmailAddress'")
+	}
+	if args.PhoneNumber == nil {
+		return nil, errors.New("invalid value for required argument 'PhoneNumber'")
+	}
+	if args.Title == nil {
+		return nil, errors.New("invalid value for required argument 'Title'")
+	}
+	var resource AlternativeContact
+	err := ctx.RegisterResource("aws:account/alternativeContact:AlternativeContact", name, args, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// GetAlternativeContact gets an existing AlternativeContact resource's state with the given name, ID, and optional
+// state properties that are used to uniquely qualify the lookup (nil if not required).
+func GetAlternativeContact(ctx *pulumi.Context,
+	name string, id pulumi.IDInput, state *AlternativeContactState, opts ...pulumi.ResourceOption) (*AlternativeContact, error) {
+	var resource AlternativeContact
+	err := ctx.ReadResource("aws:account/alternativeContact:AlternativeContact", name, id, state, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// Input properties used for looking up and filtering AlternativeContact resources.
+type alternativeContactState struct {
+	// The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+	AlternateContactType *string `pulumi:"alternateContactType"`
+	// An email address for the alternate contact.
+	EmailAddress *string `pulumi:"emailAddress"`
+	// The name of the alternate contact.
+	Name *string `pulumi:"name"`
+	// A phone number for the alternate contact.
+	PhoneNumber *string `pulumi:"phoneNumber"`
+	// A title for the alternate contact.
+	Title *string `pulumi:"title"`
+}
+
+type AlternativeContactState struct {
+	// The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+	AlternateContactType pulumi.StringPtrInput
+	// An email address for the alternate contact.
+	EmailAddress pulumi.StringPtrInput
+	// The name of the alternate contact.
+	Name pulumi.StringPtrInput
+	// A phone number for the alternate contact.
+	PhoneNumber pulumi.StringPtrInput
+	// A title for the alternate contact.
+	Title pulumi.StringPtrInput
+}
+
+func (AlternativeContactState) ElementType() reflect.Type {
+	return reflect.TypeOf((*alternativeContactState)(nil)).Elem()
+}
+
+type alternativeContactArgs struct {
+	// The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+	AlternateContactType string `pulumi:"alternateContactType"`
+	// An email address for the alternate contact.
+	EmailAddress string `pulumi:"emailAddress"`
+	// The name of the alternate contact.
+	Name *string `pulumi:"name"`
+	// A phone number for the alternate contact.
+	PhoneNumber string `pulumi:"phoneNumber"`
+	// A title for the alternate contact.
+	Title string `pulumi:"title"`
+}
+
+// The set of arguments for constructing a AlternativeContact resource.
+type AlternativeContactArgs struct {
+	// The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+	AlternateContactType pulumi.StringInput
+	// An email address for the alternate contact.
+	EmailAddress pulumi.StringInput
+	// The name of the alternate contact.
+	Name pulumi.StringPtrInput
+	// A phone number for the alternate contact.
+	PhoneNumber pulumi.StringInput
+	// A title for the alternate contact.
+	Title pulumi.StringInput
+}
+
+func (AlternativeContactArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*alternativeContactArgs)(nil)).Elem()
+}
+
+type AlternativeContactInput interface {
+	pulumi.Input
+
+	ToAlternativeContactOutput() AlternativeContactOutput
+	ToAlternativeContactOutputWithContext(ctx context.Context) AlternativeContactOutput
+}
+
+func (*AlternativeContact) ElementType() reflect.Type {
+	return reflect.TypeOf((*AlternativeContact)(nil))
+}
+
+func (i *AlternativeContact) ToAlternativeContactOutput() AlternativeContactOutput {
+	return i.ToAlternativeContactOutputWithContext(context.Background())
+}
+
+func (i *AlternativeContact) ToAlternativeContactOutputWithContext(ctx context.Context) AlternativeContactOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(AlternativeContactOutput)
+}
+
+func (i *AlternativeContact) ToAlternativeContactPtrOutput() AlternativeContactPtrOutput {
+	return i.ToAlternativeContactPtrOutputWithContext(context.Background())
+}
+
+func (i *AlternativeContact) ToAlternativeContactPtrOutputWithContext(ctx context.Context) AlternativeContactPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(AlternativeContactPtrOutput)
+}
+
+type AlternativeContactPtrInput interface {
+	pulumi.Input
+
+	ToAlternativeContactPtrOutput() AlternativeContactPtrOutput
+	ToAlternativeContactPtrOutputWithContext(ctx context.Context) AlternativeContactPtrOutput
+}
+
+type alternativeContactPtrType AlternativeContactArgs
+
+func (*alternativeContactPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**AlternativeContact)(nil))
+}
+
+func (i *alternativeContactPtrType) ToAlternativeContactPtrOutput() AlternativeContactPtrOutput {
+	return i.ToAlternativeContactPtrOutputWithContext(context.Background())
+}
+
+func (i *alternativeContactPtrType) ToAlternativeContactPtrOutputWithContext(ctx context.Context) AlternativeContactPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(AlternativeContactPtrOutput)
+}
+
+// AlternativeContactArrayInput is an input type that accepts AlternativeContactArray and AlternativeContactArrayOutput values.
+// You can construct a concrete instance of `AlternativeContactArrayInput` via:
+//
+//          AlternativeContactArray{ AlternativeContactArgs{...} }
+type AlternativeContactArrayInput interface {
+	pulumi.Input
+
+	ToAlternativeContactArrayOutput() AlternativeContactArrayOutput
+	ToAlternativeContactArrayOutputWithContext(context.Context) AlternativeContactArrayOutput
+}
+
+type AlternativeContactArray []AlternativeContactInput
+
+func (AlternativeContactArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]*AlternativeContact)(nil)).Elem()
+}
+
+func (i AlternativeContactArray) ToAlternativeContactArrayOutput() AlternativeContactArrayOutput {
+	return i.ToAlternativeContactArrayOutputWithContext(context.Background())
+}
+
+func (i AlternativeContactArray) ToAlternativeContactArrayOutputWithContext(ctx context.Context) AlternativeContactArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(AlternativeContactArrayOutput)
+}
+
+// AlternativeContactMapInput is an input type that accepts AlternativeContactMap and AlternativeContactMapOutput values.
+// You can construct a concrete instance of `AlternativeContactMapInput` via:
+//
+//          AlternativeContactMap{ "key": AlternativeContactArgs{...} }
+type AlternativeContactMapInput interface {
+	pulumi.Input
+
+	ToAlternativeContactMapOutput() AlternativeContactMapOutput
+	ToAlternativeContactMapOutputWithContext(context.Context) AlternativeContactMapOutput
+}
+
+type AlternativeContactMap map[string]AlternativeContactInput
+
+func (AlternativeContactMap) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]*AlternativeContact)(nil)).Elem()
+}
+
+func (i AlternativeContactMap) ToAlternativeContactMapOutput() AlternativeContactMapOutput {
+	return i.ToAlternativeContactMapOutputWithContext(context.Background())
+}
+
+func (i AlternativeContactMap) ToAlternativeContactMapOutputWithContext(ctx context.Context) AlternativeContactMapOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(AlternativeContactMapOutput)
+}
+
+type AlternativeContactOutput struct{ *pulumi.OutputState }
+
+func (AlternativeContactOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*AlternativeContact)(nil))
+}
+
+func (o AlternativeContactOutput) ToAlternativeContactOutput() AlternativeContactOutput {
+	return o
+}
+
+func (o AlternativeContactOutput) ToAlternativeContactOutputWithContext(ctx context.Context) AlternativeContactOutput {
+	return o
+}
+
+func (o AlternativeContactOutput) ToAlternativeContactPtrOutput() AlternativeContactPtrOutput {
+	return o.ToAlternativeContactPtrOutputWithContext(context.Background())
+}
+
+func (o AlternativeContactOutput) ToAlternativeContactPtrOutputWithContext(ctx context.Context) AlternativeContactPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v AlternativeContact) *AlternativeContact {
+		return &v
+	}).(AlternativeContactPtrOutput)
+}
+
+type AlternativeContactPtrOutput struct{ *pulumi.OutputState }
+
+func (AlternativeContactPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**AlternativeContact)(nil))
+}
+
+func (o AlternativeContactPtrOutput) ToAlternativeContactPtrOutput() AlternativeContactPtrOutput {
+	return o
+}
+
+func (o AlternativeContactPtrOutput) ToAlternativeContactPtrOutputWithContext(ctx context.Context) AlternativeContactPtrOutput {
+	return o
+}
+
+func (o AlternativeContactPtrOutput) Elem() AlternativeContactOutput {
+	return o.ApplyT(func(v *AlternativeContact) AlternativeContact {
+		if v != nil {
+			return *v
+		}
+		var ret AlternativeContact
+		return ret
+	}).(AlternativeContactOutput)
+}
+
+type AlternativeContactArrayOutput struct{ *pulumi.OutputState }
+
+func (AlternativeContactArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]AlternativeContact)(nil))
+}
+
+func (o AlternativeContactArrayOutput) ToAlternativeContactArrayOutput() AlternativeContactArrayOutput {
+	return o
+}
+
+func (o AlternativeContactArrayOutput) ToAlternativeContactArrayOutputWithContext(ctx context.Context) AlternativeContactArrayOutput {
+	return o
+}
+
+func (o AlternativeContactArrayOutput) Index(i pulumi.IntInput) AlternativeContactOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) AlternativeContact {
+		return vs[0].([]AlternativeContact)[vs[1].(int)]
+	}).(AlternativeContactOutput)
+}
+
+type AlternativeContactMapOutput struct{ *pulumi.OutputState }
+
+func (AlternativeContactMapOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]AlternativeContact)(nil))
+}
+
+func (o AlternativeContactMapOutput) ToAlternativeContactMapOutput() AlternativeContactMapOutput {
+	return o
+}
+
+func (o AlternativeContactMapOutput) ToAlternativeContactMapOutputWithContext(ctx context.Context) AlternativeContactMapOutput {
+	return o
+}
+
+func (o AlternativeContactMapOutput) MapIndex(k pulumi.StringInput) AlternativeContactOutput {
+	return pulumi.All(o, k).ApplyT(func(vs []interface{}) AlternativeContact {
+		return vs[0].(map[string]AlternativeContact)[vs[1].(string)]
+	}).(AlternativeContactOutput)
+}
+
+func init() {
+	pulumi.RegisterInputType(reflect.TypeOf((*AlternativeContactInput)(nil)).Elem(), &AlternativeContact{})
+	pulumi.RegisterInputType(reflect.TypeOf((*AlternativeContactPtrInput)(nil)).Elem(), &AlternativeContact{})
+	pulumi.RegisterInputType(reflect.TypeOf((*AlternativeContactArrayInput)(nil)).Elem(), AlternativeContactArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*AlternativeContactMapInput)(nil)).Elem(), AlternativeContactMap{})
+	pulumi.RegisterOutputType(AlternativeContactOutput{})
+	pulumi.RegisterOutputType(AlternativeContactPtrOutput{})
+	pulumi.RegisterOutputType(AlternativeContactArrayOutput{})
+	pulumi.RegisterOutputType(AlternativeContactMapOutput{})
+}
diff --git a/sdk/go/aws/account/init.go b/sdk/go/aws/account/init.go
new file mode 100644
index 00000000000..5f1071e2c0c
--- /dev/null
+++ b/sdk/go/aws/account/init.go
@@ -0,0 +1,44 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package account
+
+import (
+	"fmt"
+
+	"github.com/blang/semver"
+	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+type module struct {
+	version semver.Version
+}
+
+func (m *module) Version() semver.Version {
+	return m.version
+}
+
+func (m *module) Construct(ctx *pulumi.Context, name, typ, urn string) (r pulumi.Resource, err error) {
+	switch typ {
+	case "aws:account/alternativeContact:AlternativeContact":
+		r = &AlternativeContact{}
+	default:
+		return nil, fmt.Errorf("unknown resource type: %s", typ)
+	}
+
+	err = ctx.RegisterResource(typ, name, nil, r, pulumi.URN_(urn))
+	return
+}
+
+func init() {
+	version, err := aws.PkgVersion()
+	if err != nil {
+		fmt.Printf("failed to determine package version. defaulting to v1: %v\n", err)
+	}
+	pulumi.RegisterResourceModule(
+		"aws",
+		"account/alternativeContact",
+		&module{version},
+	)
+}
diff --git a/sdk/go/aws/alb/getLoadBalancer.go b/sdk/go/aws/alb/getLoadBalancer.go
index 871411bd52f..f509759a979 100644
--- a/sdk/go/aws/alb/getLoadBalancer.go
+++ b/sdk/go/aws/alb/getLoadBalancer.go
@@ -78,10 +78,12 @@ type LookupLoadBalancerResult struct {
 	Arn                      string                    `pulumi:"arn"`
 	ArnSuffix                string                    `pulumi:"arnSuffix"`
 	CustomerOwnedIpv4Pool    string                    `pulumi:"customerOwnedIpv4Pool"`
+	DesyncMitigationMode     string                    `pulumi:"desyncMitigationMode"`
 	DnsName                  string                    `pulumi:"dnsName"`
 	DropInvalidHeaderFields  bool                      `pulumi:"dropInvalidHeaderFields"`
 	EnableDeletionProtection bool                      `pulumi:"enableDeletionProtection"`
 	EnableHttp2              bool                      `pulumi:"enableHttp2"`
+	EnableWafFailOpen        bool                      `pulumi:"enableWafFailOpen"`
 	// The provider-assigned unique ID for this managed resource.
 	Id               string                         `pulumi:"id"`
 	IdleTimeout      int                            `pulumi:"idleTimeout"`
@@ -151,6 +153,10 @@ func (o LookupLoadBalancerResultOutput) CustomerOwnedIpv4Pool() pulumi.StringOut
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.CustomerOwnedIpv4Pool }).(pulumi.StringOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) DesyncMitigationMode() pulumi.StringOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DesyncMitigationMode }).(pulumi.StringOutput)
+}
+
 func (o LookupLoadBalancerResultOutput) DnsName() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DnsName }).(pulumi.StringOutput)
 }
@@ -167,6 +173,10 @@ func (o LookupLoadBalancerResultOutput) EnableHttp2() pulumi.BoolOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.EnableHttp2 }).(pulumi.BoolOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) EnableWafFailOpen() pulumi.BoolOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.EnableWafFailOpen }).(pulumi.BoolOutput)
+}
+
 // The provider-assigned unique ID for this managed resource.
 func (o LookupLoadBalancerResultOutput) Id() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.Id }).(pulumi.StringOutput)
diff --git a/sdk/go/aws/alb/loadBalancer.go b/sdk/go/aws/alb/loadBalancer.go
index 920c0b34b72..1def914c497 100644
--- a/sdk/go/aws/alb/loadBalancer.go
+++ b/sdk/go/aws/alb/loadBalancer.go
@@ -98,6 +98,8 @@ type LoadBalancer struct {
 	ArnSuffix pulumi.StringOutput `pulumi:"arnSuffix"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrOutput `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrOutput `pulumi:"desyncMitigationMode"`
 	// The DNS name of the load balancer.
 	DnsName pulumi.StringOutput `pulumi:"dnsName"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -110,6 +112,8 @@ type LoadBalancer struct {
 	EnableDeletionProtection pulumi.BoolPtrOutput `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrOutput `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrOutput `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrOutput `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -132,7 +136,7 @@ type LoadBalancer struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayOutput `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapOutput `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
@@ -185,6 +189,8 @@ type loadBalancerState struct {
 	ArnSuffix *string `pulumi:"arnSuffix"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool *string `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// The DNS name of the load balancer.
 	DnsName *string `pulumi:"dnsName"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -197,6 +203,8 @@ type loadBalancerState struct {
 	EnableDeletionProtection *bool `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 *bool `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen *bool `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout *int `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -219,7 +227,7 @@ type loadBalancerState struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets []string `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll map[string]string `pulumi:"tagsAll"`
@@ -238,6 +246,8 @@ type LoadBalancerState struct {
 	ArnSuffix pulumi.StringPtrInput
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// The DNS name of the load balancer.
 	DnsName pulumi.StringPtrInput
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -250,6 +260,8 @@ type LoadBalancerState struct {
 	EnableDeletionProtection pulumi.BoolPtrInput
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrInput
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrInput
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrInput
 	// If true, the LB will be internal.
@@ -272,7 +284,7 @@ type LoadBalancerState struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayInput
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll pulumi.StringMapInput
@@ -291,6 +303,8 @@ type loadBalancerArgs struct {
 	AccessLogs *LoadBalancerAccessLogs `pulumi:"accessLogs"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool *string `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 	DropInvalidHeaderFields *bool `pulumi:"dropInvalidHeaderFields"`
 	// If true, cross-zone load balancing of the load balancer will be enabled.
@@ -301,6 +315,8 @@ type loadBalancerArgs struct {
 	EnableDeletionProtection *bool `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 *bool `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen *bool `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout *int `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -323,7 +339,7 @@ type loadBalancerArgs struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets []string `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 }
 
@@ -333,6 +349,8 @@ type LoadBalancerArgs struct {
 	AccessLogs LoadBalancerAccessLogsPtrInput
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 	DropInvalidHeaderFields pulumi.BoolPtrInput
 	// If true, cross-zone load balancing of the load balancer will be enabled.
@@ -343,6 +361,8 @@ type LoadBalancerArgs struct {
 	EnableDeletionProtection pulumi.BoolPtrInput
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrInput
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrInput
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrInput
 	// If true, the LB will be internal.
@@ -365,7 +385,7 @@ type LoadBalancerArgs struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayInput
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 }
 
diff --git a/sdk/go/aws/applicationloadbalancing/getLoadBalancer.go b/sdk/go/aws/applicationloadbalancing/getLoadBalancer.go
index 93ef6e77c60..81f166783d8 100644
--- a/sdk/go/aws/applicationloadbalancing/getLoadBalancer.go
+++ b/sdk/go/aws/applicationloadbalancing/getLoadBalancer.go
@@ -80,10 +80,12 @@ type LookupLoadBalancerResult struct {
 	Arn                      string                    `pulumi:"arn"`
 	ArnSuffix                string                    `pulumi:"arnSuffix"`
 	CustomerOwnedIpv4Pool    string                    `pulumi:"customerOwnedIpv4Pool"`
+	DesyncMitigationMode     string                    `pulumi:"desyncMitigationMode"`
 	DnsName                  string                    `pulumi:"dnsName"`
 	DropInvalidHeaderFields  bool                      `pulumi:"dropInvalidHeaderFields"`
 	EnableDeletionProtection bool                      `pulumi:"enableDeletionProtection"`
 	EnableHttp2              bool                      `pulumi:"enableHttp2"`
+	EnableWafFailOpen        bool                      `pulumi:"enableWafFailOpen"`
 	// The provider-assigned unique ID for this managed resource.
 	Id               string                         `pulumi:"id"`
 	IdleTimeout      int                            `pulumi:"idleTimeout"`
@@ -153,6 +155,10 @@ func (o LookupLoadBalancerResultOutput) CustomerOwnedIpv4Pool() pulumi.StringOut
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.CustomerOwnedIpv4Pool }).(pulumi.StringOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) DesyncMitigationMode() pulumi.StringOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DesyncMitigationMode }).(pulumi.StringOutput)
+}
+
 func (o LookupLoadBalancerResultOutput) DnsName() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DnsName }).(pulumi.StringOutput)
 }
@@ -169,6 +175,10 @@ func (o LookupLoadBalancerResultOutput) EnableHttp2() pulumi.BoolOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.EnableHttp2 }).(pulumi.BoolOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) EnableWafFailOpen() pulumi.BoolOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.EnableWafFailOpen }).(pulumi.BoolOutput)
+}
+
 // The provider-assigned unique ID for this managed resource.
 func (o LookupLoadBalancerResultOutput) Id() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.Id }).(pulumi.StringOutput)
diff --git a/sdk/go/aws/applicationloadbalancing/loadBalancer.go b/sdk/go/aws/applicationloadbalancing/loadBalancer.go
index 67b8f2b6cb9..1986ef500b9 100644
--- a/sdk/go/aws/applicationloadbalancing/loadBalancer.go
+++ b/sdk/go/aws/applicationloadbalancing/loadBalancer.go
@@ -100,6 +100,8 @@ type LoadBalancer struct {
 	ArnSuffix pulumi.StringOutput `pulumi:"arnSuffix"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrOutput `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrOutput `pulumi:"desyncMitigationMode"`
 	// The DNS name of the load balancer.
 	DnsName pulumi.StringOutput `pulumi:"dnsName"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -112,6 +114,8 @@ type LoadBalancer struct {
 	EnableDeletionProtection pulumi.BoolPtrOutput `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrOutput `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrOutput `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrOutput `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -134,7 +138,7 @@ type LoadBalancer struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayOutput `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapOutput `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
@@ -181,6 +185,8 @@ type loadBalancerState struct {
 	ArnSuffix *string `pulumi:"arnSuffix"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool *string `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// The DNS name of the load balancer.
 	DnsName *string `pulumi:"dnsName"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -193,6 +199,8 @@ type loadBalancerState struct {
 	EnableDeletionProtection *bool `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 *bool `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen *bool `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout *int `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -215,7 +223,7 @@ type loadBalancerState struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets []string `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll map[string]string `pulumi:"tagsAll"`
@@ -234,6 +242,8 @@ type LoadBalancerState struct {
 	ArnSuffix pulumi.StringPtrInput
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// The DNS name of the load balancer.
 	DnsName pulumi.StringPtrInput
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -246,6 +256,8 @@ type LoadBalancerState struct {
 	EnableDeletionProtection pulumi.BoolPtrInput
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrInput
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrInput
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrInput
 	// If true, the LB will be internal.
@@ -268,7 +280,7 @@ type LoadBalancerState struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayInput
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll pulumi.StringMapInput
@@ -287,6 +299,8 @@ type loadBalancerArgs struct {
 	AccessLogs *LoadBalancerAccessLogs `pulumi:"accessLogs"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool *string `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 	DropInvalidHeaderFields *bool `pulumi:"dropInvalidHeaderFields"`
 	// If true, cross-zone load balancing of the load balancer will be enabled.
@@ -297,6 +311,8 @@ type loadBalancerArgs struct {
 	EnableDeletionProtection *bool `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 *bool `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen *bool `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout *int `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -319,7 +335,7 @@ type loadBalancerArgs struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets []string `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 }
 
@@ -329,6 +345,8 @@ type LoadBalancerArgs struct {
 	AccessLogs LoadBalancerAccessLogsPtrInput
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 	DropInvalidHeaderFields pulumi.BoolPtrInput
 	// If true, cross-zone load balancing of the load balancer will be enabled.
@@ -339,6 +357,8 @@ type LoadBalancerArgs struct {
 	EnableDeletionProtection pulumi.BoolPtrInput
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrInput
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrInput
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrInput
 	// If true, the LB will be internal.
@@ -361,7 +381,7 @@ type LoadBalancerArgs struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayInput
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 }
 
diff --git a/sdk/go/aws/apprunner/pulumiTypes.go b/sdk/go/aws/apprunner/pulumiTypes.go
index fa3bc9c2c2c..96851bed7cf 100644
--- a/sdk/go/aws/apprunner/pulumiTypes.go
+++ b/sdk/go/aws/apprunner/pulumiTypes.go
@@ -507,7 +507,7 @@ type ServiceInstanceConfiguration struct {
 	// The number of CPU units reserved for each instance of your App Runner service represented as a String. Defaults to `1024`. Valid values: `1024|2048|(1|2) vCPU`.
 	Cpu *string `pulumi:"cpu"`
 	// The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
-	InstanceRoleArn string `pulumi:"instanceRoleArn"`
+	InstanceRoleArn *string `pulumi:"instanceRoleArn"`
 	// The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
 	Memory *string `pulumi:"memory"`
 }
@@ -527,7 +527,7 @@ type ServiceInstanceConfigurationArgs struct {
 	// The number of CPU units reserved for each instance of your App Runner service represented as a String. Defaults to `1024`. Valid values: `1024|2048|(1|2) vCPU`.
 	Cpu pulumi.StringPtrInput `pulumi:"cpu"`
 	// The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
-	InstanceRoleArn pulumi.StringInput `pulumi:"instanceRoleArn"`
+	InstanceRoleArn pulumi.StringPtrInput `pulumi:"instanceRoleArn"`
 	// The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
 	Memory pulumi.StringPtrInput `pulumi:"memory"`
 }
@@ -615,8 +615,8 @@ func (o ServiceInstanceConfigurationOutput) Cpu() pulumi.StringPtrOutput {
 }
 
 // The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
-func (o ServiceInstanceConfigurationOutput) InstanceRoleArn() pulumi.StringOutput {
-	return o.ApplyT(func(v ServiceInstanceConfiguration) string { return v.InstanceRoleArn }).(pulumi.StringOutput)
+func (o ServiceInstanceConfigurationOutput) InstanceRoleArn() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v ServiceInstanceConfiguration) *string { return v.InstanceRoleArn }).(pulumi.StringPtrOutput)
 }
 
 // The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
@@ -664,7 +664,7 @@ func (o ServiceInstanceConfigurationPtrOutput) InstanceRoleArn() pulumi.StringPt
 		if v == nil {
 			return nil
 		}
-		return &v.InstanceRoleArn
+		return v.InstanceRoleArn
 	}).(pulumi.StringPtrOutput)
 }
 
diff --git a/sdk/go/aws/appstream/fleetStackAssociation.go b/sdk/go/aws/appstream/fleetStackAssociation.go
new file mode 100644
index 00000000000..a172ae2d7db
--- /dev/null
+++ b/sdk/go/aws/appstream/fleetStackAssociation.go
@@ -0,0 +1,336 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package appstream
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/pkg/errors"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+// Manages an AppStream Fleet Stack association.
+//
+// ## Example Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/appstream"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		exampleFleet, err := appstream.NewFleet(ctx, "exampleFleet", &appstream.FleetArgs{
+// 			ImageName:    pulumi.String("Amazon-AppStream2-Sample-Image-02-04-2019"),
+// 			InstanceType: pulumi.String("stream.standard.small"),
+// 			ComputeCapacity: &appstream.FleetComputeCapacityArgs{
+// 				DesiredInstances: pulumi.Int(1),
+// 			},
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		exampleStack, err := appstream.NewStack(ctx, "exampleStack", nil)
+// 		if err != nil {
+// 			return err
+// 		}
+// 		_, err = appstream.NewFleetStackAssociation(ctx, "exampleFleetStackAssociation", &appstream.FleetStackAssociationArgs{
+// 			FleetName: exampleFleet.Name,
+// 			StackName: exampleStack.Name,
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+//
+// ## Import
+//
+// AppStream Stack Fleet Association can be imported by using the `fleet_name` and `stack_name` separated by a slash (`/`), e.g.,
+//
+// ```sh
+//  $ pulumi import aws:appstream/fleetStackAssociation:FleetStackAssociation example fleetName/stackName
+// ```
+type FleetStackAssociation struct {
+	pulumi.CustomResourceState
+
+	// Name of the fleet.
+	FleetName pulumi.StringOutput `pulumi:"fleetName"`
+	// Name of the stack.
+	StackName pulumi.StringOutput `pulumi:"stackName"`
+}
+
+// NewFleetStackAssociation registers a new resource with the given unique name, arguments, and options.
+func NewFleetStackAssociation(ctx *pulumi.Context,
+	name string, args *FleetStackAssociationArgs, opts ...pulumi.ResourceOption) (*FleetStackAssociation, error) {
+	if args == nil {
+		return nil, errors.New("missing one or more required arguments")
+	}
+
+	if args.FleetName == nil {
+		return nil, errors.New("invalid value for required argument 'FleetName'")
+	}
+	if args.StackName == nil {
+		return nil, errors.New("invalid value for required argument 'StackName'")
+	}
+	var resource FleetStackAssociation
+	err := ctx.RegisterResource("aws:appstream/fleetStackAssociation:FleetStackAssociation", name, args, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// GetFleetStackAssociation gets an existing FleetStackAssociation resource's state with the given name, ID, and optional
+// state properties that are used to uniquely qualify the lookup (nil if not required).
+func GetFleetStackAssociation(ctx *pulumi.Context,
+	name string, id pulumi.IDInput, state *FleetStackAssociationState, opts ...pulumi.ResourceOption) (*FleetStackAssociation, error) {
+	var resource FleetStackAssociation
+	err := ctx.ReadResource("aws:appstream/fleetStackAssociation:FleetStackAssociation", name, id, state, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// Input properties used for looking up and filtering FleetStackAssociation resources.
+type fleetStackAssociationState struct {
+	// Name of the fleet.
+	FleetName *string `pulumi:"fleetName"`
+	// Name of the stack.
+	StackName *string `pulumi:"stackName"`
+}
+
+type FleetStackAssociationState struct {
+	// Name of the fleet.
+	FleetName pulumi.StringPtrInput
+	// Name of the stack.
+	StackName pulumi.StringPtrInput
+}
+
+func (FleetStackAssociationState) ElementType() reflect.Type {
+	return reflect.TypeOf((*fleetStackAssociationState)(nil)).Elem()
+}
+
+type fleetStackAssociationArgs struct {
+	// Name of the fleet.
+	FleetName string `pulumi:"fleetName"`
+	// Name of the stack.
+	StackName string `pulumi:"stackName"`
+}
+
+// The set of arguments for constructing a FleetStackAssociation resource.
+type FleetStackAssociationArgs struct {
+	// Name of the fleet.
+	FleetName pulumi.StringInput
+	// Name of the stack.
+	StackName pulumi.StringInput
+}
+
+func (FleetStackAssociationArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*fleetStackAssociationArgs)(nil)).Elem()
+}
+
+type FleetStackAssociationInput interface {
+	pulumi.Input
+
+	ToFleetStackAssociationOutput() FleetStackAssociationOutput
+	ToFleetStackAssociationOutputWithContext(ctx context.Context) FleetStackAssociationOutput
+}
+
+func (*FleetStackAssociation) ElementType() reflect.Type {
+	return reflect.TypeOf((*FleetStackAssociation)(nil))
+}
+
+func (i *FleetStackAssociation) ToFleetStackAssociationOutput() FleetStackAssociationOutput {
+	return i.ToFleetStackAssociationOutputWithContext(context.Background())
+}
+
+func (i *FleetStackAssociation) ToFleetStackAssociationOutputWithContext(ctx context.Context) FleetStackAssociationOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(FleetStackAssociationOutput)
+}
+
+func (i *FleetStackAssociation) ToFleetStackAssociationPtrOutput() FleetStackAssociationPtrOutput {
+	return i.ToFleetStackAssociationPtrOutputWithContext(context.Background())
+}
+
+func (i *FleetStackAssociation) ToFleetStackAssociationPtrOutputWithContext(ctx context.Context) FleetStackAssociationPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(FleetStackAssociationPtrOutput)
+}
+
+type FleetStackAssociationPtrInput interface {
+	pulumi.Input
+
+	ToFleetStackAssociationPtrOutput() FleetStackAssociationPtrOutput
+	ToFleetStackAssociationPtrOutputWithContext(ctx context.Context) FleetStackAssociationPtrOutput
+}
+
+type fleetStackAssociationPtrType FleetStackAssociationArgs
+
+func (*fleetStackAssociationPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**FleetStackAssociation)(nil))
+}
+
+func (i *fleetStackAssociationPtrType) ToFleetStackAssociationPtrOutput() FleetStackAssociationPtrOutput {
+	return i.ToFleetStackAssociationPtrOutputWithContext(context.Background())
+}
+
+func (i *fleetStackAssociationPtrType) ToFleetStackAssociationPtrOutputWithContext(ctx context.Context) FleetStackAssociationPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(FleetStackAssociationPtrOutput)
+}
+
+// FleetStackAssociationArrayInput is an input type that accepts FleetStackAssociationArray and FleetStackAssociationArrayOutput values.
+// You can construct a concrete instance of `FleetStackAssociationArrayInput` via:
+//
+//          FleetStackAssociationArray{ FleetStackAssociationArgs{...} }
+type FleetStackAssociationArrayInput interface {
+	pulumi.Input
+
+	ToFleetStackAssociationArrayOutput() FleetStackAssociationArrayOutput
+	ToFleetStackAssociationArrayOutputWithContext(context.Context) FleetStackAssociationArrayOutput
+}
+
+type FleetStackAssociationArray []FleetStackAssociationInput
+
+func (FleetStackAssociationArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]*FleetStackAssociation)(nil)).Elem()
+}
+
+func (i FleetStackAssociationArray) ToFleetStackAssociationArrayOutput() FleetStackAssociationArrayOutput {
+	return i.ToFleetStackAssociationArrayOutputWithContext(context.Background())
+}
+
+func (i FleetStackAssociationArray) ToFleetStackAssociationArrayOutputWithContext(ctx context.Context) FleetStackAssociationArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(FleetStackAssociationArrayOutput)
+}
+
+// FleetStackAssociationMapInput is an input type that accepts FleetStackAssociationMap and FleetStackAssociationMapOutput values.
+// You can construct a concrete instance of `FleetStackAssociationMapInput` via:
+//
+//          FleetStackAssociationMap{ "key": FleetStackAssociationArgs{...} }
+type FleetStackAssociationMapInput interface {
+	pulumi.Input
+
+	ToFleetStackAssociationMapOutput() FleetStackAssociationMapOutput
+	ToFleetStackAssociationMapOutputWithContext(context.Context) FleetStackAssociationMapOutput
+}
+
+type FleetStackAssociationMap map[string]FleetStackAssociationInput
+
+func (FleetStackAssociationMap) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]*FleetStackAssociation)(nil)).Elem()
+}
+
+func (i FleetStackAssociationMap) ToFleetStackAssociationMapOutput() FleetStackAssociationMapOutput {
+	return i.ToFleetStackAssociationMapOutputWithContext(context.Background())
+}
+
+func (i FleetStackAssociationMap) ToFleetStackAssociationMapOutputWithContext(ctx context.Context) FleetStackAssociationMapOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(FleetStackAssociationMapOutput)
+}
+
+type FleetStackAssociationOutput struct{ *pulumi.OutputState }
+
+func (FleetStackAssociationOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*FleetStackAssociation)(nil))
+}
+
+func (o FleetStackAssociationOutput) ToFleetStackAssociationOutput() FleetStackAssociationOutput {
+	return o
+}
+
+func (o FleetStackAssociationOutput) ToFleetStackAssociationOutputWithContext(ctx context.Context) FleetStackAssociationOutput {
+	return o
+}
+
+func (o FleetStackAssociationOutput) ToFleetStackAssociationPtrOutput() FleetStackAssociationPtrOutput {
+	return o.ToFleetStackAssociationPtrOutputWithContext(context.Background())
+}
+
+func (o FleetStackAssociationOutput) ToFleetStackAssociationPtrOutputWithContext(ctx context.Context) FleetStackAssociationPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v FleetStackAssociation) *FleetStackAssociation {
+		return &v
+	}).(FleetStackAssociationPtrOutput)
+}
+
+type FleetStackAssociationPtrOutput struct{ *pulumi.OutputState }
+
+func (FleetStackAssociationPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**FleetStackAssociation)(nil))
+}
+
+func (o FleetStackAssociationPtrOutput) ToFleetStackAssociationPtrOutput() FleetStackAssociationPtrOutput {
+	return o
+}
+
+func (o FleetStackAssociationPtrOutput) ToFleetStackAssociationPtrOutputWithContext(ctx context.Context) FleetStackAssociationPtrOutput {
+	return o
+}
+
+func (o FleetStackAssociationPtrOutput) Elem() FleetStackAssociationOutput {
+	return o.ApplyT(func(v *FleetStackAssociation) FleetStackAssociation {
+		if v != nil {
+			return *v
+		}
+		var ret FleetStackAssociation
+		return ret
+	}).(FleetStackAssociationOutput)
+}
+
+type FleetStackAssociationArrayOutput struct{ *pulumi.OutputState }
+
+func (FleetStackAssociationArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]FleetStackAssociation)(nil))
+}
+
+func (o FleetStackAssociationArrayOutput) ToFleetStackAssociationArrayOutput() FleetStackAssociationArrayOutput {
+	return o
+}
+
+func (o FleetStackAssociationArrayOutput) ToFleetStackAssociationArrayOutputWithContext(ctx context.Context) FleetStackAssociationArrayOutput {
+	return o
+}
+
+func (o FleetStackAssociationArrayOutput) Index(i pulumi.IntInput) FleetStackAssociationOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) FleetStackAssociation {
+		return vs[0].([]FleetStackAssociation)[vs[1].(int)]
+	}).(FleetStackAssociationOutput)
+}
+
+type FleetStackAssociationMapOutput struct{ *pulumi.OutputState }
+
+func (FleetStackAssociationMapOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]FleetStackAssociation)(nil))
+}
+
+func (o FleetStackAssociationMapOutput) ToFleetStackAssociationMapOutput() FleetStackAssociationMapOutput {
+	return o
+}
+
+func (o FleetStackAssociationMapOutput) ToFleetStackAssociationMapOutputWithContext(ctx context.Context) FleetStackAssociationMapOutput {
+	return o
+}
+
+func (o FleetStackAssociationMapOutput) MapIndex(k pulumi.StringInput) FleetStackAssociationOutput {
+	return pulumi.All(o, k).ApplyT(func(vs []interface{}) FleetStackAssociation {
+		return vs[0].(map[string]FleetStackAssociation)[vs[1].(string)]
+	}).(FleetStackAssociationOutput)
+}
+
+func init() {
+	pulumi.RegisterInputType(reflect.TypeOf((*FleetStackAssociationInput)(nil)).Elem(), &FleetStackAssociation{})
+	pulumi.RegisterInputType(reflect.TypeOf((*FleetStackAssociationPtrInput)(nil)).Elem(), &FleetStackAssociation{})
+	pulumi.RegisterInputType(reflect.TypeOf((*FleetStackAssociationArrayInput)(nil)).Elem(), FleetStackAssociationArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*FleetStackAssociationMapInput)(nil)).Elem(), FleetStackAssociationMap{})
+	pulumi.RegisterOutputType(FleetStackAssociationOutput{})
+	pulumi.RegisterOutputType(FleetStackAssociationPtrOutput{})
+	pulumi.RegisterOutputType(FleetStackAssociationArrayOutput{})
+	pulumi.RegisterOutputType(FleetStackAssociationMapOutput{})
+}
diff --git a/sdk/go/aws/appstream/init.go b/sdk/go/aws/appstream/init.go
index fde39f1136a..6b99d160b4c 100644
--- a/sdk/go/aws/appstream/init.go
+++ b/sdk/go/aws/appstream/init.go
@@ -25,10 +25,16 @@ func (m *module) Construct(ctx *pulumi.Context, name, typ, urn string) (r pulumi
 		r = &DirectoryConfig{}
 	case "aws:appstream/fleet:Fleet":
 		r = &Fleet{}
+	case "aws:appstream/fleetStackAssociation:FleetStackAssociation":
+		r = &FleetStackAssociation{}
 	case "aws:appstream/imageBuilder:ImageBuilder":
 		r = &ImageBuilder{}
 	case "aws:appstream/stack:Stack":
 		r = &Stack{}
+	case "aws:appstream/user:User":
+		r = &User{}
+	case "aws:appstream/userStackAssociation:UserStackAssociation":
+		r = &UserStackAssociation{}
 	default:
 		return nil, fmt.Errorf("unknown resource type: %s", typ)
 	}
@@ -52,6 +58,11 @@ func init() {
 		"appstream/fleet",
 		&module{version},
 	)
+	pulumi.RegisterResourceModule(
+		"aws",
+		"appstream/fleetStackAssociation",
+		&module{version},
+	)
 	pulumi.RegisterResourceModule(
 		"aws",
 		"appstream/imageBuilder",
@@ -62,4 +73,14 @@ func init() {
 		"appstream/stack",
 		&module{version},
 	)
+	pulumi.RegisterResourceModule(
+		"aws",
+		"appstream/user",
+		&module{version},
+	)
+	pulumi.RegisterResourceModule(
+		"aws",
+		"appstream/userStackAssociation",
+		&module{version},
+	)
 }
diff --git a/sdk/go/aws/appstream/user.go b/sdk/go/aws/appstream/user.go
new file mode 100644
index 00000000000..ce5ccfc770c
--- /dev/null
+++ b/sdk/go/aws/appstream/user.go
@@ -0,0 +1,376 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package appstream
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/pkg/errors"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+// Provides an AppStream user.
+//
+// ## Example Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/appstream"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		_, err := appstream.NewUser(ctx, "example", &appstream.UserArgs{
+// 			AuthenticationType: pulumi.String("USERPOOL"),
+// 			FirstName:          pulumi.String("FIRST NAME"),
+// 			LastName:           pulumi.String("LAST NAME"),
+// 			UserName:           pulumi.String("EMAIL ADDRESS"),
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+//
+// ## Import
+//
+// `aws_appstream_user` can be imported using the `user_name` and `authentication_type` separated by a slash (`/`), e.g.,
+//
+// ```sh
+//  $ pulumi import aws:appstream/user:User example UserName/AuthenticationType
+// ```
+type User struct {
+	pulumi.CustomResourceState
+
+	// ARN of the appstream user.
+	Arn pulumi.StringOutput `pulumi:"arn"`
+	// Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+	AuthenticationType pulumi.StringOutput `pulumi:"authenticationType"`
+	// Date and time, in UTC and extended RFC 3339 format, when the user was created.
+	CreatedTime pulumi.StringOutput `pulumi:"createdTime"`
+	// Specifies whether the user in the user pool is enabled.
+	Enabled pulumi.BoolPtrOutput `pulumi:"enabled"`
+	// First name, or given name, of the user.
+	FirstName pulumi.StringPtrOutput `pulumi:"firstName"`
+	// Last name, or surname, of the user.
+	LastName pulumi.StringPtrOutput `pulumi:"lastName"`
+	// Send an email notification.
+	SendEmailNotification pulumi.BoolPtrOutput `pulumi:"sendEmailNotification"`
+	// Email address of the user.
+	UserName pulumi.StringOutput `pulumi:"userName"`
+}
+
+// NewUser registers a new resource with the given unique name, arguments, and options.
+func NewUser(ctx *pulumi.Context,
+	name string, args *UserArgs, opts ...pulumi.ResourceOption) (*User, error) {
+	if args == nil {
+		return nil, errors.New("missing one or more required arguments")
+	}
+
+	if args.AuthenticationType == nil {
+		return nil, errors.New("invalid value for required argument 'AuthenticationType'")
+	}
+	if args.UserName == nil {
+		return nil, errors.New("invalid value for required argument 'UserName'")
+	}
+	var resource User
+	err := ctx.RegisterResource("aws:appstream/user:User", name, args, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// GetUser gets an existing User resource's state with the given name, ID, and optional
+// state properties that are used to uniquely qualify the lookup (nil if not required).
+func GetUser(ctx *pulumi.Context,
+	name string, id pulumi.IDInput, state *UserState, opts ...pulumi.ResourceOption) (*User, error) {
+	var resource User
+	err := ctx.ReadResource("aws:appstream/user:User", name, id, state, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// Input properties used for looking up and filtering User resources.
+type userState struct {
+	// ARN of the appstream user.
+	Arn *string `pulumi:"arn"`
+	// Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+	AuthenticationType *string `pulumi:"authenticationType"`
+	// Date and time, in UTC and extended RFC 3339 format, when the user was created.
+	CreatedTime *string `pulumi:"createdTime"`
+	// Specifies whether the user in the user pool is enabled.
+	Enabled *bool `pulumi:"enabled"`
+	// First name, or given name, of the user.
+	FirstName *string `pulumi:"firstName"`
+	// Last name, or surname, of the user.
+	LastName *string `pulumi:"lastName"`
+	// Send an email notification.
+	SendEmailNotification *bool `pulumi:"sendEmailNotification"`
+	// Email address of the user.
+	UserName *string `pulumi:"userName"`
+}
+
+type UserState struct {
+	// ARN of the appstream user.
+	Arn pulumi.StringPtrInput
+	// Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+	AuthenticationType pulumi.StringPtrInput
+	// Date and time, in UTC and extended RFC 3339 format, when the user was created.
+	CreatedTime pulumi.StringPtrInput
+	// Specifies whether the user in the user pool is enabled.
+	Enabled pulumi.BoolPtrInput
+	// First name, or given name, of the user.
+	FirstName pulumi.StringPtrInput
+	// Last name, or surname, of the user.
+	LastName pulumi.StringPtrInput
+	// Send an email notification.
+	SendEmailNotification pulumi.BoolPtrInput
+	// Email address of the user.
+	UserName pulumi.StringPtrInput
+}
+
+func (UserState) ElementType() reflect.Type {
+	return reflect.TypeOf((*userState)(nil)).Elem()
+}
+
+type userArgs struct {
+	// Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+	AuthenticationType string `pulumi:"authenticationType"`
+	// Specifies whether the user in the user pool is enabled.
+	Enabled *bool `pulumi:"enabled"`
+	// First name, or given name, of the user.
+	FirstName *string `pulumi:"firstName"`
+	// Last name, or surname, of the user.
+	LastName *string `pulumi:"lastName"`
+	// Send an email notification.
+	SendEmailNotification *bool `pulumi:"sendEmailNotification"`
+	// Email address of the user.
+	UserName string `pulumi:"userName"`
+}
+
+// The set of arguments for constructing a User resource.
+type UserArgs struct {
+	// Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+	AuthenticationType pulumi.StringInput
+	// Specifies whether the user in the user pool is enabled.
+	Enabled pulumi.BoolPtrInput
+	// First name, or given name, of the user.
+	FirstName pulumi.StringPtrInput
+	// Last name, or surname, of the user.
+	LastName pulumi.StringPtrInput
+	// Send an email notification.
+	SendEmailNotification pulumi.BoolPtrInput
+	// Email address of the user.
+	UserName pulumi.StringInput
+}
+
+func (UserArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*userArgs)(nil)).Elem()
+}
+
+type UserInput interface {
+	pulumi.Input
+
+	ToUserOutput() UserOutput
+	ToUserOutputWithContext(ctx context.Context) UserOutput
+}
+
+func (*User) ElementType() reflect.Type {
+	return reflect.TypeOf((*User)(nil))
+}
+
+func (i *User) ToUserOutput() UserOutput {
+	return i.ToUserOutputWithContext(context.Background())
+}
+
+func (i *User) ToUserOutputWithContext(ctx context.Context) UserOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserOutput)
+}
+
+func (i *User) ToUserPtrOutput() UserPtrOutput {
+	return i.ToUserPtrOutputWithContext(context.Background())
+}
+
+func (i *User) ToUserPtrOutputWithContext(ctx context.Context) UserPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserPtrOutput)
+}
+
+type UserPtrInput interface {
+	pulumi.Input
+
+	ToUserPtrOutput() UserPtrOutput
+	ToUserPtrOutputWithContext(ctx context.Context) UserPtrOutput
+}
+
+type userPtrType UserArgs
+
+func (*userPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**User)(nil))
+}
+
+func (i *userPtrType) ToUserPtrOutput() UserPtrOutput {
+	return i.ToUserPtrOutputWithContext(context.Background())
+}
+
+func (i *userPtrType) ToUserPtrOutputWithContext(ctx context.Context) UserPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserPtrOutput)
+}
+
+// UserArrayInput is an input type that accepts UserArray and UserArrayOutput values.
+// You can construct a concrete instance of `UserArrayInput` via:
+//
+//          UserArray{ UserArgs{...} }
+type UserArrayInput interface {
+	pulumi.Input
+
+	ToUserArrayOutput() UserArrayOutput
+	ToUserArrayOutputWithContext(context.Context) UserArrayOutput
+}
+
+type UserArray []UserInput
+
+func (UserArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]*User)(nil)).Elem()
+}
+
+func (i UserArray) ToUserArrayOutput() UserArrayOutput {
+	return i.ToUserArrayOutputWithContext(context.Background())
+}
+
+func (i UserArray) ToUserArrayOutputWithContext(ctx context.Context) UserArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserArrayOutput)
+}
+
+// UserMapInput is an input type that accepts UserMap and UserMapOutput values.
+// You can construct a concrete instance of `UserMapInput` via:
+//
+//          UserMap{ "key": UserArgs{...} }
+type UserMapInput interface {
+	pulumi.Input
+
+	ToUserMapOutput() UserMapOutput
+	ToUserMapOutputWithContext(context.Context) UserMapOutput
+}
+
+type UserMap map[string]UserInput
+
+func (UserMap) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]*User)(nil)).Elem()
+}
+
+func (i UserMap) ToUserMapOutput() UserMapOutput {
+	return i.ToUserMapOutputWithContext(context.Background())
+}
+
+func (i UserMap) ToUserMapOutputWithContext(ctx context.Context) UserMapOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserMapOutput)
+}
+
+type UserOutput struct{ *pulumi.OutputState }
+
+func (UserOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*User)(nil))
+}
+
+func (o UserOutput) ToUserOutput() UserOutput {
+	return o
+}
+
+func (o UserOutput) ToUserOutputWithContext(ctx context.Context) UserOutput {
+	return o
+}
+
+func (o UserOutput) ToUserPtrOutput() UserPtrOutput {
+	return o.ToUserPtrOutputWithContext(context.Background())
+}
+
+func (o UserOutput) ToUserPtrOutputWithContext(ctx context.Context) UserPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v User) *User {
+		return &v
+	}).(UserPtrOutput)
+}
+
+type UserPtrOutput struct{ *pulumi.OutputState }
+
+func (UserPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**User)(nil))
+}
+
+func (o UserPtrOutput) ToUserPtrOutput() UserPtrOutput {
+	return o
+}
+
+func (o UserPtrOutput) ToUserPtrOutputWithContext(ctx context.Context) UserPtrOutput {
+	return o
+}
+
+func (o UserPtrOutput) Elem() UserOutput {
+	return o.ApplyT(func(v *User) User {
+		if v != nil {
+			return *v
+		}
+		var ret User
+		return ret
+	}).(UserOutput)
+}
+
+type UserArrayOutput struct{ *pulumi.OutputState }
+
+func (UserArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]User)(nil))
+}
+
+func (o UserArrayOutput) ToUserArrayOutput() UserArrayOutput {
+	return o
+}
+
+func (o UserArrayOutput) ToUserArrayOutputWithContext(ctx context.Context) UserArrayOutput {
+	return o
+}
+
+func (o UserArrayOutput) Index(i pulumi.IntInput) UserOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) User {
+		return vs[0].([]User)[vs[1].(int)]
+	}).(UserOutput)
+}
+
+type UserMapOutput struct{ *pulumi.OutputState }
+
+func (UserMapOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]User)(nil))
+}
+
+func (o UserMapOutput) ToUserMapOutput() UserMapOutput {
+	return o
+}
+
+func (o UserMapOutput) ToUserMapOutputWithContext(ctx context.Context) UserMapOutput {
+	return o
+}
+
+func (o UserMapOutput) MapIndex(k pulumi.StringInput) UserOutput {
+	return pulumi.All(o, k).ApplyT(func(vs []interface{}) User {
+		return vs[0].(map[string]User)[vs[1].(string)]
+	}).(UserOutput)
+}
+
+func init() {
+	pulumi.RegisterInputType(reflect.TypeOf((*UserInput)(nil)).Elem(), &User{})
+	pulumi.RegisterInputType(reflect.TypeOf((*UserPtrInput)(nil)).Elem(), &User{})
+	pulumi.RegisterInputType(reflect.TypeOf((*UserArrayInput)(nil)).Elem(), UserArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*UserMapInput)(nil)).Elem(), UserMap{})
+	pulumi.RegisterOutputType(UserOutput{})
+	pulumi.RegisterOutputType(UserPtrOutput{})
+	pulumi.RegisterOutputType(UserArrayOutput{})
+	pulumi.RegisterOutputType(UserMapOutput{})
+}
diff --git a/sdk/go/aws/appstream/userStackAssociation.go b/sdk/go/aws/appstream/userStackAssociation.go
new file mode 100644
index 00000000000..63e6080cd9b
--- /dev/null
+++ b/sdk/go/aws/appstream/userStackAssociation.go
@@ -0,0 +1,357 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package appstream
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/pkg/errors"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+// Manages an AppStream User Stack association.
+//
+// ## Example Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/appstream"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		testStack, err := appstream.NewStack(ctx, "testStack", nil)
+// 		if err != nil {
+// 			return err
+// 		}
+// 		testUser, err := appstream.NewUser(ctx, "testUser", &appstream.UserArgs{
+// 			AuthenticationType: pulumi.String("USERPOOL"),
+// 			UserName:           pulumi.String("EMAIL"),
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		_, err = appstream.NewUserStackAssociation(ctx, "testUserStackAssociation", &appstream.UserStackAssociationArgs{
+// 			AuthenticationType: testUser.AuthenticationType,
+// 			StackName:          testStack.Name,
+// 			UserName:           testUser.UserName,
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+//
+// ## Import
+//
+// AppStream User Stack Association can be imported by using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`), e.g.,
+//
+// ```sh
+//  $ pulumi import aws:appstream/userStackAssociation:UserStackAssociation example userName/auhtenticationType/stackName
+// ```
+type UserStackAssociation struct {
+	pulumi.CustomResourceState
+
+	// Authentication type for the user.
+	AuthenticationType pulumi.StringOutput `pulumi:"authenticationType"`
+	// Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+	SendEmailNotification pulumi.BoolPtrOutput `pulumi:"sendEmailNotification"`
+	// Name of the stack that is associated with the user.
+	StackName pulumi.StringOutput `pulumi:"stackName"`
+	// Email address of the user who is associated with the stack.
+	UserName pulumi.StringOutput `pulumi:"userName"`
+}
+
+// NewUserStackAssociation registers a new resource with the given unique name, arguments, and options.
+func NewUserStackAssociation(ctx *pulumi.Context,
+	name string, args *UserStackAssociationArgs, opts ...pulumi.ResourceOption) (*UserStackAssociation, error) {
+	if args == nil {
+		return nil, errors.New("missing one or more required arguments")
+	}
+
+	if args.AuthenticationType == nil {
+		return nil, errors.New("invalid value for required argument 'AuthenticationType'")
+	}
+	if args.StackName == nil {
+		return nil, errors.New("invalid value for required argument 'StackName'")
+	}
+	if args.UserName == nil {
+		return nil, errors.New("invalid value for required argument 'UserName'")
+	}
+	var resource UserStackAssociation
+	err := ctx.RegisterResource("aws:appstream/userStackAssociation:UserStackAssociation", name, args, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// GetUserStackAssociation gets an existing UserStackAssociation resource's state with the given name, ID, and optional
+// state properties that are used to uniquely qualify the lookup (nil if not required).
+func GetUserStackAssociation(ctx *pulumi.Context,
+	name string, id pulumi.IDInput, state *UserStackAssociationState, opts ...pulumi.ResourceOption) (*UserStackAssociation, error) {
+	var resource UserStackAssociation
+	err := ctx.ReadResource("aws:appstream/userStackAssociation:UserStackAssociation", name, id, state, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// Input properties used for looking up and filtering UserStackAssociation resources.
+type userStackAssociationState struct {
+	// Authentication type for the user.
+	AuthenticationType *string `pulumi:"authenticationType"`
+	// Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+	SendEmailNotification *bool `pulumi:"sendEmailNotification"`
+	// Name of the stack that is associated with the user.
+	StackName *string `pulumi:"stackName"`
+	// Email address of the user who is associated with the stack.
+	UserName *string `pulumi:"userName"`
+}
+
+type UserStackAssociationState struct {
+	// Authentication type for the user.
+	AuthenticationType pulumi.StringPtrInput
+	// Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+	SendEmailNotification pulumi.BoolPtrInput
+	// Name of the stack that is associated with the user.
+	StackName pulumi.StringPtrInput
+	// Email address of the user who is associated with the stack.
+	UserName pulumi.StringPtrInput
+}
+
+func (UserStackAssociationState) ElementType() reflect.Type {
+	return reflect.TypeOf((*userStackAssociationState)(nil)).Elem()
+}
+
+type userStackAssociationArgs struct {
+	// Authentication type for the user.
+	AuthenticationType string `pulumi:"authenticationType"`
+	// Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+	SendEmailNotification *bool `pulumi:"sendEmailNotification"`
+	// Name of the stack that is associated with the user.
+	StackName string `pulumi:"stackName"`
+	// Email address of the user who is associated with the stack.
+	UserName string `pulumi:"userName"`
+}
+
+// The set of arguments for constructing a UserStackAssociation resource.
+type UserStackAssociationArgs struct {
+	// Authentication type for the user.
+	AuthenticationType pulumi.StringInput
+	// Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+	SendEmailNotification pulumi.BoolPtrInput
+	// Name of the stack that is associated with the user.
+	StackName pulumi.StringInput
+	// Email address of the user who is associated with the stack.
+	UserName pulumi.StringInput
+}
+
+func (UserStackAssociationArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*userStackAssociationArgs)(nil)).Elem()
+}
+
+type UserStackAssociationInput interface {
+	pulumi.Input
+
+	ToUserStackAssociationOutput() UserStackAssociationOutput
+	ToUserStackAssociationOutputWithContext(ctx context.Context) UserStackAssociationOutput
+}
+
+func (*UserStackAssociation) ElementType() reflect.Type {
+	return reflect.TypeOf((*UserStackAssociation)(nil))
+}
+
+func (i *UserStackAssociation) ToUserStackAssociationOutput() UserStackAssociationOutput {
+	return i.ToUserStackAssociationOutputWithContext(context.Background())
+}
+
+func (i *UserStackAssociation) ToUserStackAssociationOutputWithContext(ctx context.Context) UserStackAssociationOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserStackAssociationOutput)
+}
+
+func (i *UserStackAssociation) ToUserStackAssociationPtrOutput() UserStackAssociationPtrOutput {
+	return i.ToUserStackAssociationPtrOutputWithContext(context.Background())
+}
+
+func (i *UserStackAssociation) ToUserStackAssociationPtrOutputWithContext(ctx context.Context) UserStackAssociationPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserStackAssociationPtrOutput)
+}
+
+type UserStackAssociationPtrInput interface {
+	pulumi.Input
+
+	ToUserStackAssociationPtrOutput() UserStackAssociationPtrOutput
+	ToUserStackAssociationPtrOutputWithContext(ctx context.Context) UserStackAssociationPtrOutput
+}
+
+type userStackAssociationPtrType UserStackAssociationArgs
+
+func (*userStackAssociationPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**UserStackAssociation)(nil))
+}
+
+func (i *userStackAssociationPtrType) ToUserStackAssociationPtrOutput() UserStackAssociationPtrOutput {
+	return i.ToUserStackAssociationPtrOutputWithContext(context.Background())
+}
+
+func (i *userStackAssociationPtrType) ToUserStackAssociationPtrOutputWithContext(ctx context.Context) UserStackAssociationPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserStackAssociationPtrOutput)
+}
+
+// UserStackAssociationArrayInput is an input type that accepts UserStackAssociationArray and UserStackAssociationArrayOutput values.
+// You can construct a concrete instance of `UserStackAssociationArrayInput` via:
+//
+//          UserStackAssociationArray{ UserStackAssociationArgs{...} }
+type UserStackAssociationArrayInput interface {
+	pulumi.Input
+
+	ToUserStackAssociationArrayOutput() UserStackAssociationArrayOutput
+	ToUserStackAssociationArrayOutputWithContext(context.Context) UserStackAssociationArrayOutput
+}
+
+type UserStackAssociationArray []UserStackAssociationInput
+
+func (UserStackAssociationArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]*UserStackAssociation)(nil)).Elem()
+}
+
+func (i UserStackAssociationArray) ToUserStackAssociationArrayOutput() UserStackAssociationArrayOutput {
+	return i.ToUserStackAssociationArrayOutputWithContext(context.Background())
+}
+
+func (i UserStackAssociationArray) ToUserStackAssociationArrayOutputWithContext(ctx context.Context) UserStackAssociationArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserStackAssociationArrayOutput)
+}
+
+// UserStackAssociationMapInput is an input type that accepts UserStackAssociationMap and UserStackAssociationMapOutput values.
+// You can construct a concrete instance of `UserStackAssociationMapInput` via:
+//
+//          UserStackAssociationMap{ "key": UserStackAssociationArgs{...} }
+type UserStackAssociationMapInput interface {
+	pulumi.Input
+
+	ToUserStackAssociationMapOutput() UserStackAssociationMapOutput
+	ToUserStackAssociationMapOutputWithContext(context.Context) UserStackAssociationMapOutput
+}
+
+type UserStackAssociationMap map[string]UserStackAssociationInput
+
+func (UserStackAssociationMap) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]*UserStackAssociation)(nil)).Elem()
+}
+
+func (i UserStackAssociationMap) ToUserStackAssociationMapOutput() UserStackAssociationMapOutput {
+	return i.ToUserStackAssociationMapOutputWithContext(context.Background())
+}
+
+func (i UserStackAssociationMap) ToUserStackAssociationMapOutputWithContext(ctx context.Context) UserStackAssociationMapOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(UserStackAssociationMapOutput)
+}
+
+type UserStackAssociationOutput struct{ *pulumi.OutputState }
+
+func (UserStackAssociationOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*UserStackAssociation)(nil))
+}
+
+func (o UserStackAssociationOutput) ToUserStackAssociationOutput() UserStackAssociationOutput {
+	return o
+}
+
+func (o UserStackAssociationOutput) ToUserStackAssociationOutputWithContext(ctx context.Context) UserStackAssociationOutput {
+	return o
+}
+
+func (o UserStackAssociationOutput) ToUserStackAssociationPtrOutput() UserStackAssociationPtrOutput {
+	return o.ToUserStackAssociationPtrOutputWithContext(context.Background())
+}
+
+func (o UserStackAssociationOutput) ToUserStackAssociationPtrOutputWithContext(ctx context.Context) UserStackAssociationPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v UserStackAssociation) *UserStackAssociation {
+		return &v
+	}).(UserStackAssociationPtrOutput)
+}
+
+type UserStackAssociationPtrOutput struct{ *pulumi.OutputState }
+
+func (UserStackAssociationPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**UserStackAssociation)(nil))
+}
+
+func (o UserStackAssociationPtrOutput) ToUserStackAssociationPtrOutput() UserStackAssociationPtrOutput {
+	return o
+}
+
+func (o UserStackAssociationPtrOutput) ToUserStackAssociationPtrOutputWithContext(ctx context.Context) UserStackAssociationPtrOutput {
+	return o
+}
+
+func (o UserStackAssociationPtrOutput) Elem() UserStackAssociationOutput {
+	return o.ApplyT(func(v *UserStackAssociation) UserStackAssociation {
+		if v != nil {
+			return *v
+		}
+		var ret UserStackAssociation
+		return ret
+	}).(UserStackAssociationOutput)
+}
+
+type UserStackAssociationArrayOutput struct{ *pulumi.OutputState }
+
+func (UserStackAssociationArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]UserStackAssociation)(nil))
+}
+
+func (o UserStackAssociationArrayOutput) ToUserStackAssociationArrayOutput() UserStackAssociationArrayOutput {
+	return o
+}
+
+func (o UserStackAssociationArrayOutput) ToUserStackAssociationArrayOutputWithContext(ctx context.Context) UserStackAssociationArrayOutput {
+	return o
+}
+
+func (o UserStackAssociationArrayOutput) Index(i pulumi.IntInput) UserStackAssociationOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) UserStackAssociation {
+		return vs[0].([]UserStackAssociation)[vs[1].(int)]
+	}).(UserStackAssociationOutput)
+}
+
+type UserStackAssociationMapOutput struct{ *pulumi.OutputState }
+
+func (UserStackAssociationMapOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]UserStackAssociation)(nil))
+}
+
+func (o UserStackAssociationMapOutput) ToUserStackAssociationMapOutput() UserStackAssociationMapOutput {
+	return o
+}
+
+func (o UserStackAssociationMapOutput) ToUserStackAssociationMapOutputWithContext(ctx context.Context) UserStackAssociationMapOutput {
+	return o
+}
+
+func (o UserStackAssociationMapOutput) MapIndex(k pulumi.StringInput) UserStackAssociationOutput {
+	return pulumi.All(o, k).ApplyT(func(vs []interface{}) UserStackAssociation {
+		return vs[0].(map[string]UserStackAssociation)[vs[1].(string)]
+	}).(UserStackAssociationOutput)
+}
+
+func init() {
+	pulumi.RegisterInputType(reflect.TypeOf((*UserStackAssociationInput)(nil)).Elem(), &UserStackAssociation{})
+	pulumi.RegisterInputType(reflect.TypeOf((*UserStackAssociationPtrInput)(nil)).Elem(), &UserStackAssociation{})
+	pulumi.RegisterInputType(reflect.TypeOf((*UserStackAssociationArrayInput)(nil)).Elem(), UserStackAssociationArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*UserStackAssociationMapInput)(nil)).Elem(), UserStackAssociationMap{})
+	pulumi.RegisterOutputType(UserStackAssociationOutput{})
+	pulumi.RegisterOutputType(UserStackAssociationPtrOutput{})
+	pulumi.RegisterOutputType(UserStackAssociationArrayOutput{})
+	pulumi.RegisterOutputType(UserStackAssociationMapOutput{})
+}
diff --git a/sdk/go/aws/athena/pulumiTypes.go b/sdk/go/aws/athena/pulumiTypes.go
index 96e14ad1f01..6ab84b7beab 100644
--- a/sdk/go/aws/athena/pulumiTypes.go
+++ b/sdk/go/aws/athena/pulumiTypes.go
@@ -171,6 +171,8 @@ type WorkgroupConfiguration struct {
 	BytesScannedCutoffPerQuery *int `pulumi:"bytesScannedCutoffPerQuery"`
 	// Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
 	EnforceWorkgroupConfiguration *bool `pulumi:"enforceWorkgroupConfiguration"`
+	// Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+	EngineVersion *WorkgroupConfigurationEngineVersion `pulumi:"engineVersion"`
 	// Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
 	PublishCloudwatchMetricsEnabled *bool `pulumi:"publishCloudwatchMetricsEnabled"`
 	// If set to true , allows members assigned to a workgroup to reference Amazon S3 Requester Pays buckets in queries. If set to false , workgroup members cannot query data from Requester Pays buckets, and queries that retrieve data from Requester Pays buckets cause an error. The default is false . For more information about Requester Pays buckets, see [Requester Pays Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html) in the Amazon Simple Storage Service Developer Guide.
@@ -195,6 +197,8 @@ type WorkgroupConfigurationArgs struct {
 	BytesScannedCutoffPerQuery pulumi.IntPtrInput `pulumi:"bytesScannedCutoffPerQuery"`
 	// Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
 	EnforceWorkgroupConfiguration pulumi.BoolPtrInput `pulumi:"enforceWorkgroupConfiguration"`
+	// Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+	EngineVersion WorkgroupConfigurationEngineVersionPtrInput `pulumi:"engineVersion"`
 	// Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
 	PublishCloudwatchMetricsEnabled pulumi.BoolPtrInput `pulumi:"publishCloudwatchMetricsEnabled"`
 	// If set to true , allows members assigned to a workgroup to reference Amazon S3 Requester Pays buckets in queries. If set to false , workgroup members cannot query data from Requester Pays buckets, and queries that retrieve data from Requester Pays buckets cause an error. The default is false . For more information about Requester Pays buckets, see [Requester Pays Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html) in the Amazon Simple Storage Service Developer Guide.
@@ -290,6 +294,11 @@ func (o WorkgroupConfigurationOutput) EnforceWorkgroupConfiguration() pulumi.Boo
 	return o.ApplyT(func(v WorkgroupConfiguration) *bool { return v.EnforceWorkgroupConfiguration }).(pulumi.BoolPtrOutput)
 }
 
+// Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+func (o WorkgroupConfigurationOutput) EngineVersion() WorkgroupConfigurationEngineVersionPtrOutput {
+	return o.ApplyT(func(v WorkgroupConfiguration) *WorkgroupConfigurationEngineVersion { return v.EngineVersion }).(WorkgroupConfigurationEngineVersionPtrOutput)
+}
+
 // Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
 func (o WorkgroupConfigurationOutput) PublishCloudwatchMetricsEnabled() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v WorkgroupConfiguration) *bool { return v.PublishCloudwatchMetricsEnabled }).(pulumi.BoolPtrOutput)
@@ -351,6 +360,16 @@ func (o WorkgroupConfigurationPtrOutput) EnforceWorkgroupConfiguration() pulumi.
 	}).(pulumi.BoolPtrOutput)
 }
 
+// Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+func (o WorkgroupConfigurationPtrOutput) EngineVersion() WorkgroupConfigurationEngineVersionPtrOutput {
+	return o.ApplyT(func(v *WorkgroupConfiguration) *WorkgroupConfigurationEngineVersion {
+		if v == nil {
+			return nil
+		}
+		return v.EngineVersion
+	}).(WorkgroupConfigurationEngineVersionPtrOutput)
+}
+
 // Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
 func (o WorkgroupConfigurationPtrOutput) PublishCloudwatchMetricsEnabled() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v *WorkgroupConfiguration) *bool {
@@ -381,6 +400,162 @@ func (o WorkgroupConfigurationPtrOutput) ResultConfiguration() WorkgroupConfigur
 	}).(WorkgroupConfigurationResultConfigurationPtrOutput)
 }
 
+type WorkgroupConfigurationEngineVersion struct {
+	// The engine version on which the query runs. If `selectedEngineVersion` is set to `AUTO`, the effective engine version is chosen by Athena.
+	EffectiveEngineVersion *string `pulumi:"effectiveEngineVersion"`
+	// The requested engine version. Defaults to `AUTO`.
+	SelectedEngineVersion *string `pulumi:"selectedEngineVersion"`
+}
+
+// WorkgroupConfigurationEngineVersionInput is an input type that accepts WorkgroupConfigurationEngineVersionArgs and WorkgroupConfigurationEngineVersionOutput values.
+// You can construct a concrete instance of `WorkgroupConfigurationEngineVersionInput` via:
+//
+//          WorkgroupConfigurationEngineVersionArgs{...}
+type WorkgroupConfigurationEngineVersionInput interface {
+	pulumi.Input
+
+	ToWorkgroupConfigurationEngineVersionOutput() WorkgroupConfigurationEngineVersionOutput
+	ToWorkgroupConfigurationEngineVersionOutputWithContext(context.Context) WorkgroupConfigurationEngineVersionOutput
+}
+
+type WorkgroupConfigurationEngineVersionArgs struct {
+	// The engine version on which the query runs. If `selectedEngineVersion` is set to `AUTO`, the effective engine version is chosen by Athena.
+	EffectiveEngineVersion pulumi.StringPtrInput `pulumi:"effectiveEngineVersion"`
+	// The requested engine version. Defaults to `AUTO`.
+	SelectedEngineVersion pulumi.StringPtrInput `pulumi:"selectedEngineVersion"`
+}
+
+func (WorkgroupConfigurationEngineVersionArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WorkgroupConfigurationEngineVersion)(nil)).Elem()
+}
+
+func (i WorkgroupConfigurationEngineVersionArgs) ToWorkgroupConfigurationEngineVersionOutput() WorkgroupConfigurationEngineVersionOutput {
+	return i.ToWorkgroupConfigurationEngineVersionOutputWithContext(context.Background())
+}
+
+func (i WorkgroupConfigurationEngineVersionArgs) ToWorkgroupConfigurationEngineVersionOutputWithContext(ctx context.Context) WorkgroupConfigurationEngineVersionOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WorkgroupConfigurationEngineVersionOutput)
+}
+
+func (i WorkgroupConfigurationEngineVersionArgs) ToWorkgroupConfigurationEngineVersionPtrOutput() WorkgroupConfigurationEngineVersionPtrOutput {
+	return i.ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(context.Background())
+}
+
+func (i WorkgroupConfigurationEngineVersionArgs) ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(ctx context.Context) WorkgroupConfigurationEngineVersionPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WorkgroupConfigurationEngineVersionOutput).ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(ctx)
+}
+
+// WorkgroupConfigurationEngineVersionPtrInput is an input type that accepts WorkgroupConfigurationEngineVersionArgs, WorkgroupConfigurationEngineVersionPtr and WorkgroupConfigurationEngineVersionPtrOutput values.
+// You can construct a concrete instance of `WorkgroupConfigurationEngineVersionPtrInput` via:
+//
+//          WorkgroupConfigurationEngineVersionArgs{...}
+//
+//  or:
+//
+//          nil
+type WorkgroupConfigurationEngineVersionPtrInput interface {
+	pulumi.Input
+
+	ToWorkgroupConfigurationEngineVersionPtrOutput() WorkgroupConfigurationEngineVersionPtrOutput
+	ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(context.Context) WorkgroupConfigurationEngineVersionPtrOutput
+}
+
+type workgroupConfigurationEngineVersionPtrType WorkgroupConfigurationEngineVersionArgs
+
+func WorkgroupConfigurationEngineVersionPtr(v *WorkgroupConfigurationEngineVersionArgs) WorkgroupConfigurationEngineVersionPtrInput {
+	return (*workgroupConfigurationEngineVersionPtrType)(v)
+}
+
+func (*workgroupConfigurationEngineVersionPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WorkgroupConfigurationEngineVersion)(nil)).Elem()
+}
+
+func (i *workgroupConfigurationEngineVersionPtrType) ToWorkgroupConfigurationEngineVersionPtrOutput() WorkgroupConfigurationEngineVersionPtrOutput {
+	return i.ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(context.Background())
+}
+
+func (i *workgroupConfigurationEngineVersionPtrType) ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(ctx context.Context) WorkgroupConfigurationEngineVersionPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WorkgroupConfigurationEngineVersionPtrOutput)
+}
+
+type WorkgroupConfigurationEngineVersionOutput struct{ *pulumi.OutputState }
+
+func (WorkgroupConfigurationEngineVersionOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WorkgroupConfigurationEngineVersion)(nil)).Elem()
+}
+
+func (o WorkgroupConfigurationEngineVersionOutput) ToWorkgroupConfigurationEngineVersionOutput() WorkgroupConfigurationEngineVersionOutput {
+	return o
+}
+
+func (o WorkgroupConfigurationEngineVersionOutput) ToWorkgroupConfigurationEngineVersionOutputWithContext(ctx context.Context) WorkgroupConfigurationEngineVersionOutput {
+	return o
+}
+
+func (o WorkgroupConfigurationEngineVersionOutput) ToWorkgroupConfigurationEngineVersionPtrOutput() WorkgroupConfigurationEngineVersionPtrOutput {
+	return o.ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(context.Background())
+}
+
+func (o WorkgroupConfigurationEngineVersionOutput) ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(ctx context.Context) WorkgroupConfigurationEngineVersionPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WorkgroupConfigurationEngineVersion) *WorkgroupConfigurationEngineVersion {
+		return &v
+	}).(WorkgroupConfigurationEngineVersionPtrOutput)
+}
+
+// The engine version on which the query runs. If `selectedEngineVersion` is set to `AUTO`, the effective engine version is chosen by Athena.
+func (o WorkgroupConfigurationEngineVersionOutput) EffectiveEngineVersion() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v WorkgroupConfigurationEngineVersion) *string { return v.EffectiveEngineVersion }).(pulumi.StringPtrOutput)
+}
+
+// The requested engine version. Defaults to `AUTO`.
+func (o WorkgroupConfigurationEngineVersionOutput) SelectedEngineVersion() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v WorkgroupConfigurationEngineVersion) *string { return v.SelectedEngineVersion }).(pulumi.StringPtrOutput)
+}
+
+type WorkgroupConfigurationEngineVersionPtrOutput struct{ *pulumi.OutputState }
+
+func (WorkgroupConfigurationEngineVersionPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WorkgroupConfigurationEngineVersion)(nil)).Elem()
+}
+
+func (o WorkgroupConfigurationEngineVersionPtrOutput) ToWorkgroupConfigurationEngineVersionPtrOutput() WorkgroupConfigurationEngineVersionPtrOutput {
+	return o
+}
+
+func (o WorkgroupConfigurationEngineVersionPtrOutput) ToWorkgroupConfigurationEngineVersionPtrOutputWithContext(ctx context.Context) WorkgroupConfigurationEngineVersionPtrOutput {
+	return o
+}
+
+func (o WorkgroupConfigurationEngineVersionPtrOutput) Elem() WorkgroupConfigurationEngineVersionOutput {
+	return o.ApplyT(func(v *WorkgroupConfigurationEngineVersion) WorkgroupConfigurationEngineVersion {
+		if v != nil {
+			return *v
+		}
+		var ret WorkgroupConfigurationEngineVersion
+		return ret
+	}).(WorkgroupConfigurationEngineVersionOutput)
+}
+
+// The engine version on which the query runs. If `selectedEngineVersion` is set to `AUTO`, the effective engine version is chosen by Athena.
+func (o WorkgroupConfigurationEngineVersionPtrOutput) EffectiveEngineVersion() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WorkgroupConfigurationEngineVersion) *string {
+		if v == nil {
+			return nil
+		}
+		return v.EffectiveEngineVersion
+	}).(pulumi.StringPtrOutput)
+}
+
+// The requested engine version. Defaults to `AUTO`.
+func (o WorkgroupConfigurationEngineVersionPtrOutput) SelectedEngineVersion() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WorkgroupConfigurationEngineVersion) *string {
+		if v == nil {
+			return nil
+		}
+		return v.SelectedEngineVersion
+	}).(pulumi.StringPtrOutput)
+}
+
 type WorkgroupConfigurationResultConfiguration struct {
 	// Configuration block with encryption settings. Documented below.
 	EncryptionConfiguration *WorkgroupConfigurationResultConfigurationEncryptionConfiguration `pulumi:"encryptionConfiguration"`
@@ -702,6 +877,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*DatabaseEncryptionConfigurationPtrInput)(nil)).Elem(), DatabaseEncryptionConfigurationArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WorkgroupConfigurationInput)(nil)).Elem(), WorkgroupConfigurationArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WorkgroupConfigurationPtrInput)(nil)).Elem(), WorkgroupConfigurationArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WorkgroupConfigurationEngineVersionInput)(nil)).Elem(), WorkgroupConfigurationEngineVersionArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WorkgroupConfigurationEngineVersionPtrInput)(nil)).Elem(), WorkgroupConfigurationEngineVersionArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WorkgroupConfigurationResultConfigurationInput)(nil)).Elem(), WorkgroupConfigurationResultConfigurationArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WorkgroupConfigurationResultConfigurationPtrInput)(nil)).Elem(), WorkgroupConfigurationResultConfigurationArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WorkgroupConfigurationResultConfigurationEncryptionConfigurationInput)(nil)).Elem(), WorkgroupConfigurationResultConfigurationEncryptionConfigurationArgs{})
@@ -710,6 +887,8 @@ func init() {
 	pulumi.RegisterOutputType(DatabaseEncryptionConfigurationPtrOutput{})
 	pulumi.RegisterOutputType(WorkgroupConfigurationOutput{})
 	pulumi.RegisterOutputType(WorkgroupConfigurationPtrOutput{})
+	pulumi.RegisterOutputType(WorkgroupConfigurationEngineVersionOutput{})
+	pulumi.RegisterOutputType(WorkgroupConfigurationEngineVersionPtrOutput{})
 	pulumi.RegisterOutputType(WorkgroupConfigurationResultConfigurationOutput{})
 	pulumi.RegisterOutputType(WorkgroupConfigurationResultConfigurationPtrOutput{})
 	pulumi.RegisterOutputType(WorkgroupConfigurationResultConfigurationEncryptionConfigurationOutput{})
diff --git a/sdk/go/aws/cfg/pulumiTypes.go b/sdk/go/aws/cfg/pulumiTypes.go
index 040be6ebb28..851d393d242 100644
--- a/sdk/go/aws/cfg/pulumiTypes.go
+++ b/sdk/go/aws/cfg/pulumiTypes.go
@@ -884,12 +884,309 @@ func (o RecorderRecordingGroupPtrOutput) ResourceTypes() pulumi.StringArrayOutpu
 	}).(pulumi.StringArrayOutput)
 }
 
+type RemediationConfigurationExecutionControls struct {
+	// Configuration block for SSM controls. See below.
+	SsmControls *RemediationConfigurationExecutionControlsSsmControls `pulumi:"ssmControls"`
+}
+
+// RemediationConfigurationExecutionControlsInput is an input type that accepts RemediationConfigurationExecutionControlsArgs and RemediationConfigurationExecutionControlsOutput values.
+// You can construct a concrete instance of `RemediationConfigurationExecutionControlsInput` via:
+//
+//          RemediationConfigurationExecutionControlsArgs{...}
+type RemediationConfigurationExecutionControlsInput interface {
+	pulumi.Input
+
+	ToRemediationConfigurationExecutionControlsOutput() RemediationConfigurationExecutionControlsOutput
+	ToRemediationConfigurationExecutionControlsOutputWithContext(context.Context) RemediationConfigurationExecutionControlsOutput
+}
+
+type RemediationConfigurationExecutionControlsArgs struct {
+	// Configuration block for SSM controls. See below.
+	SsmControls RemediationConfigurationExecutionControlsSsmControlsPtrInput `pulumi:"ssmControls"`
+}
+
+func (RemediationConfigurationExecutionControlsArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RemediationConfigurationExecutionControls)(nil)).Elem()
+}
+
+func (i RemediationConfigurationExecutionControlsArgs) ToRemediationConfigurationExecutionControlsOutput() RemediationConfigurationExecutionControlsOutput {
+	return i.ToRemediationConfigurationExecutionControlsOutputWithContext(context.Background())
+}
+
+func (i RemediationConfigurationExecutionControlsArgs) ToRemediationConfigurationExecutionControlsOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RemediationConfigurationExecutionControlsOutput)
+}
+
+func (i RemediationConfigurationExecutionControlsArgs) ToRemediationConfigurationExecutionControlsPtrOutput() RemediationConfigurationExecutionControlsPtrOutput {
+	return i.ToRemediationConfigurationExecutionControlsPtrOutputWithContext(context.Background())
+}
+
+func (i RemediationConfigurationExecutionControlsArgs) ToRemediationConfigurationExecutionControlsPtrOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RemediationConfigurationExecutionControlsOutput).ToRemediationConfigurationExecutionControlsPtrOutputWithContext(ctx)
+}
+
+// RemediationConfigurationExecutionControlsPtrInput is an input type that accepts RemediationConfigurationExecutionControlsArgs, RemediationConfigurationExecutionControlsPtr and RemediationConfigurationExecutionControlsPtrOutput values.
+// You can construct a concrete instance of `RemediationConfigurationExecutionControlsPtrInput` via:
+//
+//          RemediationConfigurationExecutionControlsArgs{...}
+//
+//  or:
+//
+//          nil
+type RemediationConfigurationExecutionControlsPtrInput interface {
+	pulumi.Input
+
+	ToRemediationConfigurationExecutionControlsPtrOutput() RemediationConfigurationExecutionControlsPtrOutput
+	ToRemediationConfigurationExecutionControlsPtrOutputWithContext(context.Context) RemediationConfigurationExecutionControlsPtrOutput
+}
+
+type remediationConfigurationExecutionControlsPtrType RemediationConfigurationExecutionControlsArgs
+
+func RemediationConfigurationExecutionControlsPtr(v *RemediationConfigurationExecutionControlsArgs) RemediationConfigurationExecutionControlsPtrInput {
+	return (*remediationConfigurationExecutionControlsPtrType)(v)
+}
+
+func (*remediationConfigurationExecutionControlsPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RemediationConfigurationExecutionControls)(nil)).Elem()
+}
+
+func (i *remediationConfigurationExecutionControlsPtrType) ToRemediationConfigurationExecutionControlsPtrOutput() RemediationConfigurationExecutionControlsPtrOutput {
+	return i.ToRemediationConfigurationExecutionControlsPtrOutputWithContext(context.Background())
+}
+
+func (i *remediationConfigurationExecutionControlsPtrType) ToRemediationConfigurationExecutionControlsPtrOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RemediationConfigurationExecutionControlsPtrOutput)
+}
+
+type RemediationConfigurationExecutionControlsOutput struct{ *pulumi.OutputState }
+
+func (RemediationConfigurationExecutionControlsOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RemediationConfigurationExecutionControls)(nil)).Elem()
+}
+
+func (o RemediationConfigurationExecutionControlsOutput) ToRemediationConfigurationExecutionControlsOutput() RemediationConfigurationExecutionControlsOutput {
+	return o
+}
+
+func (o RemediationConfigurationExecutionControlsOutput) ToRemediationConfigurationExecutionControlsOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsOutput {
+	return o
+}
+
+func (o RemediationConfigurationExecutionControlsOutput) ToRemediationConfigurationExecutionControlsPtrOutput() RemediationConfigurationExecutionControlsPtrOutput {
+	return o.ToRemediationConfigurationExecutionControlsPtrOutputWithContext(context.Background())
+}
+
+func (o RemediationConfigurationExecutionControlsOutput) ToRemediationConfigurationExecutionControlsPtrOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RemediationConfigurationExecutionControls) *RemediationConfigurationExecutionControls {
+		return &v
+	}).(RemediationConfigurationExecutionControlsPtrOutput)
+}
+
+// Configuration block for SSM controls. See below.
+func (o RemediationConfigurationExecutionControlsOutput) SsmControls() RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return o.ApplyT(func(v RemediationConfigurationExecutionControls) *RemediationConfigurationExecutionControlsSsmControls {
+		return v.SsmControls
+	}).(RemediationConfigurationExecutionControlsSsmControlsPtrOutput)
+}
+
+type RemediationConfigurationExecutionControlsPtrOutput struct{ *pulumi.OutputState }
+
+func (RemediationConfigurationExecutionControlsPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RemediationConfigurationExecutionControls)(nil)).Elem()
+}
+
+func (o RemediationConfigurationExecutionControlsPtrOutput) ToRemediationConfigurationExecutionControlsPtrOutput() RemediationConfigurationExecutionControlsPtrOutput {
+	return o
+}
+
+func (o RemediationConfigurationExecutionControlsPtrOutput) ToRemediationConfigurationExecutionControlsPtrOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsPtrOutput {
+	return o
+}
+
+func (o RemediationConfigurationExecutionControlsPtrOutput) Elem() RemediationConfigurationExecutionControlsOutput {
+	return o.ApplyT(func(v *RemediationConfigurationExecutionControls) RemediationConfigurationExecutionControls {
+		if v != nil {
+			return *v
+		}
+		var ret RemediationConfigurationExecutionControls
+		return ret
+	}).(RemediationConfigurationExecutionControlsOutput)
+}
+
+// Configuration block for SSM controls. See below.
+func (o RemediationConfigurationExecutionControlsPtrOutput) SsmControls() RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return o.ApplyT(func(v *RemediationConfigurationExecutionControls) *RemediationConfigurationExecutionControlsSsmControls {
+		if v == nil {
+			return nil
+		}
+		return v.SsmControls
+	}).(RemediationConfigurationExecutionControlsSsmControlsPtrOutput)
+}
+
+type RemediationConfigurationExecutionControlsSsmControls struct {
+	// Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+	ConcurrentExecutionRatePercentage *int `pulumi:"concurrentExecutionRatePercentage"`
+	// Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+	ErrorPercentage *int `pulumi:"errorPercentage"`
+}
+
+// RemediationConfigurationExecutionControlsSsmControlsInput is an input type that accepts RemediationConfigurationExecutionControlsSsmControlsArgs and RemediationConfigurationExecutionControlsSsmControlsOutput values.
+// You can construct a concrete instance of `RemediationConfigurationExecutionControlsSsmControlsInput` via:
+//
+//          RemediationConfigurationExecutionControlsSsmControlsArgs{...}
+type RemediationConfigurationExecutionControlsSsmControlsInput interface {
+	pulumi.Input
+
+	ToRemediationConfigurationExecutionControlsSsmControlsOutput() RemediationConfigurationExecutionControlsSsmControlsOutput
+	ToRemediationConfigurationExecutionControlsSsmControlsOutputWithContext(context.Context) RemediationConfigurationExecutionControlsSsmControlsOutput
+}
+
+type RemediationConfigurationExecutionControlsSsmControlsArgs struct {
+	// Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+	ConcurrentExecutionRatePercentage pulumi.IntPtrInput `pulumi:"concurrentExecutionRatePercentage"`
+	// Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+	ErrorPercentage pulumi.IntPtrInput `pulumi:"errorPercentage"`
+}
+
+func (RemediationConfigurationExecutionControlsSsmControlsArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RemediationConfigurationExecutionControlsSsmControls)(nil)).Elem()
+}
+
+func (i RemediationConfigurationExecutionControlsSsmControlsArgs) ToRemediationConfigurationExecutionControlsSsmControlsOutput() RemediationConfigurationExecutionControlsSsmControlsOutput {
+	return i.ToRemediationConfigurationExecutionControlsSsmControlsOutputWithContext(context.Background())
+}
+
+func (i RemediationConfigurationExecutionControlsSsmControlsArgs) ToRemediationConfigurationExecutionControlsSsmControlsOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsSsmControlsOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RemediationConfigurationExecutionControlsSsmControlsOutput)
+}
+
+func (i RemediationConfigurationExecutionControlsSsmControlsArgs) ToRemediationConfigurationExecutionControlsSsmControlsPtrOutput() RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return i.ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(context.Background())
+}
+
+func (i RemediationConfigurationExecutionControlsSsmControlsArgs) ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RemediationConfigurationExecutionControlsSsmControlsOutput).ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(ctx)
+}
+
+// RemediationConfigurationExecutionControlsSsmControlsPtrInput is an input type that accepts RemediationConfigurationExecutionControlsSsmControlsArgs, RemediationConfigurationExecutionControlsSsmControlsPtr and RemediationConfigurationExecutionControlsSsmControlsPtrOutput values.
+// You can construct a concrete instance of `RemediationConfigurationExecutionControlsSsmControlsPtrInput` via:
+//
+//          RemediationConfigurationExecutionControlsSsmControlsArgs{...}
+//
+//  or:
+//
+//          nil
+type RemediationConfigurationExecutionControlsSsmControlsPtrInput interface {
+	pulumi.Input
+
+	ToRemediationConfigurationExecutionControlsSsmControlsPtrOutput() RemediationConfigurationExecutionControlsSsmControlsPtrOutput
+	ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(context.Context) RemediationConfigurationExecutionControlsSsmControlsPtrOutput
+}
+
+type remediationConfigurationExecutionControlsSsmControlsPtrType RemediationConfigurationExecutionControlsSsmControlsArgs
+
+func RemediationConfigurationExecutionControlsSsmControlsPtr(v *RemediationConfigurationExecutionControlsSsmControlsArgs) RemediationConfigurationExecutionControlsSsmControlsPtrInput {
+	return (*remediationConfigurationExecutionControlsSsmControlsPtrType)(v)
+}
+
+func (*remediationConfigurationExecutionControlsSsmControlsPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RemediationConfigurationExecutionControlsSsmControls)(nil)).Elem()
+}
+
+func (i *remediationConfigurationExecutionControlsSsmControlsPtrType) ToRemediationConfigurationExecutionControlsSsmControlsPtrOutput() RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return i.ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(context.Background())
+}
+
+func (i *remediationConfigurationExecutionControlsSsmControlsPtrType) ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RemediationConfigurationExecutionControlsSsmControlsPtrOutput)
+}
+
+type RemediationConfigurationExecutionControlsSsmControlsOutput struct{ *pulumi.OutputState }
+
+func (RemediationConfigurationExecutionControlsSsmControlsOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RemediationConfigurationExecutionControlsSsmControls)(nil)).Elem()
+}
+
+func (o RemediationConfigurationExecutionControlsSsmControlsOutput) ToRemediationConfigurationExecutionControlsSsmControlsOutput() RemediationConfigurationExecutionControlsSsmControlsOutput {
+	return o
+}
+
+func (o RemediationConfigurationExecutionControlsSsmControlsOutput) ToRemediationConfigurationExecutionControlsSsmControlsOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsSsmControlsOutput {
+	return o
+}
+
+func (o RemediationConfigurationExecutionControlsSsmControlsOutput) ToRemediationConfigurationExecutionControlsSsmControlsPtrOutput() RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return o.ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(context.Background())
+}
+
+func (o RemediationConfigurationExecutionControlsSsmControlsOutput) ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RemediationConfigurationExecutionControlsSsmControls) *RemediationConfigurationExecutionControlsSsmControls {
+		return &v
+	}).(RemediationConfigurationExecutionControlsSsmControlsPtrOutput)
+}
+
+// Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+func (o RemediationConfigurationExecutionControlsSsmControlsOutput) ConcurrentExecutionRatePercentage() pulumi.IntPtrOutput {
+	return o.ApplyT(func(v RemediationConfigurationExecutionControlsSsmControls) *int {
+		return v.ConcurrentExecutionRatePercentage
+	}).(pulumi.IntPtrOutput)
+}
+
+// Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+func (o RemediationConfigurationExecutionControlsSsmControlsOutput) ErrorPercentage() pulumi.IntPtrOutput {
+	return o.ApplyT(func(v RemediationConfigurationExecutionControlsSsmControls) *int { return v.ErrorPercentage }).(pulumi.IntPtrOutput)
+}
+
+type RemediationConfigurationExecutionControlsSsmControlsPtrOutput struct{ *pulumi.OutputState }
+
+func (RemediationConfigurationExecutionControlsSsmControlsPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RemediationConfigurationExecutionControlsSsmControls)(nil)).Elem()
+}
+
+func (o RemediationConfigurationExecutionControlsSsmControlsPtrOutput) ToRemediationConfigurationExecutionControlsSsmControlsPtrOutput() RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return o
+}
+
+func (o RemediationConfigurationExecutionControlsSsmControlsPtrOutput) ToRemediationConfigurationExecutionControlsSsmControlsPtrOutputWithContext(ctx context.Context) RemediationConfigurationExecutionControlsSsmControlsPtrOutput {
+	return o
+}
+
+func (o RemediationConfigurationExecutionControlsSsmControlsPtrOutput) Elem() RemediationConfigurationExecutionControlsSsmControlsOutput {
+	return o.ApplyT(func(v *RemediationConfigurationExecutionControlsSsmControls) RemediationConfigurationExecutionControlsSsmControls {
+		if v != nil {
+			return *v
+		}
+		var ret RemediationConfigurationExecutionControlsSsmControls
+		return ret
+	}).(RemediationConfigurationExecutionControlsSsmControlsOutput)
+}
+
+// Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+func (o RemediationConfigurationExecutionControlsSsmControlsPtrOutput) ConcurrentExecutionRatePercentage() pulumi.IntPtrOutput {
+	return o.ApplyT(func(v *RemediationConfigurationExecutionControlsSsmControls) *int {
+		if v == nil {
+			return nil
+		}
+		return v.ConcurrentExecutionRatePercentage
+	}).(pulumi.IntPtrOutput)
+}
+
+// Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+func (o RemediationConfigurationExecutionControlsSsmControlsPtrOutput) ErrorPercentage() pulumi.IntPtrOutput {
+	return o.ApplyT(func(v *RemediationConfigurationExecutionControlsSsmControls) *int {
+		if v == nil {
+			return nil
+		}
+		return v.ErrorPercentage
+	}).(pulumi.IntPtrOutput)
+}
+
 type RemediationConfigurationParameter struct {
-	// The name of the attribute.
+	// Name of the attribute.
 	Name string `pulumi:"name"`
-	// The value is dynamic and changes at run-time.
+	// Value is dynamic and changes at run-time.
 	ResourceValue *string `pulumi:"resourceValue"`
-	// The value is static and does not change at run-time.
+	// Value is static and does not change at run-time.
 	StaticValue *string `pulumi:"staticValue"`
 }
 
@@ -905,11 +1202,11 @@ type RemediationConfigurationParameterInput interface {
 }
 
 type RemediationConfigurationParameterArgs struct {
-	// The name of the attribute.
+	// Name of the attribute.
 	Name pulumi.StringInput `pulumi:"name"`
-	// The value is dynamic and changes at run-time.
+	// Value is dynamic and changes at run-time.
 	ResourceValue pulumi.StringPtrInput `pulumi:"resourceValue"`
-	// The value is static and does not change at run-time.
+	// Value is static and does not change at run-time.
 	StaticValue pulumi.StringPtrInput `pulumi:"staticValue"`
 }
 
@@ -964,17 +1261,17 @@ func (o RemediationConfigurationParameterOutput) ToRemediationConfigurationParam
 	return o
 }
 
-// The name of the attribute.
+// Name of the attribute.
 func (o RemediationConfigurationParameterOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v RemediationConfigurationParameter) string { return v.Name }).(pulumi.StringOutput)
 }
 
-// The value is dynamic and changes at run-time.
+// Value is dynamic and changes at run-time.
 func (o RemediationConfigurationParameterOutput) ResourceValue() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v RemediationConfigurationParameter) *string { return v.ResourceValue }).(pulumi.StringPtrOutput)
 }
 
-// The value is static and does not change at run-time.
+// Value is static and does not change at run-time.
 func (o RemediationConfigurationParameterOutput) StaticValue() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v RemediationConfigurationParameter) *string { return v.StaticValue }).(pulumi.StringPtrOutput)
 }
@@ -1496,6 +1793,10 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*OrganizationConformancePackInputParameterArrayInput)(nil)).Elem(), OrganizationConformancePackInputParameterArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RecorderRecordingGroupInput)(nil)).Elem(), RecorderRecordingGroupArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RecorderRecordingGroupPtrInput)(nil)).Elem(), RecorderRecordingGroupArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RemediationConfigurationExecutionControlsInput)(nil)).Elem(), RemediationConfigurationExecutionControlsArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RemediationConfigurationExecutionControlsPtrInput)(nil)).Elem(), RemediationConfigurationExecutionControlsArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RemediationConfigurationExecutionControlsSsmControlsInput)(nil)).Elem(), RemediationConfigurationExecutionControlsSsmControlsArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RemediationConfigurationExecutionControlsSsmControlsPtrInput)(nil)).Elem(), RemediationConfigurationExecutionControlsSsmControlsArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RemediationConfigurationParameterInput)(nil)).Elem(), RemediationConfigurationParameterArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RemediationConfigurationParameterArrayInput)(nil)).Elem(), RemediationConfigurationParameterArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleScopeInput)(nil)).Elem(), RuleScopeArgs{})
@@ -1516,6 +1817,10 @@ func init() {
 	pulumi.RegisterOutputType(OrganizationConformancePackInputParameterArrayOutput{})
 	pulumi.RegisterOutputType(RecorderRecordingGroupOutput{})
 	pulumi.RegisterOutputType(RecorderRecordingGroupPtrOutput{})
+	pulumi.RegisterOutputType(RemediationConfigurationExecutionControlsOutput{})
+	pulumi.RegisterOutputType(RemediationConfigurationExecutionControlsPtrOutput{})
+	pulumi.RegisterOutputType(RemediationConfigurationExecutionControlsSsmControlsOutput{})
+	pulumi.RegisterOutputType(RemediationConfigurationExecutionControlsSsmControlsPtrOutput{})
 	pulumi.RegisterOutputType(RemediationConfigurationParameterOutput{})
 	pulumi.RegisterOutputType(RemediationConfigurationParameterArrayOutput{})
 	pulumi.RegisterOutputType(RuleScopeOutput{})
diff --git a/sdk/go/aws/cfg/remediationConfiguration.go b/sdk/go/aws/cfg/remediationConfiguration.go
index e4316f06942..8c8b595979c 100644
--- a/sdk/go/aws/cfg/remediationConfiguration.go
+++ b/sdk/go/aws/cfg/remediationConfiguration.go
@@ -58,6 +58,15 @@ import (
 // 					StaticValue: pulumi.String("AES256"),
 // 				},
 // 			},
+// 			Automatic:                pulumi.Bool(true),
+// 			MaximumAutomaticAttempts: pulumi.Int(10),
+// 			RetryAttemptSeconds:      pulumi.Int(600),
+// 			ExecutionControls: &cfg.RemediationConfigurationExecutionControlsArgs{
+// 				SsmControls: &cfg.RemediationConfigurationExecutionControlsSsmControlsArgs{
+// 					ConcurrentExecutionRatePercentage: pulumi.Int(25),
+// 					ErrorPercentage:                   pulumi.Int(20),
+// 				},
+// 			},
 // 		})
 // 		if err != nil {
 // 			return err
@@ -77,18 +86,25 @@ import (
 type RemediationConfiguration struct {
 	pulumi.CustomResourceState
 
-	// Amazon Resource Name (ARN) of the Config Remediation Configuration.
+	// ARN of the Config Remediation Configuration.
 	Arn pulumi.StringOutput `pulumi:"arn"`
-	// The name of the AWS Config rule
+	// Remediation is triggered automatically if `true`.
+	Automatic pulumi.BoolPtrOutput `pulumi:"automatic"`
+	// Name of the AWS Config rule.
 	ConfigRuleName pulumi.StringOutput `pulumi:"configRuleName"`
-	// Can be specified multiple times for each
-	// parameter. Each parameter block supports fields documented below.
+	// Configuration block for execution controls. See below.
+	ExecutionControls RemediationConfigurationExecutionControlsPtrOutput `pulumi:"executionControls"`
+	// Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+	MaximumAutomaticAttempts pulumi.IntPtrOutput `pulumi:"maximumAutomaticAttempts"`
+	// Can be specified multiple times for each parameter. Each parameter block supports arguments below.
 	Parameters RemediationConfigurationParameterArrayOutput `pulumi:"parameters"`
-	// The type of a resource
+	// Type of resource.
 	ResourceType pulumi.StringPtrOutput `pulumi:"resourceType"`
-	// Target ID is the name of the public document
+	// Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+	RetryAttemptSeconds pulumi.IntPtrOutput `pulumi:"retryAttemptSeconds"`
+	// Target ID is the name of the public document.
 	TargetId pulumi.StringOutput `pulumi:"targetId"`
-	// The type of the target. Target executes remediation. For example, SSM document
+	// Type of the target. Target executes remediation. For example, SSM document.
 	TargetType pulumi.StringOutput `pulumi:"targetType"`
 	// Version of the target. For example, version of the SSM document
 	TargetVersion pulumi.StringPtrOutput `pulumi:"targetVersion"`
@@ -132,36 +148,50 @@ func GetRemediationConfiguration(ctx *pulumi.Context,
 
 // Input properties used for looking up and filtering RemediationConfiguration resources.
 type remediationConfigurationState struct {
-	// Amazon Resource Name (ARN) of the Config Remediation Configuration.
+	// ARN of the Config Remediation Configuration.
 	Arn *string `pulumi:"arn"`
-	// The name of the AWS Config rule
+	// Remediation is triggered automatically if `true`.
+	Automatic *bool `pulumi:"automatic"`
+	// Name of the AWS Config rule.
 	ConfigRuleName *string `pulumi:"configRuleName"`
-	// Can be specified multiple times for each
-	// parameter. Each parameter block supports fields documented below.
+	// Configuration block for execution controls. See below.
+	ExecutionControls *RemediationConfigurationExecutionControls `pulumi:"executionControls"`
+	// Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+	MaximumAutomaticAttempts *int `pulumi:"maximumAutomaticAttempts"`
+	// Can be specified multiple times for each parameter. Each parameter block supports arguments below.
 	Parameters []RemediationConfigurationParameter `pulumi:"parameters"`
-	// The type of a resource
+	// Type of resource.
 	ResourceType *string `pulumi:"resourceType"`
-	// Target ID is the name of the public document
+	// Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+	RetryAttemptSeconds *int `pulumi:"retryAttemptSeconds"`
+	// Target ID is the name of the public document.
 	TargetId *string `pulumi:"targetId"`
-	// The type of the target. Target executes remediation. For example, SSM document
+	// Type of the target. Target executes remediation. For example, SSM document.
 	TargetType *string `pulumi:"targetType"`
 	// Version of the target. For example, version of the SSM document
 	TargetVersion *string `pulumi:"targetVersion"`
 }
 
 type RemediationConfigurationState struct {
-	// Amazon Resource Name (ARN) of the Config Remediation Configuration.
+	// ARN of the Config Remediation Configuration.
 	Arn pulumi.StringPtrInput
-	// The name of the AWS Config rule
+	// Remediation is triggered automatically if `true`.
+	Automatic pulumi.BoolPtrInput
+	// Name of the AWS Config rule.
 	ConfigRuleName pulumi.StringPtrInput
-	// Can be specified multiple times for each
-	// parameter. Each parameter block supports fields documented below.
+	// Configuration block for execution controls. See below.
+	ExecutionControls RemediationConfigurationExecutionControlsPtrInput
+	// Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+	MaximumAutomaticAttempts pulumi.IntPtrInput
+	// Can be specified multiple times for each parameter. Each parameter block supports arguments below.
 	Parameters RemediationConfigurationParameterArrayInput
-	// The type of a resource
+	// Type of resource.
 	ResourceType pulumi.StringPtrInput
-	// Target ID is the name of the public document
+	// Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+	RetryAttemptSeconds pulumi.IntPtrInput
+	// Target ID is the name of the public document.
 	TargetId pulumi.StringPtrInput
-	// The type of the target. Target executes remediation. For example, SSM document
+	// Type of the target. Target executes remediation. For example, SSM document.
 	TargetType pulumi.StringPtrInput
 	// Version of the target. For example, version of the SSM document
 	TargetVersion pulumi.StringPtrInput
@@ -172,16 +202,23 @@ func (RemediationConfigurationState) ElementType() reflect.Type {
 }
 
 type remediationConfigurationArgs struct {
-	// The name of the AWS Config rule
+	// Remediation is triggered automatically if `true`.
+	Automatic *bool `pulumi:"automatic"`
+	// Name of the AWS Config rule.
 	ConfigRuleName string `pulumi:"configRuleName"`
-	// Can be specified multiple times for each
-	// parameter. Each parameter block supports fields documented below.
+	// Configuration block for execution controls. See below.
+	ExecutionControls *RemediationConfigurationExecutionControls `pulumi:"executionControls"`
+	// Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+	MaximumAutomaticAttempts *int `pulumi:"maximumAutomaticAttempts"`
+	// Can be specified multiple times for each parameter. Each parameter block supports arguments below.
 	Parameters []RemediationConfigurationParameter `pulumi:"parameters"`
-	// The type of a resource
+	// Type of resource.
 	ResourceType *string `pulumi:"resourceType"`
-	// Target ID is the name of the public document
+	// Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+	RetryAttemptSeconds *int `pulumi:"retryAttemptSeconds"`
+	// Target ID is the name of the public document.
 	TargetId string `pulumi:"targetId"`
-	// The type of the target. Target executes remediation. For example, SSM document
+	// Type of the target. Target executes remediation. For example, SSM document.
 	TargetType string `pulumi:"targetType"`
 	// Version of the target. For example, version of the SSM document
 	TargetVersion *string `pulumi:"targetVersion"`
@@ -189,16 +226,23 @@ type remediationConfigurationArgs struct {
 
 // The set of arguments for constructing a RemediationConfiguration resource.
 type RemediationConfigurationArgs struct {
-	// The name of the AWS Config rule
+	// Remediation is triggered automatically if `true`.
+	Automatic pulumi.BoolPtrInput
+	// Name of the AWS Config rule.
 	ConfigRuleName pulumi.StringInput
-	// Can be specified multiple times for each
-	// parameter. Each parameter block supports fields documented below.
+	// Configuration block for execution controls. See below.
+	ExecutionControls RemediationConfigurationExecutionControlsPtrInput
+	// Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+	MaximumAutomaticAttempts pulumi.IntPtrInput
+	// Can be specified multiple times for each parameter. Each parameter block supports arguments below.
 	Parameters RemediationConfigurationParameterArrayInput
-	// The type of a resource
+	// Type of resource.
 	ResourceType pulumi.StringPtrInput
-	// Target ID is the name of the public document
+	// Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+	RetryAttemptSeconds pulumi.IntPtrInput
+	// Target ID is the name of the public document.
 	TargetId pulumi.StringInput
-	// The type of the target. Target executes remediation. For example, SSM document
+	// Type of the target. Target executes remediation. For example, SSM document.
 	TargetType pulumi.StringInput
 	// Version of the target. For example, version of the SSM document
 	TargetVersion pulumi.StringPtrInput
diff --git a/sdk/go/aws/cloudtrail/pulumiTypes.go b/sdk/go/aws/cloudtrail/pulumiTypes.go
index 2012c2ae1bd..5d6deb6c880 100644
--- a/sdk/go/aws/cloudtrail/pulumiTypes.go
+++ b/sdk/go/aws/cloudtrail/pulumiTypes.go
@@ -270,7 +270,9 @@ func (o TrailAdvancedEventSelectorFieldSelectorArrayOutput) Index(i pulumi.IntIn
 type TrailEventSelector struct {
 	// Configuration block for data events. See details below.
 	DataResources []TrailEventSelectorDataResource `pulumi:"dataResources"`
-	// Whether to include management events for your trail.
+	// A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `includeManagementEvents` must be set to`true` to allow this.
+	ExcludeManagementEventSources []string `pulumi:"excludeManagementEventSources"`
+	// Whether to include management events for your trail. Defaults to `true`.
 	IncludeManagementEvents *bool `pulumi:"includeManagementEvents"`
 	// Type of events to log. Valid values are `ReadOnly`, `WriteOnly`, `All`. Default value is `All`.
 	ReadWriteType *string `pulumi:"readWriteType"`
@@ -290,7 +292,9 @@ type TrailEventSelectorInput interface {
 type TrailEventSelectorArgs struct {
 	// Configuration block for data events. See details below.
 	DataResources TrailEventSelectorDataResourceArrayInput `pulumi:"dataResources"`
-	// Whether to include management events for your trail.
+	// A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `includeManagementEvents` must be set to`true` to allow this.
+	ExcludeManagementEventSources pulumi.StringArrayInput `pulumi:"excludeManagementEventSources"`
+	// Whether to include management events for your trail. Defaults to `true`.
 	IncludeManagementEvents pulumi.BoolPtrInput `pulumi:"includeManagementEvents"`
 	// Type of events to log. Valid values are `ReadOnly`, `WriteOnly`, `All`. Default value is `All`.
 	ReadWriteType pulumi.StringPtrInput `pulumi:"readWriteType"`
@@ -352,7 +356,12 @@ func (o TrailEventSelectorOutput) DataResources() TrailEventSelectorDataResource
 	return o.ApplyT(func(v TrailEventSelector) []TrailEventSelectorDataResource { return v.DataResources }).(TrailEventSelectorDataResourceArrayOutput)
 }
 
-// Whether to include management events for your trail.
+// A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `includeManagementEvents` must be set to`true` to allow this.
+func (o TrailEventSelectorOutput) ExcludeManagementEventSources() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v TrailEventSelector) []string { return v.ExcludeManagementEventSources }).(pulumi.StringArrayOutput)
+}
+
+// Whether to include management events for your trail. Defaults to `true`.
 func (o TrailEventSelectorOutput) IncludeManagementEvents() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v TrailEventSelector) *bool { return v.IncludeManagementEvents }).(pulumi.BoolPtrOutput)
 }
diff --git a/sdk/go/aws/config/pulumiTypes.go b/sdk/go/aws/config/pulumiTypes.go
index d8e50e57b12..ec2d84d3aac 100644
--- a/sdk/go/aws/config/pulumiTypes.go
+++ b/sdk/go/aws/config/pulumiTypes.go
@@ -152,6 +152,7 @@ func (o DefaultTagsOutput) Tags() pulumi.StringMapOutput {
 
 type Endpoints struct {
 	Accessanalyzer                  *string `pulumi:"accessanalyzer"`
+	Account                         *string `pulumi:"account"`
 	Acm                             *string `pulumi:"acm"`
 	Acmpca                          *string `pulumi:"acmpca"`
 	Alexaforbusiness                *string `pulumi:"alexaforbusiness"`
@@ -465,6 +466,7 @@ type EndpointsInput interface {
 
 type EndpointsArgs struct {
 	Accessanalyzer                  pulumi.StringPtrInput `pulumi:"accessanalyzer"`
+	Account                         pulumi.StringPtrInput `pulumi:"account"`
 	Acm                             pulumi.StringPtrInput `pulumi:"acm"`
 	Acmpca                          pulumi.StringPtrInput `pulumi:"acmpca"`
 	Alexaforbusiness                pulumi.StringPtrInput `pulumi:"alexaforbusiness"`
@@ -820,6 +822,10 @@ func (o EndpointsOutput) Accessanalyzer() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v Endpoints) *string { return v.Accessanalyzer }).(pulumi.StringPtrOutput)
 }
 
+func (o EndpointsOutput) Account() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v Endpoints) *string { return v.Account }).(pulumi.StringPtrOutput)
+}
+
 func (o EndpointsOutput) Acm() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v Endpoints) *string { return v.Acm }).(pulumi.StringPtrOutput)
 }
diff --git a/sdk/go/aws/dlm/lifecyclePolicy.go b/sdk/go/aws/dlm/lifecyclePolicy.go
index 4d0da16df96..27e06a74c3b 100644
--- a/sdk/go/aws/dlm/lifecyclePolicy.go
+++ b/sdk/go/aws/dlm/lifecyclePolicy.go
@@ -14,6 +14,7 @@ import (
 // Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
 //
 // ## Example Usage
+// ### Basic
 //
 // ```go
 // package main
@@ -80,10 +81,83 @@ import (
 // 	})
 // }
 // ```
+// ### Example Cross-Region Snapshot Copy Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"fmt"
+//
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/dlm"
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/kms"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		dlmCrossRegionCopyCmk, err := kms.NewKey(ctx, "dlmCrossRegionCopyCmk", &kms.KeyArgs{
+// 			Description: pulumi.String("Example Alternate Region KMS Key"),
+// 			Policy:      pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v", "{\n", "  \"Version\": \"2012-10-17\",\n", "  \"Id\": \"dlm-cross-region-copy-cmk\",\n", "  \"Statement\": [\n", "    {\n", "      \"Sid\": \"Enable IAM User Permissions\",\n", "      \"Effect\": \"Allow\",\n", "      \"Principal\": {\n", "        \"AWS\": \"*\"\n", "      },\n", "      \"Action\": \"kms:*\",\n", "      \"Resource\": \"*\"\n", "    }\n", "  ]\n", "}\n")),
+// 		}, pulumi.Provider(aws.Alternate))
+// 		if err != nil {
+// 			return err
+// 		}
+// 		_, err = dlm.NewLifecyclePolicy(ctx, "example", &dlm.LifecyclePolicyArgs{
+// 			Description:      pulumi.String("example DLM lifecycle policy"),
+// 			ExecutionRoleArn: pulumi.Any(aws_iam_role.Dlm_lifecycle_role.Arn),
+// 			State:            pulumi.String("ENABLED"),
+// 			PolicyDetails: &dlm.LifecyclePolicyPolicyDetailsArgs{
+// 				ResourceTypes: pulumi.StringArray{
+// 					pulumi.String("VOLUME"),
+// 				},
+// 				Schedules: dlm.LifecyclePolicyPolicyDetailsScheduleArray{
+// 					&dlm.LifecyclePolicyPolicyDetailsScheduleArgs{
+// 						Name: pulumi.String("2 weeks of daily snapshots"),
+// 						CreateRule: &dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs{
+// 							Interval:     pulumi.Int(24),
+// 							IntervalUnit: pulumi.String("HOURS"),
+// 							Times: pulumi.String{
+// 								"23:45",
+// 							},
+// 						},
+// 						RetainRule: &dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs{
+// 							Count: pulumi.Int(14),
+// 						},
+// 						TagsToAdd: pulumi.StringMap{
+// 							"SnapshotCreator": pulumi.String("DLM"),
+// 						},
+// 						CopyTags: pulumi.Bool(false),
+// 						CrossRegionCopyRules: dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray{
+// 							&dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs{
+// 								Target:    pulumi.String("us-west-2"),
+// 								Encrypted: pulumi.Bool(true),
+// 								CmkArn:    dlmCrossRegionCopyCmk.Arn,
+// 								CopyTags:  pulumi.Bool(true),
+// 								RetainRule: &dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs{
+// 									Interval:     pulumi.Int(30),
+// 									IntervalUnit: pulumi.String("DAYS"),
+// 								},
+// 							},
+// 						},
+// 					},
+// 				},
+// 				TargetTags: pulumi.StringMap{
+// 					"Snapshot": pulumi.String("true"),
+// 				},
+// 			},
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
 //
 // ## Import
 //
-// DLM lifecyle policies can be imported by their policy ID
+// DLM lifecycle policies can be imported by their policy ID
 //
 // ```sh
 //  $ pulumi import aws:dlm/lifecyclePolicy:LifecyclePolicy example policy-abcdef12345678901
diff --git a/sdk/go/aws/dlm/pulumiTypes.go b/sdk/go/aws/dlm/pulumiTypes.go
index 916f64b8115..e8277fa7933 100644
--- a/sdk/go/aws/dlm/pulumiTypes.go
+++ b/sdk/go/aws/dlm/pulumiTypes.go
@@ -186,13 +186,15 @@ func (o LifecyclePolicyPolicyDetailsPtrOutput) TargetTags() pulumi.StringMapOutp
 }
 
 type LifecyclePolicyPolicyDetailsSchedule struct {
-	// Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+	// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
 	CopyTags *bool `pulumi:"copyTags"`
 	// See the `createRule` block. Max of 1 per schedule.
 	CreateRule LifecyclePolicyPolicyDetailsScheduleCreateRule `pulumi:"createRule"`
+	// See the `crossRegionCopyRule` block. Max of 3 per schedule.
+	CrossRegionCopyRules []LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule `pulumi:"crossRegionCopyRules"`
 	// A name for the schedule.
 	Name string `pulumi:"name"`
-	// See the `retainRule` block. Max of 1 per schedule.
+	// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
 	RetainRule LifecyclePolicyPolicyDetailsScheduleRetainRule `pulumi:"retainRule"`
 	// A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
 	TagsToAdd map[string]string `pulumi:"tagsToAdd"`
@@ -210,13 +212,15 @@ type LifecyclePolicyPolicyDetailsScheduleInput interface {
 }
 
 type LifecyclePolicyPolicyDetailsScheduleArgs struct {
-	// Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+	// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
 	CopyTags pulumi.BoolPtrInput `pulumi:"copyTags"`
 	// See the `createRule` block. Max of 1 per schedule.
 	CreateRule LifecyclePolicyPolicyDetailsScheduleCreateRuleInput `pulumi:"createRule"`
+	// See the `crossRegionCopyRule` block. Max of 3 per schedule.
+	CrossRegionCopyRules LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayInput `pulumi:"crossRegionCopyRules"`
 	// A name for the schedule.
 	Name pulumi.StringInput `pulumi:"name"`
-	// See the `retainRule` block. Max of 1 per schedule.
+	// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
 	RetainRule LifecyclePolicyPolicyDetailsScheduleRetainRuleInput `pulumi:"retainRule"`
 	// A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
 	TagsToAdd pulumi.StringMapInput `pulumi:"tagsToAdd"`
@@ -273,7 +277,7 @@ func (o LifecyclePolicyPolicyDetailsScheduleOutput) ToLifecyclePolicyPolicyDetai
 	return o
 }
 
-// Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
 func (o LifecyclePolicyPolicyDetailsScheduleOutput) CopyTags() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsSchedule) *bool { return v.CopyTags }).(pulumi.BoolPtrOutput)
 }
@@ -285,12 +289,19 @@ func (o LifecyclePolicyPolicyDetailsScheduleOutput) CreateRule() LifecyclePolicy
 	}).(LifecyclePolicyPolicyDetailsScheduleCreateRuleOutput)
 }
 
+// See the `crossRegionCopyRule` block. Max of 3 per schedule.
+func (o LifecyclePolicyPolicyDetailsScheduleOutput) CrossRegionCopyRules() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsSchedule) []LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule {
+		return v.CrossRegionCopyRules
+	}).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput)
+}
+
 // A name for the schedule.
 func (o LifecyclePolicyPolicyDetailsScheduleOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsSchedule) string { return v.Name }).(pulumi.StringOutput)
 }
 
-// See the `retainRule` block. Max of 1 per schedule.
+// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
 func (o LifecyclePolicyPolicyDetailsScheduleOutput) RetainRule() LifecyclePolicyPolicyDetailsScheduleRetainRuleOutput {
 	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsSchedule) LifecyclePolicyPolicyDetailsScheduleRetainRule {
 		return v.RetainRule
@@ -323,9 +334,9 @@ func (o LifecyclePolicyPolicyDetailsScheduleArrayOutput) Index(i pulumi.IntInput
 }
 
 type LifecyclePolicyPolicyDetailsScheduleCreateRule struct {
-	// How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+	// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
 	Interval int `pulumi:"interval"`
-	// The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+	// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
 	IntervalUnit *string `pulumi:"intervalUnit"`
 	// A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1.
 	Times *string `pulumi:"times"`
@@ -343,9 +354,9 @@ type LifecyclePolicyPolicyDetailsScheduleCreateRuleInput interface {
 }
 
 type LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs struct {
-	// How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+	// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
 	Interval pulumi.IntInput `pulumi:"interval"`
-	// The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+	// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
 	IntervalUnit pulumi.StringPtrInput `pulumi:"intervalUnit"`
 	// A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1.
 	Times pulumi.StringPtrInput `pulumi:"times"`
@@ -377,12 +388,12 @@ func (o LifecyclePolicyPolicyDetailsScheduleCreateRuleOutput) ToLifecyclePolicyP
 	return o
 }
 
-// How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
 func (o LifecyclePolicyPolicyDetailsScheduleCreateRuleOutput) Interval() pulumi.IntOutput {
 	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCreateRule) int { return v.Interval }).(pulumi.IntOutput)
 }
 
-// The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
 func (o LifecyclePolicyPolicyDetailsScheduleCreateRuleOutput) IntervalUnit() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCreateRule) *string { return v.IntervalUnit }).(pulumi.StringPtrOutput)
 }
@@ -392,6 +403,468 @@ func (o LifecyclePolicyPolicyDetailsScheduleCreateRuleOutput) Times() pulumi.Str
 	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCreateRule) *string { return v.Times }).(pulumi.StringPtrOutput)
 }
 
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule struct {
+	// The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+	CmkArn *string `pulumi:"cmkArn"`
+	// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+	CopyTags *bool `pulumi:"copyTags"`
+	// The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecateRule` block.
+	DeprecateRule *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule `pulumi:"deprecateRule"`
+	// To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+	Encrypted bool `pulumi:"encrypted"`
+	// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
+	RetainRule *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule `pulumi:"retainRule"`
+	// The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+	Target string `pulumi:"target"`
+}
+
+// LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleInput is an input type that accepts LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs and LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput values.
+// You can construct a concrete instance of `LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleInput` via:
+//
+//          LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs{...}
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleInput interface {
+	pulumi.Input
+
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutputWithContext(context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs struct {
+	// The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+	CmkArn pulumi.StringPtrInput `pulumi:"cmkArn"`
+	// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+	CopyTags pulumi.BoolPtrInput `pulumi:"copyTags"`
+	// The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecateRule` block.
+	DeprecateRule LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrInput `pulumi:"deprecateRule"`
+	// To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+	Encrypted pulumi.BoolInput `pulumi:"encrypted"`
+	// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
+	RetainRule LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrInput `pulumi:"retainRule"`
+	// The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+	Target pulumi.StringInput `pulumi:"target"`
+}
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule)(nil)).Elem()
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput {
+	return i.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutputWithContext(context.Background())
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput)
+}
+
+// LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayInput is an input type that accepts LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray and LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput values.
+// You can construct a concrete instance of `LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayInput` via:
+//
+//          LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray{ LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs{...} }
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayInput interface {
+	pulumi.Input
+
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutputWithContext(context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray []LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleInput
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule)(nil)).Elem()
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput {
+	return i.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutputWithContext(context.Background())
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput)
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput struct{ *pulumi.OutputState }
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule)(nil)).Elem()
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput {
+	return o
+}
+
+// The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) CmkArn() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule) *string { return v.CmkArn }).(pulumi.StringPtrOutput)
+}
+
+// Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) CopyTags() pulumi.BoolPtrOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule) *bool { return v.CopyTags }).(pulumi.BoolPtrOutput)
+}
+
+// The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecateRule` block.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) DeprecateRule() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule) *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule {
+		return v.DeprecateRule
+	}).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput)
+}
+
+// To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) Encrypted() pulumi.BoolOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule) bool { return v.Encrypted }).(pulumi.BoolOutput)
+}
+
+// The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) RetainRule() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule) *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule {
+		return v.RetainRule
+	}).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput)
+}
+
+// The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput) Target() pulumi.StringOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule) string { return v.Target }).(pulumi.StringOutput)
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput struct{ *pulumi.OutputState }
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule)(nil)).Elem()
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput) Index(i pulumi.IntInput) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule {
+		return vs[0].([]LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule)[vs[1].(int)]
+	}).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput)
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule struct {
+	// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+	Interval int `pulumi:"interval"`
+	// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+	IntervalUnit string `pulumi:"intervalUnit"`
+}
+
+// LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleInput is an input type that accepts LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs and LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput values.
+// You can construct a concrete instance of `LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleInput` via:
+//
+//          LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs{...}
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleInput interface {
+	pulumi.Input
+
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutputWithContext(context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs struct {
+	// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+	Interval pulumi.IntInput `pulumi:"interval"`
+	// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+	IntervalUnit pulumi.StringInput `pulumi:"intervalUnit"`
+}
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule)(nil)).Elem()
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput {
+	return i.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutputWithContext(context.Background())
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput)
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return i.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(context.Background())
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput).ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(ctx)
+}
+
+// LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrInput is an input type that accepts LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs, LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtr and LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput values.
+// You can construct a concrete instance of `LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrInput` via:
+//
+//          LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs{...}
+//
+//  or:
+//
+//          nil
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrInput interface {
+	pulumi.Input
+
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput
+}
+
+type lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrType LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs
+
+func LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtr(v *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrInput {
+	return (*lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrType)(v)
+}
+
+func (*lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule)(nil)).Elem()
+}
+
+func (i *lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrType) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return i.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(context.Background())
+}
+
+func (i *lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrType) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput)
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput struct{ *pulumi.OutputState }
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule)(nil)).Elem()
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return o.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(context.Background())
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule) *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule {
+		return &v
+	}).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput)
+}
+
+// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput) Interval() pulumi.IntOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule) int { return v.Interval }).(pulumi.IntOutput)
+}
+
+// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput) IntervalUnit() pulumi.StringOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule) string {
+		return v.IntervalUnit
+	}).(pulumi.StringOutput)
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput struct{ *pulumi.OutputState }
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule)(nil)).Elem()
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput) Elem() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput {
+	return o.ApplyT(func(v *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule {
+		if v != nil {
+			return *v
+		}
+		var ret LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule
+		return ret
+	}).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput)
+}
+
+// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput) Interval() pulumi.IntPtrOutput {
+	return o.ApplyT(func(v *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule) *int {
+		if v == nil {
+			return nil
+		}
+		return &v.Interval
+	}).(pulumi.IntPtrOutput)
+}
+
+// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput) IntervalUnit() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.IntervalUnit
+	}).(pulumi.StringPtrOutput)
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule struct {
+	// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+	Interval int `pulumi:"interval"`
+	// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+	IntervalUnit string `pulumi:"intervalUnit"`
+}
+
+// LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleInput is an input type that accepts LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs and LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput values.
+// You can construct a concrete instance of `LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleInput` via:
+//
+//          LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs{...}
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleInput interface {
+	pulumi.Input
+
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutputWithContext(context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs struct {
+	// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+	Interval pulumi.IntInput `pulumi:"interval"`
+	// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+	IntervalUnit pulumi.StringInput `pulumi:"intervalUnit"`
+}
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule)(nil)).Elem()
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput {
+	return i.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutputWithContext(context.Background())
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput)
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return i.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(context.Background())
+}
+
+func (i LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput).ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(ctx)
+}
+
+// LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrInput is an input type that accepts LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs, LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtr and LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput values.
+// You can construct a concrete instance of `LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrInput` via:
+//
+//          LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs{...}
+//
+//  or:
+//
+//          nil
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrInput interface {
+	pulumi.Input
+
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput
+	ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput
+}
+
+type lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrType LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs
+
+func LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtr(v *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrInput {
+	return (*lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrType)(v)
+}
+
+func (*lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule)(nil)).Elem()
+}
+
+func (i *lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrType) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return i.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(context.Background())
+}
+
+func (i *lifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrType) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput)
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput struct{ *pulumi.OutputState }
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule)(nil)).Elem()
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return o.ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(context.Background())
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule) *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule {
+		return &v
+	}).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput)
+}
+
+// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput) Interval() pulumi.IntOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule) int { return v.Interval }).(pulumi.IntOutput)
+}
+
+// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput) IntervalUnit() pulumi.StringOutput {
+	return o.ApplyT(func(v LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule) string {
+		return v.IntervalUnit
+	}).(pulumi.StringOutput)
+}
+
+type LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput struct{ *pulumi.OutputState }
+
+func (LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule)(nil)).Elem()
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput) ToLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutputWithContext(ctx context.Context) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput {
+	return o
+}
+
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput) Elem() LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput {
+	return o.ApplyT(func(v *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule) LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule {
+		if v != nil {
+			return *v
+		}
+		var ret LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule
+		return ret
+	}).(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput)
+}
+
+// The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput) Interval() pulumi.IntPtrOutput {
+	return o.ApplyT(func(v *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule) *int {
+		if v == nil {
+			return nil
+		}
+		return &v.Interval
+	}).(pulumi.IntPtrOutput)
+}
+
+// The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+func (o LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput) IntervalUnit() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.IntervalUnit
+	}).(pulumi.StringPtrOutput)
+}
+
 type LifecyclePolicyPolicyDetailsScheduleRetainRule struct {
 	// How many snapshots to keep. Must be an integer between 1 and 1000.
 	Count int `pulumi:"count"`
@@ -450,11 +923,23 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleArrayInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCreateRuleInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*LifecyclePolicyPolicyDetailsScheduleRetainRuleInput)(nil)).Elem(), LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs{})
 	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsOutput{})
 	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsPtrOutput{})
 	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleOutput{})
 	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleArrayOutput{})
 	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleCreateRuleOutput{})
+	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleOutput{})
+	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArrayOutput{})
+	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleOutput{})
+	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRulePtrOutput{})
+	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleOutput{})
+	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRulePtrOutput{})
 	pulumi.RegisterOutputType(LifecyclePolicyPolicyDetailsScheduleRetainRuleOutput{})
 }
diff --git a/sdk/go/aws/ec2/getInstanceTypes.go b/sdk/go/aws/ec2/getInstanceTypes.go
new file mode 100644
index 00000000000..fb1f86db4e2
--- /dev/null
+++ b/sdk/go/aws/ec2/getInstanceTypes.go
@@ -0,0 +1,137 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package ec2
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+// Information about EC2 Instance Types.
+//
+// ## Example Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/ec2"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		_, err := ec2.GetInstanceTypes(ctx, &ec2.GetInstanceTypesArgs{
+// 			Filters: []ec2.GetInstanceTypesFilter{
+// 				ec2.GetInstanceTypesFilter{
+// 					Name: "auto-recovery-supported",
+// 					Values: []string{
+// 						"true",
+// 					},
+// 				},
+// 				ec2.GetInstanceTypesFilter{
+// 					Name: "network-info.encryption-in-transit-supported",
+// 					Values: []string{
+// 						"true",
+// 					},
+// 				},
+// 				ec2.GetInstanceTypesFilter{
+// 					Name: "instance-storage-supported",
+// 					Values: []string{
+// 						"true",
+// 					},
+// 				},
+// 				ec2.GetInstanceTypesFilter{
+// 					Name: "instance-type",
+// 					Values: []string{
+// 						"g5.2xlarge",
+// 						"g5.4xlarge",
+// 					},
+// 				},
+// 			},
+// 		}, nil)
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+func GetInstanceTypes(ctx *pulumi.Context, args *GetInstanceTypesArgs, opts ...pulumi.InvokeOption) (*GetInstanceTypesResult, error) {
+	var rv GetInstanceTypesResult
+	err := ctx.Invoke("aws:ec2/getInstanceTypes:getInstanceTypes", args, &rv, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &rv, nil
+}
+
+// A collection of arguments for invoking getInstanceTypes.
+type GetInstanceTypesArgs struct {
+	// One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
+	Filters []GetInstanceTypesFilter `pulumi:"filters"`
+}
+
+// A collection of values returned by getInstanceTypes.
+type GetInstanceTypesResult struct {
+	Filters []GetInstanceTypesFilter `pulumi:"filters"`
+	// The provider-assigned unique ID for this managed resource.
+	Id string `pulumi:"id"`
+	// List of EC2 Instance Types.
+	InstanceTypes []string `pulumi:"instanceTypes"`
+}
+
+func GetInstanceTypesOutput(ctx *pulumi.Context, args GetInstanceTypesOutputArgs, opts ...pulumi.InvokeOption) GetInstanceTypesResultOutput {
+	return pulumi.ToOutputWithContext(context.Background(), args).
+		ApplyT(func(v interface{}) (GetInstanceTypesResult, error) {
+			args := v.(GetInstanceTypesArgs)
+			r, err := GetInstanceTypes(ctx, &args, opts...)
+			return *r, err
+		}).(GetInstanceTypesResultOutput)
+}
+
+// A collection of arguments for invoking getInstanceTypes.
+type GetInstanceTypesOutputArgs struct {
+	// One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
+	Filters GetInstanceTypesFilterArrayInput `pulumi:"filters"`
+}
+
+func (GetInstanceTypesOutputArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*GetInstanceTypesArgs)(nil)).Elem()
+}
+
+// A collection of values returned by getInstanceTypes.
+type GetInstanceTypesResultOutput struct{ *pulumi.OutputState }
+
+func (GetInstanceTypesResultOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*GetInstanceTypesResult)(nil)).Elem()
+}
+
+func (o GetInstanceTypesResultOutput) ToGetInstanceTypesResultOutput() GetInstanceTypesResultOutput {
+	return o
+}
+
+func (o GetInstanceTypesResultOutput) ToGetInstanceTypesResultOutputWithContext(ctx context.Context) GetInstanceTypesResultOutput {
+	return o
+}
+
+func (o GetInstanceTypesResultOutput) Filters() GetInstanceTypesFilterArrayOutput {
+	return o.ApplyT(func(v GetInstanceTypesResult) []GetInstanceTypesFilter { return v.Filters }).(GetInstanceTypesFilterArrayOutput)
+}
+
+// The provider-assigned unique ID for this managed resource.
+func (o GetInstanceTypesResultOutput) Id() pulumi.StringOutput {
+	return o.ApplyT(func(v GetInstanceTypesResult) string { return v.Id }).(pulumi.StringOutput)
+}
+
+// List of EC2 Instance Types.
+func (o GetInstanceTypesResultOutput) InstanceTypes() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v GetInstanceTypesResult) []string { return v.InstanceTypes }).(pulumi.StringArrayOutput)
+}
+
+func init() {
+	pulumi.RegisterOutputType(GetInstanceTypesResultOutput{})
+}
diff --git a/sdk/go/aws/ec2/pulumiTypes.go b/sdk/go/aws/ec2/pulumiTypes.go
index c5f64c738ea..2d58b61ae6e 100644
--- a/sdk/go/aws/ec2/pulumiTypes.go
+++ b/sdk/go/aws/ec2/pulumiTypes.go
@@ -16893,6 +16893,112 @@ func (o GetInstanceTypeOfferingsFilterArrayOutput) Index(i pulumi.IntInput) GetI
 	}).(GetInstanceTypeOfferingsFilterOutput)
 }
 
+type GetInstanceTypesFilter struct {
+	// Name of the filter.
+	Name string `pulumi:"name"`
+	// List of one or more values for the filter.
+	Values []string `pulumi:"values"`
+}
+
+// GetInstanceTypesFilterInput is an input type that accepts GetInstanceTypesFilterArgs and GetInstanceTypesFilterOutput values.
+// You can construct a concrete instance of `GetInstanceTypesFilterInput` via:
+//
+//          GetInstanceTypesFilterArgs{...}
+type GetInstanceTypesFilterInput interface {
+	pulumi.Input
+
+	ToGetInstanceTypesFilterOutput() GetInstanceTypesFilterOutput
+	ToGetInstanceTypesFilterOutputWithContext(context.Context) GetInstanceTypesFilterOutput
+}
+
+type GetInstanceTypesFilterArgs struct {
+	// Name of the filter.
+	Name pulumi.StringInput `pulumi:"name"`
+	// List of one or more values for the filter.
+	Values pulumi.StringArrayInput `pulumi:"values"`
+}
+
+func (GetInstanceTypesFilterArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*GetInstanceTypesFilter)(nil)).Elem()
+}
+
+func (i GetInstanceTypesFilterArgs) ToGetInstanceTypesFilterOutput() GetInstanceTypesFilterOutput {
+	return i.ToGetInstanceTypesFilterOutputWithContext(context.Background())
+}
+
+func (i GetInstanceTypesFilterArgs) ToGetInstanceTypesFilterOutputWithContext(ctx context.Context) GetInstanceTypesFilterOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(GetInstanceTypesFilterOutput)
+}
+
+// GetInstanceTypesFilterArrayInput is an input type that accepts GetInstanceTypesFilterArray and GetInstanceTypesFilterArrayOutput values.
+// You can construct a concrete instance of `GetInstanceTypesFilterArrayInput` via:
+//
+//          GetInstanceTypesFilterArray{ GetInstanceTypesFilterArgs{...} }
+type GetInstanceTypesFilterArrayInput interface {
+	pulumi.Input
+
+	ToGetInstanceTypesFilterArrayOutput() GetInstanceTypesFilterArrayOutput
+	ToGetInstanceTypesFilterArrayOutputWithContext(context.Context) GetInstanceTypesFilterArrayOutput
+}
+
+type GetInstanceTypesFilterArray []GetInstanceTypesFilterInput
+
+func (GetInstanceTypesFilterArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]GetInstanceTypesFilter)(nil)).Elem()
+}
+
+func (i GetInstanceTypesFilterArray) ToGetInstanceTypesFilterArrayOutput() GetInstanceTypesFilterArrayOutput {
+	return i.ToGetInstanceTypesFilterArrayOutputWithContext(context.Background())
+}
+
+func (i GetInstanceTypesFilterArray) ToGetInstanceTypesFilterArrayOutputWithContext(ctx context.Context) GetInstanceTypesFilterArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(GetInstanceTypesFilterArrayOutput)
+}
+
+type GetInstanceTypesFilterOutput struct{ *pulumi.OutputState }
+
+func (GetInstanceTypesFilterOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*GetInstanceTypesFilter)(nil)).Elem()
+}
+
+func (o GetInstanceTypesFilterOutput) ToGetInstanceTypesFilterOutput() GetInstanceTypesFilterOutput {
+	return o
+}
+
+func (o GetInstanceTypesFilterOutput) ToGetInstanceTypesFilterOutputWithContext(ctx context.Context) GetInstanceTypesFilterOutput {
+	return o
+}
+
+// Name of the filter.
+func (o GetInstanceTypesFilterOutput) Name() pulumi.StringOutput {
+	return o.ApplyT(func(v GetInstanceTypesFilter) string { return v.Name }).(pulumi.StringOutput)
+}
+
+// List of one or more values for the filter.
+func (o GetInstanceTypesFilterOutput) Values() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v GetInstanceTypesFilter) []string { return v.Values }).(pulumi.StringArrayOutput)
+}
+
+type GetInstanceTypesFilterArrayOutput struct{ *pulumi.OutputState }
+
+func (GetInstanceTypesFilterArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]GetInstanceTypesFilter)(nil)).Elem()
+}
+
+func (o GetInstanceTypesFilterArrayOutput) ToGetInstanceTypesFilterArrayOutput() GetInstanceTypesFilterArrayOutput {
+	return o
+}
+
+func (o GetInstanceTypesFilterArrayOutput) ToGetInstanceTypesFilterArrayOutputWithContext(ctx context.Context) GetInstanceTypesFilterArrayOutput {
+	return o
+}
+
+func (o GetInstanceTypesFilterArrayOutput) Index(i pulumi.IntInput) GetInstanceTypesFilterOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) GetInstanceTypesFilter {
+		return vs[0].([]GetInstanceTypesFilter)[vs[1].(int)]
+	}).(GetInstanceTypesFilterOutput)
+}
+
 type GetInstancesFilter struct {
 	Name   string   `pulumi:"name"`
 	Values []string `pulumi:"values"`
@@ -24173,6 +24279,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInstanceTypeOfferingFilterArrayInput)(nil)).Elem(), GetInstanceTypeOfferingFilterArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInstanceTypeOfferingsFilterInput)(nil)).Elem(), GetInstanceTypeOfferingsFilterArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInstanceTypeOfferingsFilterArrayInput)(nil)).Elem(), GetInstanceTypeOfferingsFilterArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*GetInstanceTypesFilterInput)(nil)).Elem(), GetInstanceTypesFilterArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*GetInstanceTypesFilterArrayInput)(nil)).Elem(), GetInstanceTypesFilterArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInstancesFilterInput)(nil)).Elem(), GetInstancesFilterArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInstancesFilterArrayInput)(nil)).Elem(), GetInstancesFilterArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInternetGatewayAttachmentInput)(nil)).Elem(), GetInternetGatewayAttachmentArgs{})
@@ -24522,6 +24630,8 @@ func init() {
 	pulumi.RegisterOutputType(GetInstanceTypeOfferingFilterArrayOutput{})
 	pulumi.RegisterOutputType(GetInstanceTypeOfferingsFilterOutput{})
 	pulumi.RegisterOutputType(GetInstanceTypeOfferingsFilterArrayOutput{})
+	pulumi.RegisterOutputType(GetInstanceTypesFilterOutput{})
+	pulumi.RegisterOutputType(GetInstanceTypesFilterArrayOutput{})
 	pulumi.RegisterOutputType(GetInstancesFilterOutput{})
 	pulumi.RegisterOutputType(GetInstancesFilterArrayOutput{})
 	pulumi.RegisterOutputType(GetInternetGatewayAttachmentOutput{})
diff --git a/sdk/go/aws/ecs/capacityProvider.go b/sdk/go/aws/ecs/capacityProvider.go
index bb0168dcf08..12c0849cd13 100644
--- a/sdk/go/aws/ecs/capacityProvider.go
+++ b/sdk/go/aws/ecs/capacityProvider.go
@@ -32,7 +32,7 @@ import (
 // 			Tags: autoscaling.GroupTagArray{
 // 				&autoscaling.GroupTagArgs{
 // 					Key:               pulumi.String("AmazonECSManaged"),
-// 					Value:             pulumi.String(""),
+// 					Value:             pulumi.String("true"),
 // 					PropagateAtLaunch: pulumi.Bool(true),
 // 				},
 // 			},
diff --git a/sdk/go/aws/ecs/service.go b/sdk/go/aws/ecs/service.go
index e546bc0e8fb..60639ad13a6 100644
--- a/sdk/go/aws/ecs/service.go
+++ b/sdk/go/aws/ecs/service.go
@@ -146,13 +146,13 @@ import (
 type Service struct {
 	pulumi.CustomResourceState
 
-	// Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+	// Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `forceNewDeployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
 	CapacityProviderStrategies ServiceCapacityProviderStrategyArrayOutput `pulumi:"capacityProviderStrategies"`
-	// ARN of an ECS cluster
+	// ARN of an ECS cluster.
 	Cluster pulumi.StringOutput `pulumi:"cluster"`
-	// Configuration block for deployment circuit breaker. Detailed below.
+	// Configuration block for deployment circuit breaker. See below.
 	DeploymentCircuitBreaker ServiceDeploymentCircuitBreakerPtrOutput `pulumi:"deploymentCircuitBreaker"`
-	// Configuration block for deployment controller configuration. Detailed below.
+	// Configuration block for deployment controller configuration. See below.
 	DeploymentController ServiceDeploymentControllerPtrOutput `pulumi:"deploymentController"`
 	// Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
 	DeploymentMaximumPercent pulumi.IntPtrOutput `pulumi:"deploymentMaximumPercent"`
@@ -172,15 +172,15 @@ type Service struct {
 	IamRole pulumi.StringOutput `pulumi:"iamRole"`
 	// Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
 	LaunchType pulumi.StringOutput `pulumi:"launchType"`
-	// Configuration block for load balancers. Detailed below.
+	// Configuration block for load balancers. See below.
 	LoadBalancers ServiceLoadBalancerArrayOutput `pulumi:"loadBalancers"`
 	// Name of the service (up to 255 letters, numbers, hyphens, and underscores)
 	Name pulumi.StringOutput `pulumi:"name"`
-	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
 	NetworkConfiguration ServiceNetworkConfigurationPtrOutput `pulumi:"networkConfiguration"`
-	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. Detailed below.
+	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
 	OrderedPlacementStrategies ServiceOrderedPlacementStrategyArrayOutput `pulumi:"orderedPlacementStrategies"`
-	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. Detailed below.
+	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
 	PlacementConstraints ServicePlacementConstraintArrayOutput `pulumi:"placementConstraints"`
 	// Platform version on which to run your service. Only applicable for `launchType` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
 	PlatformVersion pulumi.StringOutput `pulumi:"platformVersion"`
@@ -188,9 +188,9 @@ type Service struct {
 	PropagateTags pulumi.StringPtrOutput `pulumi:"propagateTags"`
 	// Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
 	SchedulingStrategy pulumi.StringPtrOutput `pulumi:"schedulingStrategy"`
-	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. Detailed below.
+	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
 	ServiceRegistries ServiceServiceRegistriesPtrOutput `pulumi:"serviceRegistries"`
-	// Key-value map of resource tags.
+	// Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapOutput `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
 	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
@@ -229,13 +229,13 @@ func GetService(ctx *pulumi.Context,
 
 // Input properties used for looking up and filtering Service resources.
 type serviceState struct {
-	// Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+	// Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `forceNewDeployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
 	CapacityProviderStrategies []ServiceCapacityProviderStrategy `pulumi:"capacityProviderStrategies"`
-	// ARN of an ECS cluster
+	// ARN of an ECS cluster.
 	Cluster *string `pulumi:"cluster"`
-	// Configuration block for deployment circuit breaker. Detailed below.
+	// Configuration block for deployment circuit breaker. See below.
 	DeploymentCircuitBreaker *ServiceDeploymentCircuitBreaker `pulumi:"deploymentCircuitBreaker"`
-	// Configuration block for deployment controller configuration. Detailed below.
+	// Configuration block for deployment controller configuration. See below.
 	DeploymentController *ServiceDeploymentController `pulumi:"deploymentController"`
 	// Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
 	DeploymentMaximumPercent *int `pulumi:"deploymentMaximumPercent"`
@@ -255,15 +255,15 @@ type serviceState struct {
 	IamRole *string `pulumi:"iamRole"`
 	// Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
 	LaunchType *string `pulumi:"launchType"`
-	// Configuration block for load balancers. Detailed below.
+	// Configuration block for load balancers. See below.
 	LoadBalancers []ServiceLoadBalancer `pulumi:"loadBalancers"`
 	// Name of the service (up to 255 letters, numbers, hyphens, and underscores)
 	Name *string `pulumi:"name"`
-	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
 	NetworkConfiguration *ServiceNetworkConfiguration `pulumi:"networkConfiguration"`
-	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. Detailed below.
+	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
 	OrderedPlacementStrategies []ServiceOrderedPlacementStrategy `pulumi:"orderedPlacementStrategies"`
-	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. Detailed below.
+	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
 	PlacementConstraints []ServicePlacementConstraint `pulumi:"placementConstraints"`
 	// Platform version on which to run your service. Only applicable for `launchType` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
 	PlatformVersion *string `pulumi:"platformVersion"`
@@ -271,9 +271,9 @@ type serviceState struct {
 	PropagateTags *string `pulumi:"propagateTags"`
 	// Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
 	SchedulingStrategy *string `pulumi:"schedulingStrategy"`
-	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. Detailed below.
+	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
 	ServiceRegistries *ServiceServiceRegistries `pulumi:"serviceRegistries"`
-	// Key-value map of resource tags.
+	// Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
 	TagsAll map[string]string `pulumi:"tagsAll"`
@@ -284,13 +284,13 @@ type serviceState struct {
 }
 
 type ServiceState struct {
-	// Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+	// Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `forceNewDeployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
 	CapacityProviderStrategies ServiceCapacityProviderStrategyArrayInput
-	// ARN of an ECS cluster
+	// ARN of an ECS cluster.
 	Cluster pulumi.StringPtrInput
-	// Configuration block for deployment circuit breaker. Detailed below.
+	// Configuration block for deployment circuit breaker. See below.
 	DeploymentCircuitBreaker ServiceDeploymentCircuitBreakerPtrInput
-	// Configuration block for deployment controller configuration. Detailed below.
+	// Configuration block for deployment controller configuration. See below.
 	DeploymentController ServiceDeploymentControllerPtrInput
 	// Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
 	DeploymentMaximumPercent pulumi.IntPtrInput
@@ -310,15 +310,15 @@ type ServiceState struct {
 	IamRole pulumi.StringPtrInput
 	// Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
 	LaunchType pulumi.StringPtrInput
-	// Configuration block for load balancers. Detailed below.
+	// Configuration block for load balancers. See below.
 	LoadBalancers ServiceLoadBalancerArrayInput
 	// Name of the service (up to 255 letters, numbers, hyphens, and underscores)
 	Name pulumi.StringPtrInput
-	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
 	NetworkConfiguration ServiceNetworkConfigurationPtrInput
-	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. Detailed below.
+	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
 	OrderedPlacementStrategies ServiceOrderedPlacementStrategyArrayInput
-	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. Detailed below.
+	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
 	PlacementConstraints ServicePlacementConstraintArrayInput
 	// Platform version on which to run your service. Only applicable for `launchType` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
 	PlatformVersion pulumi.StringPtrInput
@@ -326,9 +326,9 @@ type ServiceState struct {
 	PropagateTags pulumi.StringPtrInput
 	// Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
 	SchedulingStrategy pulumi.StringPtrInput
-	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. Detailed below.
+	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
 	ServiceRegistries ServiceServiceRegistriesPtrInput
-	// Key-value map of resource tags.
+	// Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 	// A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
 	TagsAll pulumi.StringMapInput
@@ -343,13 +343,13 @@ func (ServiceState) ElementType() reflect.Type {
 }
 
 type serviceArgs struct {
-	// Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+	// Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `forceNewDeployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
 	CapacityProviderStrategies []ServiceCapacityProviderStrategy `pulumi:"capacityProviderStrategies"`
-	// ARN of an ECS cluster
+	// ARN of an ECS cluster.
 	Cluster *string `pulumi:"cluster"`
-	// Configuration block for deployment circuit breaker. Detailed below.
+	// Configuration block for deployment circuit breaker. See below.
 	DeploymentCircuitBreaker *ServiceDeploymentCircuitBreaker `pulumi:"deploymentCircuitBreaker"`
-	// Configuration block for deployment controller configuration. Detailed below.
+	// Configuration block for deployment controller configuration. See below.
 	DeploymentController *ServiceDeploymentController `pulumi:"deploymentController"`
 	// Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
 	DeploymentMaximumPercent *int `pulumi:"deploymentMaximumPercent"`
@@ -369,15 +369,15 @@ type serviceArgs struct {
 	IamRole *string `pulumi:"iamRole"`
 	// Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
 	LaunchType *string `pulumi:"launchType"`
-	// Configuration block for load balancers. Detailed below.
+	// Configuration block for load balancers. See below.
 	LoadBalancers []ServiceLoadBalancer `pulumi:"loadBalancers"`
 	// Name of the service (up to 255 letters, numbers, hyphens, and underscores)
 	Name *string `pulumi:"name"`
-	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
 	NetworkConfiguration *ServiceNetworkConfiguration `pulumi:"networkConfiguration"`
-	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. Detailed below.
+	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
 	OrderedPlacementStrategies []ServiceOrderedPlacementStrategy `pulumi:"orderedPlacementStrategies"`
-	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. Detailed below.
+	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
 	PlacementConstraints []ServicePlacementConstraint `pulumi:"placementConstraints"`
 	// Platform version on which to run your service. Only applicable for `launchType` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
 	PlatformVersion *string `pulumi:"platformVersion"`
@@ -385,9 +385,9 @@ type serviceArgs struct {
 	PropagateTags *string `pulumi:"propagateTags"`
 	// Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
 	SchedulingStrategy *string `pulumi:"schedulingStrategy"`
-	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. Detailed below.
+	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
 	ServiceRegistries *ServiceServiceRegistries `pulumi:"serviceRegistries"`
-	// Key-value map of resource tags.
+	// Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 	// Family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service. Required unless using the `EXTERNAL` deployment controller. If a revision is not specified, the latest `ACTIVE` revision is used.
 	TaskDefinition *string `pulumi:"taskDefinition"`
@@ -397,13 +397,13 @@ type serviceArgs struct {
 
 // The set of arguments for constructing a Service resource.
 type ServiceArgs struct {
-	// Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+	// Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `forceNewDeployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
 	CapacityProviderStrategies ServiceCapacityProviderStrategyArrayInput
-	// ARN of an ECS cluster
+	// ARN of an ECS cluster.
 	Cluster pulumi.StringPtrInput
-	// Configuration block for deployment circuit breaker. Detailed below.
+	// Configuration block for deployment circuit breaker. See below.
 	DeploymentCircuitBreaker ServiceDeploymentCircuitBreakerPtrInput
-	// Configuration block for deployment controller configuration. Detailed below.
+	// Configuration block for deployment controller configuration. See below.
 	DeploymentController ServiceDeploymentControllerPtrInput
 	// Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
 	DeploymentMaximumPercent pulumi.IntPtrInput
@@ -423,15 +423,15 @@ type ServiceArgs struct {
 	IamRole pulumi.StringPtrInput
 	// Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
 	LaunchType pulumi.StringPtrInput
-	// Configuration block for load balancers. Detailed below.
+	// Configuration block for load balancers. See below.
 	LoadBalancers ServiceLoadBalancerArrayInput
 	// Name of the service (up to 255 letters, numbers, hyphens, and underscores)
 	Name pulumi.StringPtrInput
-	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+	// Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
 	NetworkConfiguration ServiceNetworkConfigurationPtrInput
-	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. Detailed below.
+	// Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
 	OrderedPlacementStrategies ServiceOrderedPlacementStrategyArrayInput
-	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. Detailed below.
+	// Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
 	PlacementConstraints ServicePlacementConstraintArrayInput
 	// Platform version on which to run your service. Only applicable for `launchType` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
 	PlatformVersion pulumi.StringPtrInput
@@ -439,9 +439,9 @@ type ServiceArgs struct {
 	PropagateTags pulumi.StringPtrInput
 	// Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
 	SchedulingStrategy pulumi.StringPtrInput
-	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. Detailed below.
+	// Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
 	ServiceRegistries ServiceServiceRegistriesPtrInput
-	// Key-value map of resource tags.
+	// Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 	// Family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service. Required unless using the `EXTERNAL` deployment controller. If a revision is not specified, the latest `ACTIVE` revision is used.
 	TaskDefinition pulumi.StringPtrInput
diff --git a/sdk/go/aws/elasticloadbalancing/getLoadBalancer.go b/sdk/go/aws/elasticloadbalancing/getLoadBalancer.go
index 1aa2cb81bcb..b8c325b7f9b 100644
--- a/sdk/go/aws/elasticloadbalancing/getLoadBalancer.go
+++ b/sdk/go/aws/elasticloadbalancing/getLoadBalancer.go
@@ -72,6 +72,7 @@ type LookupLoadBalancerResult struct {
 	ConnectionDraining        bool                       `pulumi:"connectionDraining"`
 	ConnectionDrainingTimeout int                        `pulumi:"connectionDrainingTimeout"`
 	CrossZoneLoadBalancing    bool                       `pulumi:"crossZoneLoadBalancing"`
+	DesyncMitigationMode      string                     `pulumi:"desyncMitigationMode"`
 	DnsName                   string                     `pulumi:"dnsName"`
 	HealthCheck               GetLoadBalancerHealthCheck `pulumi:"healthCheck"`
 	// The provider-assigned unique ID for this managed resource.
@@ -148,6 +149,10 @@ func (o LookupLoadBalancerResultOutput) CrossZoneLoadBalancing() pulumi.BoolOutp
 	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.CrossZoneLoadBalancing }).(pulumi.BoolOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) DesyncMitigationMode() pulumi.StringOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DesyncMitigationMode }).(pulumi.StringOutput)
+}
+
 func (o LookupLoadBalancerResultOutput) DnsName() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DnsName }).(pulumi.StringOutput)
 }
diff --git a/sdk/go/aws/elasticloadbalancing/loadBalancer.go b/sdk/go/aws/elasticloadbalancing/loadBalancer.go
index 01b02264040..5ff00c6fd80 100644
--- a/sdk/go/aws/elasticloadbalancing/loadBalancer.go
+++ b/sdk/go/aws/elasticloadbalancing/loadBalancer.go
@@ -117,6 +117,8 @@ type LoadBalancer struct {
 	ConnectionDrainingTimeout pulumi.IntPtrOutput `pulumi:"connectionDrainingTimeout"`
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing pulumi.BoolPtrOutput `pulumi:"crossZoneLoadBalancing"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrOutput `pulumi:"desyncMitigationMode"`
 	// The DNS name of the ELB
 	DnsName pulumi.StringOutput `pulumi:"dnsName"`
 	// A healthCheck block. Health Check documented below.
@@ -198,6 +200,8 @@ type loadBalancerState struct {
 	ConnectionDrainingTimeout *int `pulumi:"connectionDrainingTimeout"`
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing *bool `pulumi:"crossZoneLoadBalancing"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// The DNS name of the ELB
 	DnsName *string `pulumi:"dnsName"`
 	// A healthCheck block. Health Check documented below.
@@ -248,6 +252,8 @@ type LoadBalancerState struct {
 	ConnectionDrainingTimeout pulumi.IntPtrInput
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing pulumi.BoolPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// The DNS name of the ELB
 	DnsName pulumi.StringPtrInput
 	// A healthCheck block. Health Check documented below.
@@ -300,6 +306,8 @@ type loadBalancerArgs struct {
 	ConnectionDrainingTimeout *int `pulumi:"connectionDrainingTimeout"`
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing *bool `pulumi:"crossZoneLoadBalancing"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// A healthCheck block. Health Check documented below.
 	HealthCheck *LoadBalancerHealthCheck `pulumi:"healthCheck"`
 	// The time in seconds that the connection is allowed to be idle. Default: `60`
@@ -339,6 +347,8 @@ type LoadBalancerArgs struct {
 	ConnectionDrainingTimeout pulumi.IntPtrInput
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing pulumi.BoolPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// A healthCheck block. Health Check documented below.
 	HealthCheck LoadBalancerHealthCheckPtrInput
 	// The time in seconds that the connection is allowed to be idle. Default: `60`
diff --git a/sdk/go/aws/elasticloadbalancingv2/getLoadBalancer.go b/sdk/go/aws/elasticloadbalancingv2/getLoadBalancer.go
index 5ae9a20a17a..09accaf4e7c 100644
--- a/sdk/go/aws/elasticloadbalancingv2/getLoadBalancer.go
+++ b/sdk/go/aws/elasticloadbalancingv2/getLoadBalancer.go
@@ -80,10 +80,12 @@ type LookupLoadBalancerResult struct {
 	Arn                      string                    `pulumi:"arn"`
 	ArnSuffix                string                    `pulumi:"arnSuffix"`
 	CustomerOwnedIpv4Pool    string                    `pulumi:"customerOwnedIpv4Pool"`
+	DesyncMitigationMode     string                    `pulumi:"desyncMitigationMode"`
 	DnsName                  string                    `pulumi:"dnsName"`
 	DropInvalidHeaderFields  bool                      `pulumi:"dropInvalidHeaderFields"`
 	EnableDeletionProtection bool                      `pulumi:"enableDeletionProtection"`
 	EnableHttp2              bool                      `pulumi:"enableHttp2"`
+	EnableWafFailOpen        bool                      `pulumi:"enableWafFailOpen"`
 	// The provider-assigned unique ID for this managed resource.
 	Id               string                         `pulumi:"id"`
 	IdleTimeout      int                            `pulumi:"idleTimeout"`
@@ -153,6 +155,10 @@ func (o LookupLoadBalancerResultOutput) CustomerOwnedIpv4Pool() pulumi.StringOut
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.CustomerOwnedIpv4Pool }).(pulumi.StringOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) DesyncMitigationMode() pulumi.StringOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DesyncMitigationMode }).(pulumi.StringOutput)
+}
+
 func (o LookupLoadBalancerResultOutput) DnsName() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DnsName }).(pulumi.StringOutput)
 }
@@ -169,6 +175,10 @@ func (o LookupLoadBalancerResultOutput) EnableHttp2() pulumi.BoolOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.EnableHttp2 }).(pulumi.BoolOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) EnableWafFailOpen() pulumi.BoolOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.EnableWafFailOpen }).(pulumi.BoolOutput)
+}
+
 // The provider-assigned unique ID for this managed resource.
 func (o LookupLoadBalancerResultOutput) Id() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.Id }).(pulumi.StringOutput)
diff --git a/sdk/go/aws/elasticloadbalancingv2/loadBalancer.go b/sdk/go/aws/elasticloadbalancingv2/loadBalancer.go
index 33f11a9d36e..2912c14dcf9 100644
--- a/sdk/go/aws/elasticloadbalancingv2/loadBalancer.go
+++ b/sdk/go/aws/elasticloadbalancingv2/loadBalancer.go
@@ -100,6 +100,8 @@ type LoadBalancer struct {
 	ArnSuffix pulumi.StringOutput `pulumi:"arnSuffix"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrOutput `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrOutput `pulumi:"desyncMitigationMode"`
 	// The DNS name of the load balancer.
 	DnsName pulumi.StringOutput `pulumi:"dnsName"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -112,6 +114,8 @@ type LoadBalancer struct {
 	EnableDeletionProtection pulumi.BoolPtrOutput `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrOutput `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrOutput `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrOutput `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -134,7 +138,7 @@ type LoadBalancer struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayOutput `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapOutput `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
@@ -181,6 +185,8 @@ type loadBalancerState struct {
 	ArnSuffix *string `pulumi:"arnSuffix"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool *string `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// The DNS name of the load balancer.
 	DnsName *string `pulumi:"dnsName"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -193,6 +199,8 @@ type loadBalancerState struct {
 	EnableDeletionProtection *bool `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 *bool `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen *bool `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout *int `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -215,7 +223,7 @@ type loadBalancerState struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets []string `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll map[string]string `pulumi:"tagsAll"`
@@ -234,6 +242,8 @@ type LoadBalancerState struct {
 	ArnSuffix pulumi.StringPtrInput
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// The DNS name of the load balancer.
 	DnsName pulumi.StringPtrInput
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -246,6 +256,8 @@ type LoadBalancerState struct {
 	EnableDeletionProtection pulumi.BoolPtrInput
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrInput
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrInput
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrInput
 	// If true, the LB will be internal.
@@ -268,7 +280,7 @@ type LoadBalancerState struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayInput
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll pulumi.StringMapInput
@@ -287,6 +299,8 @@ type loadBalancerArgs struct {
 	AccessLogs *LoadBalancerAccessLogs `pulumi:"accessLogs"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool *string `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 	DropInvalidHeaderFields *bool `pulumi:"dropInvalidHeaderFields"`
 	// If true, cross-zone load balancing of the load balancer will be enabled.
@@ -297,6 +311,8 @@ type loadBalancerArgs struct {
 	EnableDeletionProtection *bool `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 *bool `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen *bool `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout *int `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -319,7 +335,7 @@ type loadBalancerArgs struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets []string `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 }
 
@@ -329,6 +345,8 @@ type LoadBalancerArgs struct {
 	AccessLogs LoadBalancerAccessLogsPtrInput
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 	DropInvalidHeaderFields pulumi.BoolPtrInput
 	// If true, cross-zone load balancing of the load balancer will be enabled.
@@ -339,6 +357,8 @@ type LoadBalancerArgs struct {
 	EnableDeletionProtection pulumi.BoolPtrInput
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrInput
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrInput
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrInput
 	// If true, the LB will be internal.
@@ -361,7 +381,7 @@ type LoadBalancerArgs struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayInput
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 }
 
diff --git a/sdk/go/aws/elb/getLoadBalancer.go b/sdk/go/aws/elb/getLoadBalancer.go
index 87bcaa04ba4..aab3bc479c1 100644
--- a/sdk/go/aws/elb/getLoadBalancer.go
+++ b/sdk/go/aws/elb/getLoadBalancer.go
@@ -70,6 +70,7 @@ type LookupLoadBalancerResult struct {
 	ConnectionDraining        bool                       `pulumi:"connectionDraining"`
 	ConnectionDrainingTimeout int                        `pulumi:"connectionDrainingTimeout"`
 	CrossZoneLoadBalancing    bool                       `pulumi:"crossZoneLoadBalancing"`
+	DesyncMitigationMode      string                     `pulumi:"desyncMitigationMode"`
 	DnsName                   string                     `pulumi:"dnsName"`
 	HealthCheck               GetLoadBalancerHealthCheck `pulumi:"healthCheck"`
 	// The provider-assigned unique ID for this managed resource.
@@ -146,6 +147,10 @@ func (o LookupLoadBalancerResultOutput) CrossZoneLoadBalancing() pulumi.BoolOutp
 	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.CrossZoneLoadBalancing }).(pulumi.BoolOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) DesyncMitigationMode() pulumi.StringOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DesyncMitigationMode }).(pulumi.StringOutput)
+}
+
 func (o LookupLoadBalancerResultOutput) DnsName() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DnsName }).(pulumi.StringOutput)
 }
diff --git a/sdk/go/aws/elb/loadBalancer.go b/sdk/go/aws/elb/loadBalancer.go
index 0bb2c0c7086..044f4f85988 100644
--- a/sdk/go/aws/elb/loadBalancer.go
+++ b/sdk/go/aws/elb/loadBalancer.go
@@ -115,6 +115,8 @@ type LoadBalancer struct {
 	ConnectionDrainingTimeout pulumi.IntPtrOutput `pulumi:"connectionDrainingTimeout"`
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing pulumi.BoolPtrOutput `pulumi:"crossZoneLoadBalancing"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrOutput `pulumi:"desyncMitigationMode"`
 	// The DNS name of the ELB
 	DnsName pulumi.StringOutput `pulumi:"dnsName"`
 	// A healthCheck block. Health Check documented below.
@@ -202,6 +204,8 @@ type loadBalancerState struct {
 	ConnectionDrainingTimeout *int `pulumi:"connectionDrainingTimeout"`
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing *bool `pulumi:"crossZoneLoadBalancing"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// The DNS name of the ELB
 	DnsName *string `pulumi:"dnsName"`
 	// A healthCheck block. Health Check documented below.
@@ -252,6 +256,8 @@ type LoadBalancerState struct {
 	ConnectionDrainingTimeout pulumi.IntPtrInput
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing pulumi.BoolPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// The DNS name of the ELB
 	DnsName pulumi.StringPtrInput
 	// A healthCheck block. Health Check documented below.
@@ -304,6 +310,8 @@ type loadBalancerArgs struct {
 	ConnectionDrainingTimeout *int `pulumi:"connectionDrainingTimeout"`
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing *bool `pulumi:"crossZoneLoadBalancing"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// A healthCheck block. Health Check documented below.
 	HealthCheck *LoadBalancerHealthCheck `pulumi:"healthCheck"`
 	// The time in seconds that the connection is allowed to be idle. Default: `60`
@@ -343,6 +351,8 @@ type LoadBalancerArgs struct {
 	ConnectionDrainingTimeout pulumi.IntPtrInput
 	// Enable cross-zone load balancing. Default: `true`
 	CrossZoneLoadBalancing pulumi.BoolPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// A healthCheck block. Health Check documented below.
 	HealthCheck LoadBalancerHealthCheckPtrInput
 	// The time in seconds that the connection is allowed to be idle. Default: `60`
diff --git a/sdk/go/aws/fsx/init.go b/sdk/go/aws/fsx/init.go
index 47092ee03ec..3a00934ff6e 100644
--- a/sdk/go/aws/fsx/init.go
+++ b/sdk/go/aws/fsx/init.go
@@ -27,6 +27,10 @@ func (m *module) Construct(ctx *pulumi.Context, name, typ, urn string) (r pulumi
 		r = &LustreFileSystem{}
 	case "aws:fsx/ontapFileSystem:OntapFileSystem":
 		r = &OntapFileSystem{}
+	case "aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine":
+		r = &OntapStorageVirtualMachine{}
+	case "aws:fsx/ontapVolume:OntapVolume":
+		r = &OntapVolume{}
 	case "aws:fsx/windowsFileSystem:WindowsFileSystem":
 		r = &WindowsFileSystem{}
 	default:
@@ -57,6 +61,16 @@ func init() {
 		"fsx/ontapFileSystem",
 		&module{version},
 	)
+	pulumi.RegisterResourceModule(
+		"aws",
+		"fsx/ontapStorageVirtualMachine",
+		&module{version},
+	)
+	pulumi.RegisterResourceModule(
+		"aws",
+		"fsx/ontapVolume",
+		&module{version},
+	)
 	pulumi.RegisterResourceModule(
 		"aws",
 		"fsx/windowsFileSystem",
diff --git a/sdk/go/aws/fsx/ontapStorageVirtualMachine.go b/sdk/go/aws/fsx/ontapStorageVirtualMachine.go
new file mode 100644
index 00000000000..c90be31d867
--- /dev/null
+++ b/sdk/go/aws/fsx/ontapStorageVirtualMachine.go
@@ -0,0 +1,439 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package fsx
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/pkg/errors"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+// Manages a FSx Storage Virtual Machine.
+// See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html) for more information.
+//
+// ## Example Usage
+// ### Basic Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		_, err := fsx.NewOntapStorageVirtualMachine(ctx, "test", &fsx.OntapStorageVirtualMachineArgs{
+// 			FileSystemId: pulumi.Any(aws_fsx_ontap_file_system.Test.Id),
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+// ### Using a Self-Managed Microsoft Active Directory
+//
+// Additional information for using AWS Directory Service with ONTAP File Systems can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD.html).
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		_, err := fsx.NewOntapStorageVirtualMachine(ctx, "test", &fsx.OntapStorageVirtualMachineArgs{
+// 			FileSystemId: pulumi.Any(aws_fsx_ontap_file_system.Test.Id),
+// 			ActiveDirectoryConfiguration: &fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationArgs{
+// 				NetbiosName: pulumi.String("mysvm"),
+// 				SelfManagedActiveDirectoryConfiguration: &fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs{
+// 					DnsIps: pulumi.StringArray{
+// 						pulumi.String("10.0.0.111"),
+// 						pulumi.String("10.0.0.222"),
+// 					},
+// 					DomainName: pulumi.String("corp.example.com"),
+// 					Password:   pulumi.String("avoid-plaintext-passwords"),
+// 					Username:   pulumi.String("Admin"),
+// 				},
+// 			},
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+//
+// ## Import
+//
+// FSx Storage Virtual Machine can be imported using the `id`, e.g.,
+//
+// ```sh
+//  $ pulumi import aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine example svm-12345678abcdef123
+// ```
+//
+//  Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g., terraform resource "aws_fsx_ontap_storage_virtual_machine" "example" {
+//
+// # ... other configuration ...
+//
+//  svm_admin_password = "avoid-plaintext-passwords"
+//
+// # There is no FSx API for reading svm_admin_password
+//
+//  lifecycle {
+//
+//  ignore_changes = [svm_admin_password]
+//
+//  } }
+type OntapStorageVirtualMachine struct {
+	pulumi.CustomResourceState
+
+	// Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+	ActiveDirectoryConfiguration OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput `pulumi:"activeDirectoryConfiguration"`
+	// Amazon Resource Name of the storage virtual machine.
+	Arn pulumi.StringOutput `pulumi:"arn"`
+	// The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+	Endpoints OntapStorageVirtualMachineEndpointArrayOutput `pulumi:"endpoints"`
+	// The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+	FileSystemId pulumi.StringOutput `pulumi:"fileSystemId"`
+	// The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+	Name pulumi.StringOutput `pulumi:"name"`
+	// Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+	RootVolumeSecurityStyle pulumi.StringPtrOutput `pulumi:"rootVolumeSecurityStyle"`
+	// Describes the SVM's subtype, e.g. `DEFAULT`
+	Subtype          pulumi.StringOutput    `pulumi:"subtype"`
+	SvmAdminPassword pulumi.StringPtrOutput `pulumi:"svmAdminPassword"`
+	// A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags pulumi.StringMapOutput `pulumi:"tags"`
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
+	// The SVM's UUID (universally unique identifier).
+	Uuid pulumi.StringOutput `pulumi:"uuid"`
+}
+
+// NewOntapStorageVirtualMachine registers a new resource with the given unique name, arguments, and options.
+func NewOntapStorageVirtualMachine(ctx *pulumi.Context,
+	name string, args *OntapStorageVirtualMachineArgs, opts ...pulumi.ResourceOption) (*OntapStorageVirtualMachine, error) {
+	if args == nil {
+		return nil, errors.New("missing one or more required arguments")
+	}
+
+	if args.FileSystemId == nil {
+		return nil, errors.New("invalid value for required argument 'FileSystemId'")
+	}
+	var resource OntapStorageVirtualMachine
+	err := ctx.RegisterResource("aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine", name, args, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// GetOntapStorageVirtualMachine gets an existing OntapStorageVirtualMachine resource's state with the given name, ID, and optional
+// state properties that are used to uniquely qualify the lookup (nil if not required).
+func GetOntapStorageVirtualMachine(ctx *pulumi.Context,
+	name string, id pulumi.IDInput, state *OntapStorageVirtualMachineState, opts ...pulumi.ResourceOption) (*OntapStorageVirtualMachine, error) {
+	var resource OntapStorageVirtualMachine
+	err := ctx.ReadResource("aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine", name, id, state, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// Input properties used for looking up and filtering OntapStorageVirtualMachine resources.
+type ontapStorageVirtualMachineState struct {
+	// Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+	ActiveDirectoryConfiguration *OntapStorageVirtualMachineActiveDirectoryConfiguration `pulumi:"activeDirectoryConfiguration"`
+	// Amazon Resource Name of the storage virtual machine.
+	Arn *string `pulumi:"arn"`
+	// The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+	Endpoints []OntapStorageVirtualMachineEndpoint `pulumi:"endpoints"`
+	// The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+	FileSystemId *string `pulumi:"fileSystemId"`
+	// The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+	Name *string `pulumi:"name"`
+	// Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+	RootVolumeSecurityStyle *string `pulumi:"rootVolumeSecurityStyle"`
+	// Describes the SVM's subtype, e.g. `DEFAULT`
+	Subtype          *string `pulumi:"subtype"`
+	SvmAdminPassword *string `pulumi:"svmAdminPassword"`
+	// A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags map[string]string `pulumi:"tags"`
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll map[string]string `pulumi:"tagsAll"`
+	// The SVM's UUID (universally unique identifier).
+	Uuid *string `pulumi:"uuid"`
+}
+
+type OntapStorageVirtualMachineState struct {
+	// Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+	ActiveDirectoryConfiguration OntapStorageVirtualMachineActiveDirectoryConfigurationPtrInput
+	// Amazon Resource Name of the storage virtual machine.
+	Arn pulumi.StringPtrInput
+	// The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+	Endpoints OntapStorageVirtualMachineEndpointArrayInput
+	// The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+	FileSystemId pulumi.StringPtrInput
+	// The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+	Name pulumi.StringPtrInput
+	// Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+	RootVolumeSecurityStyle pulumi.StringPtrInput
+	// Describes the SVM's subtype, e.g. `DEFAULT`
+	Subtype          pulumi.StringPtrInput
+	SvmAdminPassword pulumi.StringPtrInput
+	// A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags pulumi.StringMapInput
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll pulumi.StringMapInput
+	// The SVM's UUID (universally unique identifier).
+	Uuid pulumi.StringPtrInput
+}
+
+func (OntapStorageVirtualMachineState) ElementType() reflect.Type {
+	return reflect.TypeOf((*ontapStorageVirtualMachineState)(nil)).Elem()
+}
+
+type ontapStorageVirtualMachineArgs struct {
+	// Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+	ActiveDirectoryConfiguration *OntapStorageVirtualMachineActiveDirectoryConfiguration `pulumi:"activeDirectoryConfiguration"`
+	// The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+	FileSystemId string `pulumi:"fileSystemId"`
+	// The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+	Name *string `pulumi:"name"`
+	// Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+	RootVolumeSecurityStyle *string `pulumi:"rootVolumeSecurityStyle"`
+	SvmAdminPassword        *string `pulumi:"svmAdminPassword"`
+	// A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags map[string]string `pulumi:"tags"`
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll map[string]string `pulumi:"tagsAll"`
+}
+
+// The set of arguments for constructing a OntapStorageVirtualMachine resource.
+type OntapStorageVirtualMachineArgs struct {
+	// Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+	ActiveDirectoryConfiguration OntapStorageVirtualMachineActiveDirectoryConfigurationPtrInput
+	// The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+	FileSystemId pulumi.StringInput
+	// The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+	Name pulumi.StringPtrInput
+	// Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+	RootVolumeSecurityStyle pulumi.StringPtrInput
+	SvmAdminPassword        pulumi.StringPtrInput
+	// A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags pulumi.StringMapInput
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll pulumi.StringMapInput
+}
+
+func (OntapStorageVirtualMachineArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*ontapStorageVirtualMachineArgs)(nil)).Elem()
+}
+
+type OntapStorageVirtualMachineInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineOutput() OntapStorageVirtualMachineOutput
+	ToOntapStorageVirtualMachineOutputWithContext(ctx context.Context) OntapStorageVirtualMachineOutput
+}
+
+func (*OntapStorageVirtualMachine) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachine)(nil))
+}
+
+func (i *OntapStorageVirtualMachine) ToOntapStorageVirtualMachineOutput() OntapStorageVirtualMachineOutput {
+	return i.ToOntapStorageVirtualMachineOutputWithContext(context.Background())
+}
+
+func (i *OntapStorageVirtualMachine) ToOntapStorageVirtualMachineOutputWithContext(ctx context.Context) OntapStorageVirtualMachineOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineOutput)
+}
+
+func (i *OntapStorageVirtualMachine) ToOntapStorageVirtualMachinePtrOutput() OntapStorageVirtualMachinePtrOutput {
+	return i.ToOntapStorageVirtualMachinePtrOutputWithContext(context.Background())
+}
+
+func (i *OntapStorageVirtualMachine) ToOntapStorageVirtualMachinePtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachinePtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachinePtrOutput)
+}
+
+type OntapStorageVirtualMachinePtrInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachinePtrOutput() OntapStorageVirtualMachinePtrOutput
+	ToOntapStorageVirtualMachinePtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachinePtrOutput
+}
+
+type ontapStorageVirtualMachinePtrType OntapStorageVirtualMachineArgs
+
+func (*ontapStorageVirtualMachinePtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapStorageVirtualMachine)(nil))
+}
+
+func (i *ontapStorageVirtualMachinePtrType) ToOntapStorageVirtualMachinePtrOutput() OntapStorageVirtualMachinePtrOutput {
+	return i.ToOntapStorageVirtualMachinePtrOutputWithContext(context.Background())
+}
+
+func (i *ontapStorageVirtualMachinePtrType) ToOntapStorageVirtualMachinePtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachinePtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachinePtrOutput)
+}
+
+// OntapStorageVirtualMachineArrayInput is an input type that accepts OntapStorageVirtualMachineArray and OntapStorageVirtualMachineArrayOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineArrayInput` via:
+//
+//          OntapStorageVirtualMachineArray{ OntapStorageVirtualMachineArgs{...} }
+type OntapStorageVirtualMachineArrayInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineArrayOutput() OntapStorageVirtualMachineArrayOutput
+	ToOntapStorageVirtualMachineArrayOutputWithContext(context.Context) OntapStorageVirtualMachineArrayOutput
+}
+
+type OntapStorageVirtualMachineArray []OntapStorageVirtualMachineInput
+
+func (OntapStorageVirtualMachineArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]*OntapStorageVirtualMachine)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineArray) ToOntapStorageVirtualMachineArrayOutput() OntapStorageVirtualMachineArrayOutput {
+	return i.ToOntapStorageVirtualMachineArrayOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineArray) ToOntapStorageVirtualMachineArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineArrayOutput)
+}
+
+// OntapStorageVirtualMachineMapInput is an input type that accepts OntapStorageVirtualMachineMap and OntapStorageVirtualMachineMapOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineMapInput` via:
+//
+//          OntapStorageVirtualMachineMap{ "key": OntapStorageVirtualMachineArgs{...} }
+type OntapStorageVirtualMachineMapInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineMapOutput() OntapStorageVirtualMachineMapOutput
+	ToOntapStorageVirtualMachineMapOutputWithContext(context.Context) OntapStorageVirtualMachineMapOutput
+}
+
+type OntapStorageVirtualMachineMap map[string]OntapStorageVirtualMachineInput
+
+func (OntapStorageVirtualMachineMap) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]*OntapStorageVirtualMachine)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineMap) ToOntapStorageVirtualMachineMapOutput() OntapStorageVirtualMachineMapOutput {
+	return i.ToOntapStorageVirtualMachineMapOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineMap) ToOntapStorageVirtualMachineMapOutputWithContext(ctx context.Context) OntapStorageVirtualMachineMapOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineMapOutput)
+}
+
+type OntapStorageVirtualMachineOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachine)(nil))
+}
+
+func (o OntapStorageVirtualMachineOutput) ToOntapStorageVirtualMachineOutput() OntapStorageVirtualMachineOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineOutput) ToOntapStorageVirtualMachineOutputWithContext(ctx context.Context) OntapStorageVirtualMachineOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineOutput) ToOntapStorageVirtualMachinePtrOutput() OntapStorageVirtualMachinePtrOutput {
+	return o.ToOntapStorageVirtualMachinePtrOutputWithContext(context.Background())
+}
+
+func (o OntapStorageVirtualMachineOutput) ToOntapStorageVirtualMachinePtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachinePtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v OntapStorageVirtualMachine) *OntapStorageVirtualMachine {
+		return &v
+	}).(OntapStorageVirtualMachinePtrOutput)
+}
+
+type OntapStorageVirtualMachinePtrOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachinePtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapStorageVirtualMachine)(nil))
+}
+
+func (o OntapStorageVirtualMachinePtrOutput) ToOntapStorageVirtualMachinePtrOutput() OntapStorageVirtualMachinePtrOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachinePtrOutput) ToOntapStorageVirtualMachinePtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachinePtrOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachinePtrOutput) Elem() OntapStorageVirtualMachineOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachine) OntapStorageVirtualMachine {
+		if v != nil {
+			return *v
+		}
+		var ret OntapStorageVirtualMachine
+		return ret
+	}).(OntapStorageVirtualMachineOutput)
+}
+
+type OntapStorageVirtualMachineArrayOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachine)(nil))
+}
+
+func (o OntapStorageVirtualMachineArrayOutput) ToOntapStorageVirtualMachineArrayOutput() OntapStorageVirtualMachineArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineArrayOutput) ToOntapStorageVirtualMachineArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineArrayOutput) Index(i pulumi.IntInput) OntapStorageVirtualMachineOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) OntapStorageVirtualMachine {
+		return vs[0].([]OntapStorageVirtualMachine)[vs[1].(int)]
+	}).(OntapStorageVirtualMachineOutput)
+}
+
+type OntapStorageVirtualMachineMapOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineMapOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]OntapStorageVirtualMachine)(nil))
+}
+
+func (o OntapStorageVirtualMachineMapOutput) ToOntapStorageVirtualMachineMapOutput() OntapStorageVirtualMachineMapOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineMapOutput) ToOntapStorageVirtualMachineMapOutputWithContext(ctx context.Context) OntapStorageVirtualMachineMapOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineMapOutput) MapIndex(k pulumi.StringInput) OntapStorageVirtualMachineOutput {
+	return pulumi.All(o, k).ApplyT(func(vs []interface{}) OntapStorageVirtualMachine {
+		return vs[0].(map[string]OntapStorageVirtualMachine)[vs[1].(string)]
+	}).(OntapStorageVirtualMachineOutput)
+}
+
+func init() {
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineInput)(nil)).Elem(), &OntapStorageVirtualMachine{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachinePtrInput)(nil)).Elem(), &OntapStorageVirtualMachine{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineArrayInput)(nil)).Elem(), OntapStorageVirtualMachineArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineMapInput)(nil)).Elem(), OntapStorageVirtualMachineMap{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachinePtrOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineArrayOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineMapOutput{})
+}
diff --git a/sdk/go/aws/fsx/ontapVolume.go b/sdk/go/aws/fsx/ontapVolume.go
new file mode 100644
index 00000000000..a103c0cd19e
--- /dev/null
+++ b/sdk/go/aws/fsx/ontapVolume.go
@@ -0,0 +1,468 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package fsx
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/pkg/errors"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+// Manages a FSx ONTAP Volume.
+// See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html) for more information.
+//
+// ## Example Usage
+// ### Basic Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		_, err := fsx.NewOntapVolume(ctx, "test", &fsx.OntapVolumeArgs{
+// 			JunctionPath:             pulumi.String("/test"),
+// 			SizeInMegabytes:          pulumi.Int(1024),
+// 			StorageEfficiencyEnabled: pulumi.Bool(true),
+// 			StorageVirtualMachineId:  pulumi.Any(aws_fsx_ontap_storage_virtual_machine.Test.Id),
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+// ### Using Tiering Policy
+//
+// Additional information on tiering policy with ONTAP Volumes can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html).
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/fsx"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		_, err := fsx.NewOntapVolume(ctx, "test", &fsx.OntapVolumeArgs{
+// 			JunctionPath:             pulumi.String("/test"),
+// 			SizeInMegabytes:          pulumi.Int(1024),
+// 			StorageEfficiencyEnabled: pulumi.Bool(true),
+// 			StorageVirtualMachineId:  pulumi.Any(aws_fsx_ontap_storage_virtual_machine.Test.Id),
+// 			TieringPolicy: &fsx.OntapVolumeTieringPolicyArgs{
+// 				Name:          pulumi.String("AUTO"),
+// 				CoolingPeriod: pulumi.Int(31),
+// 			},
+// 		})
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+//
+// ## Import
+//
+// FSx ONTAP volume can be imported using the `id`, e.g.,
+//
+// ```sh
+//  $ pulumi import aws:fsx/ontapVolume:OntapVolume example fsvol-12345678abcdef123
+// ```
+type OntapVolume struct {
+	pulumi.CustomResourceState
+
+	// Amazon Resource Name of the volune.
+	Arn pulumi.StringOutput `pulumi:"arn"`
+	// Describes the file system for the volume, e.g. `fs-12345679`
+	FileSystemId pulumi.StringOutput `pulumi:"fileSystemId"`
+	// Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+	FlexcacheEndpointType pulumi.StringOutput `pulumi:"flexcacheEndpointType"`
+	// Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junctionPath must have a leading forward slash, such as `/vol3`
+	JunctionPath pulumi.StringOutput `pulumi:"junctionPath"`
+	// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+	Name pulumi.StringOutput `pulumi:"name"`
+	// Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+	OntapVolumeType pulumi.StringOutput `pulumi:"ontapVolumeType"`
+	// Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+	SecurityStyle pulumi.StringPtrOutput `pulumi:"securityStyle"`
+	// Specifies the size of the volume, in megabytes (MB), that you are creating.
+	SizeInMegabytes pulumi.IntOutput `pulumi:"sizeInMegabytes"`
+	// Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+	StorageEfficiencyEnabled pulumi.BoolOutput `pulumi:"storageEfficiencyEnabled"`
+	// Specifies the storage virtual machine in which to create the volume.
+	StorageVirtualMachineId pulumi.StringOutput `pulumi:"storageVirtualMachineId"`
+	// A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags pulumi.StringMapOutput `pulumi:"tags"`
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll       pulumi.StringMapOutput            `pulumi:"tagsAll"`
+	TieringPolicy OntapVolumeTieringPolicyPtrOutput `pulumi:"tieringPolicy"`
+	// The Volume's UUID (universally unique identifier).
+	Uuid pulumi.StringOutput `pulumi:"uuid"`
+	// The type of volume, currently the only valid value is `ONTAP`.
+	VolumeType pulumi.StringPtrOutput `pulumi:"volumeType"`
+}
+
+// NewOntapVolume registers a new resource with the given unique name, arguments, and options.
+func NewOntapVolume(ctx *pulumi.Context,
+	name string, args *OntapVolumeArgs, opts ...pulumi.ResourceOption) (*OntapVolume, error) {
+	if args == nil {
+		return nil, errors.New("missing one or more required arguments")
+	}
+
+	if args.JunctionPath == nil {
+		return nil, errors.New("invalid value for required argument 'JunctionPath'")
+	}
+	if args.SizeInMegabytes == nil {
+		return nil, errors.New("invalid value for required argument 'SizeInMegabytes'")
+	}
+	if args.StorageEfficiencyEnabled == nil {
+		return nil, errors.New("invalid value for required argument 'StorageEfficiencyEnabled'")
+	}
+	if args.StorageVirtualMachineId == nil {
+		return nil, errors.New("invalid value for required argument 'StorageVirtualMachineId'")
+	}
+	var resource OntapVolume
+	err := ctx.RegisterResource("aws:fsx/ontapVolume:OntapVolume", name, args, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// GetOntapVolume gets an existing OntapVolume resource's state with the given name, ID, and optional
+// state properties that are used to uniquely qualify the lookup (nil if not required).
+func GetOntapVolume(ctx *pulumi.Context,
+	name string, id pulumi.IDInput, state *OntapVolumeState, opts ...pulumi.ResourceOption) (*OntapVolume, error) {
+	var resource OntapVolume
+	err := ctx.ReadResource("aws:fsx/ontapVolume:OntapVolume", name, id, state, &resource, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &resource, nil
+}
+
+// Input properties used for looking up and filtering OntapVolume resources.
+type ontapVolumeState struct {
+	// Amazon Resource Name of the volune.
+	Arn *string `pulumi:"arn"`
+	// Describes the file system for the volume, e.g. `fs-12345679`
+	FileSystemId *string `pulumi:"fileSystemId"`
+	// Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+	FlexcacheEndpointType *string `pulumi:"flexcacheEndpointType"`
+	// Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junctionPath must have a leading forward slash, such as `/vol3`
+	JunctionPath *string `pulumi:"junctionPath"`
+	// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+	Name *string `pulumi:"name"`
+	// Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+	OntapVolumeType *string `pulumi:"ontapVolumeType"`
+	// Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+	SecurityStyle *string `pulumi:"securityStyle"`
+	// Specifies the size of the volume, in megabytes (MB), that you are creating.
+	SizeInMegabytes *int `pulumi:"sizeInMegabytes"`
+	// Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+	StorageEfficiencyEnabled *bool `pulumi:"storageEfficiencyEnabled"`
+	// Specifies the storage virtual machine in which to create the volume.
+	StorageVirtualMachineId *string `pulumi:"storageVirtualMachineId"`
+	// A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags map[string]string `pulumi:"tags"`
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll       map[string]string         `pulumi:"tagsAll"`
+	TieringPolicy *OntapVolumeTieringPolicy `pulumi:"tieringPolicy"`
+	// The Volume's UUID (universally unique identifier).
+	Uuid *string `pulumi:"uuid"`
+	// The type of volume, currently the only valid value is `ONTAP`.
+	VolumeType *string `pulumi:"volumeType"`
+}
+
+type OntapVolumeState struct {
+	// Amazon Resource Name of the volune.
+	Arn pulumi.StringPtrInput
+	// Describes the file system for the volume, e.g. `fs-12345679`
+	FileSystemId pulumi.StringPtrInput
+	// Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+	FlexcacheEndpointType pulumi.StringPtrInput
+	// Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junctionPath must have a leading forward slash, such as `/vol3`
+	JunctionPath pulumi.StringPtrInput
+	// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+	Name pulumi.StringPtrInput
+	// Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+	OntapVolumeType pulumi.StringPtrInput
+	// Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+	SecurityStyle pulumi.StringPtrInput
+	// Specifies the size of the volume, in megabytes (MB), that you are creating.
+	SizeInMegabytes pulumi.IntPtrInput
+	// Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+	StorageEfficiencyEnabled pulumi.BoolPtrInput
+	// Specifies the storage virtual machine in which to create the volume.
+	StorageVirtualMachineId pulumi.StringPtrInput
+	// A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags pulumi.StringMapInput
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll       pulumi.StringMapInput
+	TieringPolicy OntapVolumeTieringPolicyPtrInput
+	// The Volume's UUID (universally unique identifier).
+	Uuid pulumi.StringPtrInput
+	// The type of volume, currently the only valid value is `ONTAP`.
+	VolumeType pulumi.StringPtrInput
+}
+
+func (OntapVolumeState) ElementType() reflect.Type {
+	return reflect.TypeOf((*ontapVolumeState)(nil)).Elem()
+}
+
+type ontapVolumeArgs struct {
+	// Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junctionPath must have a leading forward slash, such as `/vol3`
+	JunctionPath string `pulumi:"junctionPath"`
+	// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+	Name *string `pulumi:"name"`
+	// Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+	SecurityStyle *string `pulumi:"securityStyle"`
+	// Specifies the size of the volume, in megabytes (MB), that you are creating.
+	SizeInMegabytes int `pulumi:"sizeInMegabytes"`
+	// Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+	StorageEfficiencyEnabled bool `pulumi:"storageEfficiencyEnabled"`
+	// Specifies the storage virtual machine in which to create the volume.
+	StorageVirtualMachineId string `pulumi:"storageVirtualMachineId"`
+	// A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags map[string]string `pulumi:"tags"`
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll       map[string]string         `pulumi:"tagsAll"`
+	TieringPolicy *OntapVolumeTieringPolicy `pulumi:"tieringPolicy"`
+	// The type of volume, currently the only valid value is `ONTAP`.
+	VolumeType *string `pulumi:"volumeType"`
+}
+
+// The set of arguments for constructing a OntapVolume resource.
+type OntapVolumeArgs struct {
+	// Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junctionPath must have a leading forward slash, such as `/vol3`
+	JunctionPath pulumi.StringInput
+	// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+	Name pulumi.StringPtrInput
+	// Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+	SecurityStyle pulumi.StringPtrInput
+	// Specifies the size of the volume, in megabytes (MB), that you are creating.
+	SizeInMegabytes pulumi.IntInput
+	// Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+	StorageEfficiencyEnabled pulumi.BoolInput
+	// Specifies the storage virtual machine in which to create the volume.
+	StorageVirtualMachineId pulumi.StringInput
+	// A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+	Tags pulumi.StringMapInput
+	// A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+	TagsAll       pulumi.StringMapInput
+	TieringPolicy OntapVolumeTieringPolicyPtrInput
+	// The type of volume, currently the only valid value is `ONTAP`.
+	VolumeType pulumi.StringPtrInput
+}
+
+func (OntapVolumeArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*ontapVolumeArgs)(nil)).Elem()
+}
+
+type OntapVolumeInput interface {
+	pulumi.Input
+
+	ToOntapVolumeOutput() OntapVolumeOutput
+	ToOntapVolumeOutputWithContext(ctx context.Context) OntapVolumeOutput
+}
+
+func (*OntapVolume) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapVolume)(nil))
+}
+
+func (i *OntapVolume) ToOntapVolumeOutput() OntapVolumeOutput {
+	return i.ToOntapVolumeOutputWithContext(context.Background())
+}
+
+func (i *OntapVolume) ToOntapVolumeOutputWithContext(ctx context.Context) OntapVolumeOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapVolumeOutput)
+}
+
+func (i *OntapVolume) ToOntapVolumePtrOutput() OntapVolumePtrOutput {
+	return i.ToOntapVolumePtrOutputWithContext(context.Background())
+}
+
+func (i *OntapVolume) ToOntapVolumePtrOutputWithContext(ctx context.Context) OntapVolumePtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapVolumePtrOutput)
+}
+
+type OntapVolumePtrInput interface {
+	pulumi.Input
+
+	ToOntapVolumePtrOutput() OntapVolumePtrOutput
+	ToOntapVolumePtrOutputWithContext(ctx context.Context) OntapVolumePtrOutput
+}
+
+type ontapVolumePtrType OntapVolumeArgs
+
+func (*ontapVolumePtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapVolume)(nil))
+}
+
+func (i *ontapVolumePtrType) ToOntapVolumePtrOutput() OntapVolumePtrOutput {
+	return i.ToOntapVolumePtrOutputWithContext(context.Background())
+}
+
+func (i *ontapVolumePtrType) ToOntapVolumePtrOutputWithContext(ctx context.Context) OntapVolumePtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapVolumePtrOutput)
+}
+
+// OntapVolumeArrayInput is an input type that accepts OntapVolumeArray and OntapVolumeArrayOutput values.
+// You can construct a concrete instance of `OntapVolumeArrayInput` via:
+//
+//          OntapVolumeArray{ OntapVolumeArgs{...} }
+type OntapVolumeArrayInput interface {
+	pulumi.Input
+
+	ToOntapVolumeArrayOutput() OntapVolumeArrayOutput
+	ToOntapVolumeArrayOutputWithContext(context.Context) OntapVolumeArrayOutput
+}
+
+type OntapVolumeArray []OntapVolumeInput
+
+func (OntapVolumeArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]*OntapVolume)(nil)).Elem()
+}
+
+func (i OntapVolumeArray) ToOntapVolumeArrayOutput() OntapVolumeArrayOutput {
+	return i.ToOntapVolumeArrayOutputWithContext(context.Background())
+}
+
+func (i OntapVolumeArray) ToOntapVolumeArrayOutputWithContext(ctx context.Context) OntapVolumeArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapVolumeArrayOutput)
+}
+
+// OntapVolumeMapInput is an input type that accepts OntapVolumeMap and OntapVolumeMapOutput values.
+// You can construct a concrete instance of `OntapVolumeMapInput` via:
+//
+//          OntapVolumeMap{ "key": OntapVolumeArgs{...} }
+type OntapVolumeMapInput interface {
+	pulumi.Input
+
+	ToOntapVolumeMapOutput() OntapVolumeMapOutput
+	ToOntapVolumeMapOutputWithContext(context.Context) OntapVolumeMapOutput
+}
+
+type OntapVolumeMap map[string]OntapVolumeInput
+
+func (OntapVolumeMap) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]*OntapVolume)(nil)).Elem()
+}
+
+func (i OntapVolumeMap) ToOntapVolumeMapOutput() OntapVolumeMapOutput {
+	return i.ToOntapVolumeMapOutputWithContext(context.Background())
+}
+
+func (i OntapVolumeMap) ToOntapVolumeMapOutputWithContext(ctx context.Context) OntapVolumeMapOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapVolumeMapOutput)
+}
+
+type OntapVolumeOutput struct{ *pulumi.OutputState }
+
+func (OntapVolumeOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapVolume)(nil))
+}
+
+func (o OntapVolumeOutput) ToOntapVolumeOutput() OntapVolumeOutput {
+	return o
+}
+
+func (o OntapVolumeOutput) ToOntapVolumeOutputWithContext(ctx context.Context) OntapVolumeOutput {
+	return o
+}
+
+func (o OntapVolumeOutput) ToOntapVolumePtrOutput() OntapVolumePtrOutput {
+	return o.ToOntapVolumePtrOutputWithContext(context.Background())
+}
+
+func (o OntapVolumeOutput) ToOntapVolumePtrOutputWithContext(ctx context.Context) OntapVolumePtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v OntapVolume) *OntapVolume {
+		return &v
+	}).(OntapVolumePtrOutput)
+}
+
+type OntapVolumePtrOutput struct{ *pulumi.OutputState }
+
+func (OntapVolumePtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapVolume)(nil))
+}
+
+func (o OntapVolumePtrOutput) ToOntapVolumePtrOutput() OntapVolumePtrOutput {
+	return o
+}
+
+func (o OntapVolumePtrOutput) ToOntapVolumePtrOutputWithContext(ctx context.Context) OntapVolumePtrOutput {
+	return o
+}
+
+func (o OntapVolumePtrOutput) Elem() OntapVolumeOutput {
+	return o.ApplyT(func(v *OntapVolume) OntapVolume {
+		if v != nil {
+			return *v
+		}
+		var ret OntapVolume
+		return ret
+	}).(OntapVolumeOutput)
+}
+
+type OntapVolumeArrayOutput struct{ *pulumi.OutputState }
+
+func (OntapVolumeArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapVolume)(nil))
+}
+
+func (o OntapVolumeArrayOutput) ToOntapVolumeArrayOutput() OntapVolumeArrayOutput {
+	return o
+}
+
+func (o OntapVolumeArrayOutput) ToOntapVolumeArrayOutputWithContext(ctx context.Context) OntapVolumeArrayOutput {
+	return o
+}
+
+func (o OntapVolumeArrayOutput) Index(i pulumi.IntInput) OntapVolumeOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) OntapVolume {
+		return vs[0].([]OntapVolume)[vs[1].(int)]
+	}).(OntapVolumeOutput)
+}
+
+type OntapVolumeMapOutput struct{ *pulumi.OutputState }
+
+func (OntapVolumeMapOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*map[string]OntapVolume)(nil))
+}
+
+func (o OntapVolumeMapOutput) ToOntapVolumeMapOutput() OntapVolumeMapOutput {
+	return o
+}
+
+func (o OntapVolumeMapOutput) ToOntapVolumeMapOutputWithContext(ctx context.Context) OntapVolumeMapOutput {
+	return o
+}
+
+func (o OntapVolumeMapOutput) MapIndex(k pulumi.StringInput) OntapVolumeOutput {
+	return pulumi.All(o, k).ApplyT(func(vs []interface{}) OntapVolume {
+		return vs[0].(map[string]OntapVolume)[vs[1].(string)]
+	}).(OntapVolumeOutput)
+}
+
+func init() {
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapVolumeInput)(nil)).Elem(), &OntapVolume{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapVolumePtrInput)(nil)).Elem(), &OntapVolume{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapVolumeArrayInput)(nil)).Elem(), OntapVolumeArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapVolumeMapInput)(nil)).Elem(), OntapVolumeMap{})
+	pulumi.RegisterOutputType(OntapVolumeOutput{})
+	pulumi.RegisterOutputType(OntapVolumePtrOutput{})
+	pulumi.RegisterOutputType(OntapVolumeArrayOutput{})
+	pulumi.RegisterOutputType(OntapVolumeMapOutput{})
+}
diff --git a/sdk/go/aws/fsx/pulumiTypes.go b/sdk/go/aws/fsx/pulumiTypes.go
index 1146b783edc..c57f71c3c07 100644
--- a/sdk/go/aws/fsx/pulumiTypes.go
+++ b/sdk/go/aws/fsx/pulumiTypes.go
@@ -484,6 +484,1102 @@ func (o OntapFileSystemEndpointManagementArrayOutput) Index(i pulumi.IntInput) O
 	}).(OntapFileSystemEndpointManagementOutput)
 }
 
+type OntapStorageVirtualMachineActiveDirectoryConfiguration struct {
+	// The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+	NetbiosName                             *string                                                                                        `pulumi:"netbiosName"`
+	SelfManagedActiveDirectoryConfiguration *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration `pulumi:"selfManagedActiveDirectoryConfiguration"`
+}
+
+// OntapStorageVirtualMachineActiveDirectoryConfigurationInput is an input type that accepts OntapStorageVirtualMachineActiveDirectoryConfigurationArgs and OntapStorageVirtualMachineActiveDirectoryConfigurationOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineActiveDirectoryConfigurationInput` via:
+//
+//          OntapStorageVirtualMachineActiveDirectoryConfigurationArgs{...}
+type OntapStorageVirtualMachineActiveDirectoryConfigurationInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineActiveDirectoryConfigurationOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationOutput
+	ToOntapStorageVirtualMachineActiveDirectoryConfigurationOutputWithContext(context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationOutput
+}
+
+type OntapStorageVirtualMachineActiveDirectoryConfigurationArgs struct {
+	// The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+	NetbiosName                             pulumi.StringPtrInput                                                                                 `pulumi:"netbiosName"`
+	SelfManagedActiveDirectoryConfiguration OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrInput `pulumi:"selfManagedActiveDirectoryConfiguration"`
+}
+
+func (OntapStorageVirtualMachineActiveDirectoryConfigurationArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineActiveDirectoryConfiguration)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineActiveDirectoryConfigurationArgs) ToOntapStorageVirtualMachineActiveDirectoryConfigurationOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationOutput {
+	return i.ToOntapStorageVirtualMachineActiveDirectoryConfigurationOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineActiveDirectoryConfigurationArgs) ToOntapStorageVirtualMachineActiveDirectoryConfigurationOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineActiveDirectoryConfigurationOutput)
+}
+
+func (i OntapStorageVirtualMachineActiveDirectoryConfigurationArgs) ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput {
+	return i.ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineActiveDirectoryConfigurationArgs) ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineActiveDirectoryConfigurationOutput).ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(ctx)
+}
+
+// OntapStorageVirtualMachineActiveDirectoryConfigurationPtrInput is an input type that accepts OntapStorageVirtualMachineActiveDirectoryConfigurationArgs, OntapStorageVirtualMachineActiveDirectoryConfigurationPtr and OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineActiveDirectoryConfigurationPtrInput` via:
+//
+//          OntapStorageVirtualMachineActiveDirectoryConfigurationArgs{...}
+//
+//  or:
+//
+//          nil
+type OntapStorageVirtualMachineActiveDirectoryConfigurationPtrInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput
+	ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput
+}
+
+type ontapStorageVirtualMachineActiveDirectoryConfigurationPtrType OntapStorageVirtualMachineActiveDirectoryConfigurationArgs
+
+func OntapStorageVirtualMachineActiveDirectoryConfigurationPtr(v *OntapStorageVirtualMachineActiveDirectoryConfigurationArgs) OntapStorageVirtualMachineActiveDirectoryConfigurationPtrInput {
+	return (*ontapStorageVirtualMachineActiveDirectoryConfigurationPtrType)(v)
+}
+
+func (*ontapStorageVirtualMachineActiveDirectoryConfigurationPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapStorageVirtualMachineActiveDirectoryConfiguration)(nil)).Elem()
+}
+
+func (i *ontapStorageVirtualMachineActiveDirectoryConfigurationPtrType) ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput {
+	return i.ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(context.Background())
+}
+
+func (i *ontapStorageVirtualMachineActiveDirectoryConfigurationPtrType) ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput)
+}
+
+type OntapStorageVirtualMachineActiveDirectoryConfigurationOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineActiveDirectoryConfigurationOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineActiveDirectoryConfiguration)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput {
+	return o.ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(context.Background())
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v OntapStorageVirtualMachineActiveDirectoryConfiguration) *OntapStorageVirtualMachineActiveDirectoryConfiguration {
+		return &v
+	}).(OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput)
+}
+
+// The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationOutput) NetbiosName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineActiveDirectoryConfiguration) *string { return v.NetbiosName }).(pulumi.StringPtrOutput)
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationOutput) SelfManagedActiveDirectoryConfiguration() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineActiveDirectoryConfiguration) *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration {
+		return v.SelfManagedActiveDirectoryConfiguration
+	}).(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput)
+}
+
+type OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapStorageVirtualMachineActiveDirectoryConfiguration)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput) Elem() OntapStorageVirtualMachineActiveDirectoryConfigurationOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfiguration) OntapStorageVirtualMachineActiveDirectoryConfiguration {
+		if v != nil {
+			return *v
+		}
+		var ret OntapStorageVirtualMachineActiveDirectoryConfiguration
+		return ret
+	}).(OntapStorageVirtualMachineActiveDirectoryConfigurationOutput)
+}
+
+// The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput) NetbiosName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfiguration) *string {
+		if v == nil {
+			return nil
+		}
+		return v.NetbiosName
+	}).(pulumi.StringPtrOutput)
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput) SelfManagedActiveDirectoryConfiguration() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfiguration) *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration {
+		if v == nil {
+			return nil
+		}
+		return v.SelfManagedActiveDirectoryConfiguration
+	}).(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput)
+}
+
+type OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration struct {
+	// A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+	DnsIps []string `pulumi:"dnsIps"`
+	// The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+	DomainName string `pulumi:"domainName"`
+	// The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+	FileSystemAdministratorsGroup        *string `pulumi:"fileSystemAdministratorsGroup"`
+	OrganizationalUnitDistinguidshedName *string `pulumi:"organizationalUnitDistinguidshedName"`
+	// The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+	Password string `pulumi:"password"`
+	// The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+	Username string `pulumi:"username"`
+}
+
+// OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationInput is an input type that accepts OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs and OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationInput` via:
+//
+//          OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs{...}
+type OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput
+	ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutputWithContext(context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput
+}
+
+type OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs struct {
+	// A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+	DnsIps pulumi.StringArrayInput `pulumi:"dnsIps"`
+	// The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+	DomainName pulumi.StringInput `pulumi:"domainName"`
+	// The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+	FileSystemAdministratorsGroup        pulumi.StringPtrInput `pulumi:"fileSystemAdministratorsGroup"`
+	OrganizationalUnitDistinguidshedName pulumi.StringPtrInput `pulumi:"organizationalUnitDistinguidshedName"`
+	// The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+	Password pulumi.StringInput `pulumi:"password"`
+	// The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+	Username pulumi.StringInput `pulumi:"username"`
+}
+
+func (OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput {
+	return i.ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput)
+}
+
+func (i OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return i.ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput).ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(ctx)
+}
+
+// OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrInput is an input type that accepts OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs, OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtr and OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrInput` via:
+//
+//          OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs{...}
+//
+//  or:
+//
+//          nil
+type OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput
+	ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput
+}
+
+type ontapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrType OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs
+
+func OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtr(v *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrInput {
+	return (*ontapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrType)(v)
+}
+
+func (*ontapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration)(nil)).Elem()
+}
+
+func (i *ontapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrType) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return i.ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(context.Background())
+}
+
+func (i *ontapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrType) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput)
+}
+
+type OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return o.ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(context.Background())
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration {
+		return &v
+	}).(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput)
+}
+
+// A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) DnsIps() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) []string {
+		return v.DnsIps
+	}).(pulumi.StringArrayOutput)
+}
+
+// The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) DomainName() pulumi.StringOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) string {
+		return v.DomainName
+	}).(pulumi.StringOutput)
+}
+
+// The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) FileSystemAdministratorsGroup() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) *string {
+		return v.FileSystemAdministratorsGroup
+	}).(pulumi.StringPtrOutput)
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) OrganizationalUnitDistinguidshedName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) *string {
+		return v.OrganizationalUnitDistinguidshedName
+	}).(pulumi.StringPtrOutput)
+}
+
+// The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) Password() pulumi.StringOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) string {
+		return v.Password
+	}).(pulumi.StringOutput)
+}
+
+// The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput) Username() pulumi.StringOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) string {
+		return v.Username
+	}).(pulumi.StringOutput)
+}
+
+type OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) ToOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutputWithContext(ctx context.Context) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) Elem() OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration {
+		if v != nil {
+			return *v
+		}
+		var ret OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration
+		return ret
+	}).(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput)
+}
+
+// A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) DnsIps() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) []string {
+		if v == nil {
+			return nil
+		}
+		return v.DnsIps
+	}).(pulumi.StringArrayOutput)
+}
+
+// The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) DomainName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.DomainName
+	}).(pulumi.StringPtrOutput)
+}
+
+// The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) FileSystemAdministratorsGroup() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) *string {
+		if v == nil {
+			return nil
+		}
+		return v.FileSystemAdministratorsGroup
+	}).(pulumi.StringPtrOutput)
+}
+
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) OrganizationalUnitDistinguidshedName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) *string {
+		if v == nil {
+			return nil
+		}
+		return v.OrganizationalUnitDistinguidshedName
+	}).(pulumi.StringPtrOutput)
+}
+
+// The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) Password() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Password
+	}).(pulumi.StringPtrOutput)
+}
+
+// The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+func (o OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput) Username() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Username
+	}).(pulumi.StringPtrOutput)
+}
+
+type OntapStorageVirtualMachineEndpoint struct {
+	// An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+	Iscses []OntapStorageVirtualMachineEndpointIscse `pulumi:"iscses"`
+	// An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+	Managements []OntapStorageVirtualMachineEndpointManagement `pulumi:"managements"`
+	// An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+	Nfs []OntapStorageVirtualMachineEndpointNf `pulumi:"nfs"`
+	// An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an activeDirectoryConfiguration has been set. See Endpoint.
+	Smbs []OntapStorageVirtualMachineEndpointSmb `pulumi:"smbs"`
+}
+
+// OntapStorageVirtualMachineEndpointInput is an input type that accepts OntapStorageVirtualMachineEndpointArgs and OntapStorageVirtualMachineEndpointOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointInput` via:
+//
+//          OntapStorageVirtualMachineEndpointArgs{...}
+type OntapStorageVirtualMachineEndpointInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointOutput() OntapStorageVirtualMachineEndpointOutput
+	ToOntapStorageVirtualMachineEndpointOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointOutput
+}
+
+type OntapStorageVirtualMachineEndpointArgs struct {
+	// An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+	Iscses OntapStorageVirtualMachineEndpointIscseArrayInput `pulumi:"iscses"`
+	// An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+	Managements OntapStorageVirtualMachineEndpointManagementArrayInput `pulumi:"managements"`
+	// An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+	Nfs OntapStorageVirtualMachineEndpointNfArrayInput `pulumi:"nfs"`
+	// An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an activeDirectoryConfiguration has been set. See Endpoint.
+	Smbs OntapStorageVirtualMachineEndpointSmbArrayInput `pulumi:"smbs"`
+}
+
+func (OntapStorageVirtualMachineEndpointArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpoint)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointArgs) ToOntapStorageVirtualMachineEndpointOutput() OntapStorageVirtualMachineEndpointOutput {
+	return i.ToOntapStorageVirtualMachineEndpointOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointArgs) ToOntapStorageVirtualMachineEndpointOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointOutput)
+}
+
+// OntapStorageVirtualMachineEndpointArrayInput is an input type that accepts OntapStorageVirtualMachineEndpointArray and OntapStorageVirtualMachineEndpointArrayOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointArrayInput` via:
+//
+//          OntapStorageVirtualMachineEndpointArray{ OntapStorageVirtualMachineEndpointArgs{...} }
+type OntapStorageVirtualMachineEndpointArrayInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointArrayOutput() OntapStorageVirtualMachineEndpointArrayOutput
+	ToOntapStorageVirtualMachineEndpointArrayOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointArrayOutput
+}
+
+type OntapStorageVirtualMachineEndpointArray []OntapStorageVirtualMachineEndpointInput
+
+func (OntapStorageVirtualMachineEndpointArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpoint)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointArray) ToOntapStorageVirtualMachineEndpointArrayOutput() OntapStorageVirtualMachineEndpointArrayOutput {
+	return i.ToOntapStorageVirtualMachineEndpointArrayOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointArray) ToOntapStorageVirtualMachineEndpointArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpoint)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointOutput) ToOntapStorageVirtualMachineEndpointOutput() OntapStorageVirtualMachineEndpointOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointOutput) ToOntapStorageVirtualMachineEndpointOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointOutput {
+	return o
+}
+
+// An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+func (o OntapStorageVirtualMachineEndpointOutput) Iscses() OntapStorageVirtualMachineEndpointIscseArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpoint) []OntapStorageVirtualMachineEndpointIscse { return v.Iscses }).(OntapStorageVirtualMachineEndpointIscseArrayOutput)
+}
+
+// An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+func (o OntapStorageVirtualMachineEndpointOutput) Managements() OntapStorageVirtualMachineEndpointManagementArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpoint) []OntapStorageVirtualMachineEndpointManagement {
+		return v.Managements
+	}).(OntapStorageVirtualMachineEndpointManagementArrayOutput)
+}
+
+// An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+func (o OntapStorageVirtualMachineEndpointOutput) Nfs() OntapStorageVirtualMachineEndpointNfArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpoint) []OntapStorageVirtualMachineEndpointNf { return v.Nfs }).(OntapStorageVirtualMachineEndpointNfArrayOutput)
+}
+
+// An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an activeDirectoryConfiguration has been set. See Endpoint.
+func (o OntapStorageVirtualMachineEndpointOutput) Smbs() OntapStorageVirtualMachineEndpointSmbArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpoint) []OntapStorageVirtualMachineEndpointSmb { return v.Smbs }).(OntapStorageVirtualMachineEndpointSmbArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointArrayOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpoint)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointArrayOutput) ToOntapStorageVirtualMachineEndpointArrayOutput() OntapStorageVirtualMachineEndpointArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointArrayOutput) ToOntapStorageVirtualMachineEndpointArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointArrayOutput) Index(i pulumi.IntInput) OntapStorageVirtualMachineEndpointOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) OntapStorageVirtualMachineEndpoint {
+		return vs[0].([]OntapStorageVirtualMachineEndpoint)[vs[1].(int)]
+	}).(OntapStorageVirtualMachineEndpointOutput)
+}
+
+type OntapStorageVirtualMachineEndpointIscse struct {
+	// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+	DnsName *string `pulumi:"dnsName"`
+	// IP addresses of the storage virtual machine endpoint.
+	IpAddresses []string `pulumi:"ipAddresses"`
+}
+
+// OntapStorageVirtualMachineEndpointIscseInput is an input type that accepts OntapStorageVirtualMachineEndpointIscseArgs and OntapStorageVirtualMachineEndpointIscseOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointIscseInput` via:
+//
+//          OntapStorageVirtualMachineEndpointIscseArgs{...}
+type OntapStorageVirtualMachineEndpointIscseInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointIscseOutput() OntapStorageVirtualMachineEndpointIscseOutput
+	ToOntapStorageVirtualMachineEndpointIscseOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointIscseOutput
+}
+
+type OntapStorageVirtualMachineEndpointIscseArgs struct {
+	// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+	DnsName pulumi.StringPtrInput `pulumi:"dnsName"`
+	// IP addresses of the storage virtual machine endpoint.
+	IpAddresses pulumi.StringArrayInput `pulumi:"ipAddresses"`
+}
+
+func (OntapStorageVirtualMachineEndpointIscseArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpointIscse)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointIscseArgs) ToOntapStorageVirtualMachineEndpointIscseOutput() OntapStorageVirtualMachineEndpointIscseOutput {
+	return i.ToOntapStorageVirtualMachineEndpointIscseOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointIscseArgs) ToOntapStorageVirtualMachineEndpointIscseOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointIscseOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointIscseOutput)
+}
+
+// OntapStorageVirtualMachineEndpointIscseArrayInput is an input type that accepts OntapStorageVirtualMachineEndpointIscseArray and OntapStorageVirtualMachineEndpointIscseArrayOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointIscseArrayInput` via:
+//
+//          OntapStorageVirtualMachineEndpointIscseArray{ OntapStorageVirtualMachineEndpointIscseArgs{...} }
+type OntapStorageVirtualMachineEndpointIscseArrayInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointIscseArrayOutput() OntapStorageVirtualMachineEndpointIscseArrayOutput
+	ToOntapStorageVirtualMachineEndpointIscseArrayOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointIscseArrayOutput
+}
+
+type OntapStorageVirtualMachineEndpointIscseArray []OntapStorageVirtualMachineEndpointIscseInput
+
+func (OntapStorageVirtualMachineEndpointIscseArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpointIscse)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointIscseArray) ToOntapStorageVirtualMachineEndpointIscseArrayOutput() OntapStorageVirtualMachineEndpointIscseArrayOutput {
+	return i.ToOntapStorageVirtualMachineEndpointIscseArrayOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointIscseArray) ToOntapStorageVirtualMachineEndpointIscseArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointIscseArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointIscseArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointIscseOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointIscseOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpointIscse)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointIscseOutput) ToOntapStorageVirtualMachineEndpointIscseOutput() OntapStorageVirtualMachineEndpointIscseOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointIscseOutput) ToOntapStorageVirtualMachineEndpointIscseOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointIscseOutput {
+	return o
+}
+
+// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+func (o OntapStorageVirtualMachineEndpointIscseOutput) DnsName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpointIscse) *string { return v.DnsName }).(pulumi.StringPtrOutput)
+}
+
+// IP addresses of the storage virtual machine endpoint.
+func (o OntapStorageVirtualMachineEndpointIscseOutput) IpAddresses() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpointIscse) []string { return v.IpAddresses }).(pulumi.StringArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointIscseArrayOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointIscseArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpointIscse)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointIscseArrayOutput) ToOntapStorageVirtualMachineEndpointIscseArrayOutput() OntapStorageVirtualMachineEndpointIscseArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointIscseArrayOutput) ToOntapStorageVirtualMachineEndpointIscseArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointIscseArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointIscseArrayOutput) Index(i pulumi.IntInput) OntapStorageVirtualMachineEndpointIscseOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) OntapStorageVirtualMachineEndpointIscse {
+		return vs[0].([]OntapStorageVirtualMachineEndpointIscse)[vs[1].(int)]
+	}).(OntapStorageVirtualMachineEndpointIscseOutput)
+}
+
+type OntapStorageVirtualMachineEndpointManagement struct {
+	// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+	DnsName *string `pulumi:"dnsName"`
+	// IP addresses of the storage virtual machine endpoint.
+	IpAddresses []string `pulumi:"ipAddresses"`
+}
+
+// OntapStorageVirtualMachineEndpointManagementInput is an input type that accepts OntapStorageVirtualMachineEndpointManagementArgs and OntapStorageVirtualMachineEndpointManagementOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointManagementInput` via:
+//
+//          OntapStorageVirtualMachineEndpointManagementArgs{...}
+type OntapStorageVirtualMachineEndpointManagementInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointManagementOutput() OntapStorageVirtualMachineEndpointManagementOutput
+	ToOntapStorageVirtualMachineEndpointManagementOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointManagementOutput
+}
+
+type OntapStorageVirtualMachineEndpointManagementArgs struct {
+	// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+	DnsName pulumi.StringPtrInput `pulumi:"dnsName"`
+	// IP addresses of the storage virtual machine endpoint.
+	IpAddresses pulumi.StringArrayInput `pulumi:"ipAddresses"`
+}
+
+func (OntapStorageVirtualMachineEndpointManagementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpointManagement)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointManagementArgs) ToOntapStorageVirtualMachineEndpointManagementOutput() OntapStorageVirtualMachineEndpointManagementOutput {
+	return i.ToOntapStorageVirtualMachineEndpointManagementOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointManagementArgs) ToOntapStorageVirtualMachineEndpointManagementOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointManagementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointManagementOutput)
+}
+
+// OntapStorageVirtualMachineEndpointManagementArrayInput is an input type that accepts OntapStorageVirtualMachineEndpointManagementArray and OntapStorageVirtualMachineEndpointManagementArrayOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointManagementArrayInput` via:
+//
+//          OntapStorageVirtualMachineEndpointManagementArray{ OntapStorageVirtualMachineEndpointManagementArgs{...} }
+type OntapStorageVirtualMachineEndpointManagementArrayInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointManagementArrayOutput() OntapStorageVirtualMachineEndpointManagementArrayOutput
+	ToOntapStorageVirtualMachineEndpointManagementArrayOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointManagementArrayOutput
+}
+
+type OntapStorageVirtualMachineEndpointManagementArray []OntapStorageVirtualMachineEndpointManagementInput
+
+func (OntapStorageVirtualMachineEndpointManagementArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpointManagement)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointManagementArray) ToOntapStorageVirtualMachineEndpointManagementArrayOutput() OntapStorageVirtualMachineEndpointManagementArrayOutput {
+	return i.ToOntapStorageVirtualMachineEndpointManagementArrayOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointManagementArray) ToOntapStorageVirtualMachineEndpointManagementArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointManagementArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointManagementArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointManagementOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointManagementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpointManagement)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointManagementOutput) ToOntapStorageVirtualMachineEndpointManagementOutput() OntapStorageVirtualMachineEndpointManagementOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointManagementOutput) ToOntapStorageVirtualMachineEndpointManagementOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointManagementOutput {
+	return o
+}
+
+// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+func (o OntapStorageVirtualMachineEndpointManagementOutput) DnsName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpointManagement) *string { return v.DnsName }).(pulumi.StringPtrOutput)
+}
+
+// IP addresses of the storage virtual machine endpoint.
+func (o OntapStorageVirtualMachineEndpointManagementOutput) IpAddresses() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpointManagement) []string { return v.IpAddresses }).(pulumi.StringArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointManagementArrayOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointManagementArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpointManagement)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointManagementArrayOutput) ToOntapStorageVirtualMachineEndpointManagementArrayOutput() OntapStorageVirtualMachineEndpointManagementArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointManagementArrayOutput) ToOntapStorageVirtualMachineEndpointManagementArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointManagementArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointManagementArrayOutput) Index(i pulumi.IntInput) OntapStorageVirtualMachineEndpointManagementOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) OntapStorageVirtualMachineEndpointManagement {
+		return vs[0].([]OntapStorageVirtualMachineEndpointManagement)[vs[1].(int)]
+	}).(OntapStorageVirtualMachineEndpointManagementOutput)
+}
+
+type OntapStorageVirtualMachineEndpointNf struct {
+	// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+	DnsName *string `pulumi:"dnsName"`
+	// IP addresses of the storage virtual machine endpoint.
+	IpAddresses []string `pulumi:"ipAddresses"`
+}
+
+// OntapStorageVirtualMachineEndpointNfInput is an input type that accepts OntapStorageVirtualMachineEndpointNfArgs and OntapStorageVirtualMachineEndpointNfOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointNfInput` via:
+//
+//          OntapStorageVirtualMachineEndpointNfArgs{...}
+type OntapStorageVirtualMachineEndpointNfInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointNfOutput() OntapStorageVirtualMachineEndpointNfOutput
+	ToOntapStorageVirtualMachineEndpointNfOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointNfOutput
+}
+
+type OntapStorageVirtualMachineEndpointNfArgs struct {
+	// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+	DnsName pulumi.StringPtrInput `pulumi:"dnsName"`
+	// IP addresses of the storage virtual machine endpoint.
+	IpAddresses pulumi.StringArrayInput `pulumi:"ipAddresses"`
+}
+
+func (OntapStorageVirtualMachineEndpointNfArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpointNf)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointNfArgs) ToOntapStorageVirtualMachineEndpointNfOutput() OntapStorageVirtualMachineEndpointNfOutput {
+	return i.ToOntapStorageVirtualMachineEndpointNfOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointNfArgs) ToOntapStorageVirtualMachineEndpointNfOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointNfOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointNfOutput)
+}
+
+// OntapStorageVirtualMachineEndpointNfArrayInput is an input type that accepts OntapStorageVirtualMachineEndpointNfArray and OntapStorageVirtualMachineEndpointNfArrayOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointNfArrayInput` via:
+//
+//          OntapStorageVirtualMachineEndpointNfArray{ OntapStorageVirtualMachineEndpointNfArgs{...} }
+type OntapStorageVirtualMachineEndpointNfArrayInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointNfArrayOutput() OntapStorageVirtualMachineEndpointNfArrayOutput
+	ToOntapStorageVirtualMachineEndpointNfArrayOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointNfArrayOutput
+}
+
+type OntapStorageVirtualMachineEndpointNfArray []OntapStorageVirtualMachineEndpointNfInput
+
+func (OntapStorageVirtualMachineEndpointNfArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpointNf)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointNfArray) ToOntapStorageVirtualMachineEndpointNfArrayOutput() OntapStorageVirtualMachineEndpointNfArrayOutput {
+	return i.ToOntapStorageVirtualMachineEndpointNfArrayOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointNfArray) ToOntapStorageVirtualMachineEndpointNfArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointNfArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointNfArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointNfOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointNfOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpointNf)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointNfOutput) ToOntapStorageVirtualMachineEndpointNfOutput() OntapStorageVirtualMachineEndpointNfOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointNfOutput) ToOntapStorageVirtualMachineEndpointNfOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointNfOutput {
+	return o
+}
+
+// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+func (o OntapStorageVirtualMachineEndpointNfOutput) DnsName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpointNf) *string { return v.DnsName }).(pulumi.StringPtrOutput)
+}
+
+// IP addresses of the storage virtual machine endpoint.
+func (o OntapStorageVirtualMachineEndpointNfOutput) IpAddresses() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpointNf) []string { return v.IpAddresses }).(pulumi.StringArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointNfArrayOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointNfArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpointNf)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointNfArrayOutput) ToOntapStorageVirtualMachineEndpointNfArrayOutput() OntapStorageVirtualMachineEndpointNfArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointNfArrayOutput) ToOntapStorageVirtualMachineEndpointNfArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointNfArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointNfArrayOutput) Index(i pulumi.IntInput) OntapStorageVirtualMachineEndpointNfOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) OntapStorageVirtualMachineEndpointNf {
+		return vs[0].([]OntapStorageVirtualMachineEndpointNf)[vs[1].(int)]
+	}).(OntapStorageVirtualMachineEndpointNfOutput)
+}
+
+type OntapStorageVirtualMachineEndpointSmb struct {
+	// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+	DnsName *string `pulumi:"dnsName"`
+	// IP addresses of the storage virtual machine endpoint.
+	IpAddresses []string `pulumi:"ipAddresses"`
+}
+
+// OntapStorageVirtualMachineEndpointSmbInput is an input type that accepts OntapStorageVirtualMachineEndpointSmbArgs and OntapStorageVirtualMachineEndpointSmbOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointSmbInput` via:
+//
+//          OntapStorageVirtualMachineEndpointSmbArgs{...}
+type OntapStorageVirtualMachineEndpointSmbInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointSmbOutput() OntapStorageVirtualMachineEndpointSmbOutput
+	ToOntapStorageVirtualMachineEndpointSmbOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointSmbOutput
+}
+
+type OntapStorageVirtualMachineEndpointSmbArgs struct {
+	// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+	DnsName pulumi.StringPtrInput `pulumi:"dnsName"`
+	// IP addresses of the storage virtual machine endpoint.
+	IpAddresses pulumi.StringArrayInput `pulumi:"ipAddresses"`
+}
+
+func (OntapStorageVirtualMachineEndpointSmbArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpointSmb)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointSmbArgs) ToOntapStorageVirtualMachineEndpointSmbOutput() OntapStorageVirtualMachineEndpointSmbOutput {
+	return i.ToOntapStorageVirtualMachineEndpointSmbOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointSmbArgs) ToOntapStorageVirtualMachineEndpointSmbOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointSmbOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointSmbOutput)
+}
+
+// OntapStorageVirtualMachineEndpointSmbArrayInput is an input type that accepts OntapStorageVirtualMachineEndpointSmbArray and OntapStorageVirtualMachineEndpointSmbArrayOutput values.
+// You can construct a concrete instance of `OntapStorageVirtualMachineEndpointSmbArrayInput` via:
+//
+//          OntapStorageVirtualMachineEndpointSmbArray{ OntapStorageVirtualMachineEndpointSmbArgs{...} }
+type OntapStorageVirtualMachineEndpointSmbArrayInput interface {
+	pulumi.Input
+
+	ToOntapStorageVirtualMachineEndpointSmbArrayOutput() OntapStorageVirtualMachineEndpointSmbArrayOutput
+	ToOntapStorageVirtualMachineEndpointSmbArrayOutputWithContext(context.Context) OntapStorageVirtualMachineEndpointSmbArrayOutput
+}
+
+type OntapStorageVirtualMachineEndpointSmbArray []OntapStorageVirtualMachineEndpointSmbInput
+
+func (OntapStorageVirtualMachineEndpointSmbArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpointSmb)(nil)).Elem()
+}
+
+func (i OntapStorageVirtualMachineEndpointSmbArray) ToOntapStorageVirtualMachineEndpointSmbArrayOutput() OntapStorageVirtualMachineEndpointSmbArrayOutput {
+	return i.ToOntapStorageVirtualMachineEndpointSmbArrayOutputWithContext(context.Background())
+}
+
+func (i OntapStorageVirtualMachineEndpointSmbArray) ToOntapStorageVirtualMachineEndpointSmbArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointSmbArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapStorageVirtualMachineEndpointSmbArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointSmbOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointSmbOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapStorageVirtualMachineEndpointSmb)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointSmbOutput) ToOntapStorageVirtualMachineEndpointSmbOutput() OntapStorageVirtualMachineEndpointSmbOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointSmbOutput) ToOntapStorageVirtualMachineEndpointSmbOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointSmbOutput {
+	return o
+}
+
+// The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+func (o OntapStorageVirtualMachineEndpointSmbOutput) DnsName() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpointSmb) *string { return v.DnsName }).(pulumi.StringPtrOutput)
+}
+
+// IP addresses of the storage virtual machine endpoint.
+func (o OntapStorageVirtualMachineEndpointSmbOutput) IpAddresses() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v OntapStorageVirtualMachineEndpointSmb) []string { return v.IpAddresses }).(pulumi.StringArrayOutput)
+}
+
+type OntapStorageVirtualMachineEndpointSmbArrayOutput struct{ *pulumi.OutputState }
+
+func (OntapStorageVirtualMachineEndpointSmbArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]OntapStorageVirtualMachineEndpointSmb)(nil)).Elem()
+}
+
+func (o OntapStorageVirtualMachineEndpointSmbArrayOutput) ToOntapStorageVirtualMachineEndpointSmbArrayOutput() OntapStorageVirtualMachineEndpointSmbArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointSmbArrayOutput) ToOntapStorageVirtualMachineEndpointSmbArrayOutputWithContext(ctx context.Context) OntapStorageVirtualMachineEndpointSmbArrayOutput {
+	return o
+}
+
+func (o OntapStorageVirtualMachineEndpointSmbArrayOutput) Index(i pulumi.IntInput) OntapStorageVirtualMachineEndpointSmbOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) OntapStorageVirtualMachineEndpointSmb {
+		return vs[0].([]OntapStorageVirtualMachineEndpointSmb)[vs[1].(int)]
+	}).(OntapStorageVirtualMachineEndpointSmbOutput)
+}
+
+type OntapVolumeTieringPolicy struct {
+	CoolingPeriod *int `pulumi:"coolingPeriod"`
+	// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+	Name *string `pulumi:"name"`
+}
+
+// OntapVolumeTieringPolicyInput is an input type that accepts OntapVolumeTieringPolicyArgs and OntapVolumeTieringPolicyOutput values.
+// You can construct a concrete instance of `OntapVolumeTieringPolicyInput` via:
+//
+//          OntapVolumeTieringPolicyArgs{...}
+type OntapVolumeTieringPolicyInput interface {
+	pulumi.Input
+
+	ToOntapVolumeTieringPolicyOutput() OntapVolumeTieringPolicyOutput
+	ToOntapVolumeTieringPolicyOutputWithContext(context.Context) OntapVolumeTieringPolicyOutput
+}
+
+type OntapVolumeTieringPolicyArgs struct {
+	CoolingPeriod pulumi.IntPtrInput `pulumi:"coolingPeriod"`
+	// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+	Name pulumi.StringPtrInput `pulumi:"name"`
+}
+
+func (OntapVolumeTieringPolicyArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapVolumeTieringPolicy)(nil)).Elem()
+}
+
+func (i OntapVolumeTieringPolicyArgs) ToOntapVolumeTieringPolicyOutput() OntapVolumeTieringPolicyOutput {
+	return i.ToOntapVolumeTieringPolicyOutputWithContext(context.Background())
+}
+
+func (i OntapVolumeTieringPolicyArgs) ToOntapVolumeTieringPolicyOutputWithContext(ctx context.Context) OntapVolumeTieringPolicyOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapVolumeTieringPolicyOutput)
+}
+
+func (i OntapVolumeTieringPolicyArgs) ToOntapVolumeTieringPolicyPtrOutput() OntapVolumeTieringPolicyPtrOutput {
+	return i.ToOntapVolumeTieringPolicyPtrOutputWithContext(context.Background())
+}
+
+func (i OntapVolumeTieringPolicyArgs) ToOntapVolumeTieringPolicyPtrOutputWithContext(ctx context.Context) OntapVolumeTieringPolicyPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapVolumeTieringPolicyOutput).ToOntapVolumeTieringPolicyPtrOutputWithContext(ctx)
+}
+
+// OntapVolumeTieringPolicyPtrInput is an input type that accepts OntapVolumeTieringPolicyArgs, OntapVolumeTieringPolicyPtr and OntapVolumeTieringPolicyPtrOutput values.
+// You can construct a concrete instance of `OntapVolumeTieringPolicyPtrInput` via:
+//
+//          OntapVolumeTieringPolicyArgs{...}
+//
+//  or:
+//
+//          nil
+type OntapVolumeTieringPolicyPtrInput interface {
+	pulumi.Input
+
+	ToOntapVolumeTieringPolicyPtrOutput() OntapVolumeTieringPolicyPtrOutput
+	ToOntapVolumeTieringPolicyPtrOutputWithContext(context.Context) OntapVolumeTieringPolicyPtrOutput
+}
+
+type ontapVolumeTieringPolicyPtrType OntapVolumeTieringPolicyArgs
+
+func OntapVolumeTieringPolicyPtr(v *OntapVolumeTieringPolicyArgs) OntapVolumeTieringPolicyPtrInput {
+	return (*ontapVolumeTieringPolicyPtrType)(v)
+}
+
+func (*ontapVolumeTieringPolicyPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapVolumeTieringPolicy)(nil)).Elem()
+}
+
+func (i *ontapVolumeTieringPolicyPtrType) ToOntapVolumeTieringPolicyPtrOutput() OntapVolumeTieringPolicyPtrOutput {
+	return i.ToOntapVolumeTieringPolicyPtrOutputWithContext(context.Background())
+}
+
+func (i *ontapVolumeTieringPolicyPtrType) ToOntapVolumeTieringPolicyPtrOutputWithContext(ctx context.Context) OntapVolumeTieringPolicyPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(OntapVolumeTieringPolicyPtrOutput)
+}
+
+type OntapVolumeTieringPolicyOutput struct{ *pulumi.OutputState }
+
+func (OntapVolumeTieringPolicyOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*OntapVolumeTieringPolicy)(nil)).Elem()
+}
+
+func (o OntapVolumeTieringPolicyOutput) ToOntapVolumeTieringPolicyOutput() OntapVolumeTieringPolicyOutput {
+	return o
+}
+
+func (o OntapVolumeTieringPolicyOutput) ToOntapVolumeTieringPolicyOutputWithContext(ctx context.Context) OntapVolumeTieringPolicyOutput {
+	return o
+}
+
+func (o OntapVolumeTieringPolicyOutput) ToOntapVolumeTieringPolicyPtrOutput() OntapVolumeTieringPolicyPtrOutput {
+	return o.ToOntapVolumeTieringPolicyPtrOutputWithContext(context.Background())
+}
+
+func (o OntapVolumeTieringPolicyOutput) ToOntapVolumeTieringPolicyPtrOutputWithContext(ctx context.Context) OntapVolumeTieringPolicyPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v OntapVolumeTieringPolicy) *OntapVolumeTieringPolicy {
+		return &v
+	}).(OntapVolumeTieringPolicyPtrOutput)
+}
+
+func (o OntapVolumeTieringPolicyOutput) CoolingPeriod() pulumi.IntPtrOutput {
+	return o.ApplyT(func(v OntapVolumeTieringPolicy) *int { return v.CoolingPeriod }).(pulumi.IntPtrOutput)
+}
+
+// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+func (o OntapVolumeTieringPolicyOutput) Name() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v OntapVolumeTieringPolicy) *string { return v.Name }).(pulumi.StringPtrOutput)
+}
+
+type OntapVolumeTieringPolicyPtrOutput struct{ *pulumi.OutputState }
+
+func (OntapVolumeTieringPolicyPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**OntapVolumeTieringPolicy)(nil)).Elem()
+}
+
+func (o OntapVolumeTieringPolicyPtrOutput) ToOntapVolumeTieringPolicyPtrOutput() OntapVolumeTieringPolicyPtrOutput {
+	return o
+}
+
+func (o OntapVolumeTieringPolicyPtrOutput) ToOntapVolumeTieringPolicyPtrOutputWithContext(ctx context.Context) OntapVolumeTieringPolicyPtrOutput {
+	return o
+}
+
+func (o OntapVolumeTieringPolicyPtrOutput) Elem() OntapVolumeTieringPolicyOutput {
+	return o.ApplyT(func(v *OntapVolumeTieringPolicy) OntapVolumeTieringPolicy {
+		if v != nil {
+			return *v
+		}
+		var ret OntapVolumeTieringPolicy
+		return ret
+	}).(OntapVolumeTieringPolicyOutput)
+}
+
+func (o OntapVolumeTieringPolicyPtrOutput) CoolingPeriod() pulumi.IntPtrOutput {
+	return o.ApplyT(func(v *OntapVolumeTieringPolicy) *int {
+		if v == nil {
+			return nil
+		}
+		return v.CoolingPeriod
+	}).(pulumi.IntPtrOutput)
+}
+
+// Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+func (o OntapVolumeTieringPolicyPtrOutput) Name() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *OntapVolumeTieringPolicy) *string {
+		if v == nil {
+			return nil
+		}
+		return v.Name
+	}).(pulumi.StringPtrOutput)
+}
+
 type WindowsFileSystemAuditLogConfiguration struct {
 	// The Amazon Resource Name (ARN) for the destination of the audit logs. The destination can be any Amazon CloudWatch Logs log group ARN or Amazon Kinesis Data Firehose delivery stream ARN. Can be specified when `fileAccessAuditLogLevel` and `fileShareAccessAuditLogLevel` are not set to `DISABLED`. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. The name of the Amazon Kinesis Data Firehouse delivery stream must begin with the `aws-fsx` prefix. If you do not provide a destination in `auditLogDestionation`, Amazon FSx will create and use a log stream in the CloudWatch Logs /aws/fsx/windows log group.
 	AuditLogDestination *string `pulumi:"auditLogDestination"`
@@ -902,6 +1998,22 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*OntapFileSystemEndpointInterclusterArrayInput)(nil)).Elem(), OntapFileSystemEndpointInterclusterArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*OntapFileSystemEndpointManagementInput)(nil)).Elem(), OntapFileSystemEndpointManagementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*OntapFileSystemEndpointManagementArrayInput)(nil)).Elem(), OntapFileSystemEndpointManagementArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineActiveDirectoryConfigurationInput)(nil)).Elem(), OntapStorageVirtualMachineActiveDirectoryConfigurationArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineActiveDirectoryConfigurationPtrInput)(nil)).Elem(), OntapStorageVirtualMachineActiveDirectoryConfigurationArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationInput)(nil)).Elem(), OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrInput)(nil)).Elem(), OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointArrayInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointIscseInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointIscseArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointIscseArrayInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointIscseArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointManagementInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointManagementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointManagementArrayInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointManagementArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointNfInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointNfArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointNfArrayInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointNfArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointSmbInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointSmbArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapStorageVirtualMachineEndpointSmbArrayInput)(nil)).Elem(), OntapStorageVirtualMachineEndpointSmbArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapVolumeTieringPolicyInput)(nil)).Elem(), OntapVolumeTieringPolicyArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*OntapVolumeTieringPolicyPtrInput)(nil)).Elem(), OntapVolumeTieringPolicyArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WindowsFileSystemAuditLogConfigurationInput)(nil)).Elem(), WindowsFileSystemAuditLogConfigurationArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WindowsFileSystemAuditLogConfigurationPtrInput)(nil)).Elem(), WindowsFileSystemAuditLogConfigurationArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WindowsFileSystemSelfManagedActiveDirectoryInput)(nil)).Elem(), WindowsFileSystemSelfManagedActiveDirectoryArgs{})
@@ -914,6 +2026,22 @@ func init() {
 	pulumi.RegisterOutputType(OntapFileSystemEndpointInterclusterArrayOutput{})
 	pulumi.RegisterOutputType(OntapFileSystemEndpointManagementOutput{})
 	pulumi.RegisterOutputType(OntapFileSystemEndpointManagementArrayOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineActiveDirectoryConfigurationOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineActiveDirectoryConfigurationPtrOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationPtrOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointArrayOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointIscseOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointIscseArrayOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointManagementOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointManagementArrayOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointNfOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointNfArrayOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointSmbOutput{})
+	pulumi.RegisterOutputType(OntapStorageVirtualMachineEndpointSmbArrayOutput{})
+	pulumi.RegisterOutputType(OntapVolumeTieringPolicyOutput{})
+	pulumi.RegisterOutputType(OntapVolumeTieringPolicyPtrOutput{})
 	pulumi.RegisterOutputType(WindowsFileSystemAuditLogConfigurationOutput{})
 	pulumi.RegisterOutputType(WindowsFileSystemAuditLogConfigurationPtrOutput{})
 	pulumi.RegisterOutputType(WindowsFileSystemSelfManagedActiveDirectoryOutput{})
diff --git a/sdk/go/aws/imagebuilder/getImageRecipes.go b/sdk/go/aws/imagebuilder/getImageRecipes.go
new file mode 100644
index 00000000000..6d35578a160
--- /dev/null
+++ b/sdk/go/aws/imagebuilder/getImageRecipes.go
@@ -0,0 +1,136 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+package imagebuilder
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+// Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.
+//
+// ## Example Usage
+//
+// ```go
+// package main
+//
+// import (
+// 	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/imagebuilder"
+// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+// )
+//
+// func main() {
+// 	pulumi.Run(func(ctx *pulumi.Context) error {
+// 		opt0 := "Self"
+// 		_, err := imagebuilder.GetImageRecipes(ctx, &imagebuilder.GetImageRecipesArgs{
+// 			Filters: []imagebuilder.GetImageRecipesFilter{
+// 				imagebuilder.GetImageRecipesFilter{
+// 					Name: "platform",
+// 					Values: []string{
+// 						"Linux",
+// 					},
+// 				},
+// 			},
+// 			Owner: &opt0,
+// 		}, nil)
+// 		if err != nil {
+// 			return err
+// 		}
+// 		return nil
+// 	})
+// }
+// ```
+func GetImageRecipes(ctx *pulumi.Context, args *GetImageRecipesArgs, opts ...pulumi.InvokeOption) (*GetImageRecipesResult, error) {
+	var rv GetImageRecipesResult
+	err := ctx.Invoke("aws:imagebuilder/getImageRecipes:getImageRecipes", args, &rv, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &rv, nil
+}
+
+// A collection of arguments for invoking getImageRecipes.
+type GetImageRecipesArgs struct {
+	// Configuration block(s) for filtering. Detailed below.
+	Filters []GetImageRecipesFilter `pulumi:"filters"`
+	// The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+	Owner *string `pulumi:"owner"`
+}
+
+// A collection of values returned by getImageRecipes.
+type GetImageRecipesResult struct {
+	// Set of ARNs of the matched Image Builder Image Recipes.
+	Arns    []string                `pulumi:"arns"`
+	Filters []GetImageRecipesFilter `pulumi:"filters"`
+	// The provider-assigned unique ID for this managed resource.
+	Id string `pulumi:"id"`
+	// Set of names of the matched Image Builder Image Recipes.
+	Names []string `pulumi:"names"`
+	Owner *string  `pulumi:"owner"`
+}
+
+func GetImageRecipesOutput(ctx *pulumi.Context, args GetImageRecipesOutputArgs, opts ...pulumi.InvokeOption) GetImageRecipesResultOutput {
+	return pulumi.ToOutputWithContext(context.Background(), args).
+		ApplyT(func(v interface{}) (GetImageRecipesResult, error) {
+			args := v.(GetImageRecipesArgs)
+			r, err := GetImageRecipes(ctx, &args, opts...)
+			return *r, err
+		}).(GetImageRecipesResultOutput)
+}
+
+// A collection of arguments for invoking getImageRecipes.
+type GetImageRecipesOutputArgs struct {
+	// Configuration block(s) for filtering. Detailed below.
+	Filters GetImageRecipesFilterArrayInput `pulumi:"filters"`
+	// The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+	Owner pulumi.StringPtrInput `pulumi:"owner"`
+}
+
+func (GetImageRecipesOutputArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*GetImageRecipesArgs)(nil)).Elem()
+}
+
+// A collection of values returned by getImageRecipes.
+type GetImageRecipesResultOutput struct{ *pulumi.OutputState }
+
+func (GetImageRecipesResultOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*GetImageRecipesResult)(nil)).Elem()
+}
+
+func (o GetImageRecipesResultOutput) ToGetImageRecipesResultOutput() GetImageRecipesResultOutput {
+	return o
+}
+
+func (o GetImageRecipesResultOutput) ToGetImageRecipesResultOutputWithContext(ctx context.Context) GetImageRecipesResultOutput {
+	return o
+}
+
+// Set of ARNs of the matched Image Builder Image Recipes.
+func (o GetImageRecipesResultOutput) Arns() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v GetImageRecipesResult) []string { return v.Arns }).(pulumi.StringArrayOutput)
+}
+
+func (o GetImageRecipesResultOutput) Filters() GetImageRecipesFilterArrayOutput {
+	return o.ApplyT(func(v GetImageRecipesResult) []GetImageRecipesFilter { return v.Filters }).(GetImageRecipesFilterArrayOutput)
+}
+
+// The provider-assigned unique ID for this managed resource.
+func (o GetImageRecipesResultOutput) Id() pulumi.StringOutput {
+	return o.ApplyT(func(v GetImageRecipesResult) string { return v.Id }).(pulumi.StringOutput)
+}
+
+// Set of names of the matched Image Builder Image Recipes.
+func (o GetImageRecipesResultOutput) Names() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v GetImageRecipesResult) []string { return v.Names }).(pulumi.StringArrayOutput)
+}
+
+func (o GetImageRecipesResultOutput) Owner() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v GetImageRecipesResult) *string { return v.Owner }).(pulumi.StringPtrOutput)
+}
+
+func init() {
+	pulumi.RegisterOutputType(GetImageRecipesResultOutput{})
+}
diff --git a/sdk/go/aws/imagebuilder/pulumiTypes.go b/sdk/go/aws/imagebuilder/pulumiTypes.go
index 803e65ed74e..2b071be7c65 100644
--- a/sdk/go/aws/imagebuilder/pulumiTypes.go
+++ b/sdk/go/aws/imagebuilder/pulumiTypes.go
@@ -3287,6 +3287,112 @@ func (o GetImageRecipeComponentArrayOutput) Index(i pulumi.IntInput) GetImageRec
 	}).(GetImageRecipeComponentOutput)
 }
 
+type GetImageRecipesFilter struct {
+	// The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+	Name string `pulumi:"name"`
+	// Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+	Values []string `pulumi:"values"`
+}
+
+// GetImageRecipesFilterInput is an input type that accepts GetImageRecipesFilterArgs and GetImageRecipesFilterOutput values.
+// You can construct a concrete instance of `GetImageRecipesFilterInput` via:
+//
+//          GetImageRecipesFilterArgs{...}
+type GetImageRecipesFilterInput interface {
+	pulumi.Input
+
+	ToGetImageRecipesFilterOutput() GetImageRecipesFilterOutput
+	ToGetImageRecipesFilterOutputWithContext(context.Context) GetImageRecipesFilterOutput
+}
+
+type GetImageRecipesFilterArgs struct {
+	// The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+	Name pulumi.StringInput `pulumi:"name"`
+	// Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+	Values pulumi.StringArrayInput `pulumi:"values"`
+}
+
+func (GetImageRecipesFilterArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*GetImageRecipesFilter)(nil)).Elem()
+}
+
+func (i GetImageRecipesFilterArgs) ToGetImageRecipesFilterOutput() GetImageRecipesFilterOutput {
+	return i.ToGetImageRecipesFilterOutputWithContext(context.Background())
+}
+
+func (i GetImageRecipesFilterArgs) ToGetImageRecipesFilterOutputWithContext(ctx context.Context) GetImageRecipesFilterOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(GetImageRecipesFilterOutput)
+}
+
+// GetImageRecipesFilterArrayInput is an input type that accepts GetImageRecipesFilterArray and GetImageRecipesFilterArrayOutput values.
+// You can construct a concrete instance of `GetImageRecipesFilterArrayInput` via:
+//
+//          GetImageRecipesFilterArray{ GetImageRecipesFilterArgs{...} }
+type GetImageRecipesFilterArrayInput interface {
+	pulumi.Input
+
+	ToGetImageRecipesFilterArrayOutput() GetImageRecipesFilterArrayOutput
+	ToGetImageRecipesFilterArrayOutputWithContext(context.Context) GetImageRecipesFilterArrayOutput
+}
+
+type GetImageRecipesFilterArray []GetImageRecipesFilterInput
+
+func (GetImageRecipesFilterArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]GetImageRecipesFilter)(nil)).Elem()
+}
+
+func (i GetImageRecipesFilterArray) ToGetImageRecipesFilterArrayOutput() GetImageRecipesFilterArrayOutput {
+	return i.ToGetImageRecipesFilterArrayOutputWithContext(context.Background())
+}
+
+func (i GetImageRecipesFilterArray) ToGetImageRecipesFilterArrayOutputWithContext(ctx context.Context) GetImageRecipesFilterArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(GetImageRecipesFilterArrayOutput)
+}
+
+type GetImageRecipesFilterOutput struct{ *pulumi.OutputState }
+
+func (GetImageRecipesFilterOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*GetImageRecipesFilter)(nil)).Elem()
+}
+
+func (o GetImageRecipesFilterOutput) ToGetImageRecipesFilterOutput() GetImageRecipesFilterOutput {
+	return o
+}
+
+func (o GetImageRecipesFilterOutput) ToGetImageRecipesFilterOutputWithContext(ctx context.Context) GetImageRecipesFilterOutput {
+	return o
+}
+
+// The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+func (o GetImageRecipesFilterOutput) Name() pulumi.StringOutput {
+	return o.ApplyT(func(v GetImageRecipesFilter) string { return v.Name }).(pulumi.StringOutput)
+}
+
+// Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+func (o GetImageRecipesFilterOutput) Values() pulumi.StringArrayOutput {
+	return o.ApplyT(func(v GetImageRecipesFilter) []string { return v.Values }).(pulumi.StringArrayOutput)
+}
+
+type GetImageRecipesFilterArrayOutput struct{ *pulumi.OutputState }
+
+func (GetImageRecipesFilterArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]GetImageRecipesFilter)(nil)).Elem()
+}
+
+func (o GetImageRecipesFilterArrayOutput) ToGetImageRecipesFilterArrayOutput() GetImageRecipesFilterArrayOutput {
+	return o
+}
+
+func (o GetImageRecipesFilterArrayOutput) ToGetImageRecipesFilterArrayOutputWithContext(ctx context.Context) GetImageRecipesFilterArrayOutput {
+	return o
+}
+
+func (o GetImageRecipesFilterArrayOutput) Index(i pulumi.IntInput) GetImageRecipesFilterOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) GetImageRecipesFilter {
+		return vs[0].([]GetImageRecipesFilter)[vs[1].(int)]
+	}).(GetImageRecipesFilterOutput)
+}
+
 type GetInfrastructureConfigurationLogging struct {
 	// Nested list of S3 logs settings.
 	S3Logs []GetInfrastructureConfigurationLoggingS3Log `pulumi:"s3Logs"`
@@ -3541,6 +3647,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*GetImageRecipeBlockDeviceMappingEbArrayInput)(nil)).Elem(), GetImageRecipeBlockDeviceMappingEbArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetImageRecipeComponentInput)(nil)).Elem(), GetImageRecipeComponentArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetImageRecipeComponentArrayInput)(nil)).Elem(), GetImageRecipeComponentArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*GetImageRecipesFilterInput)(nil)).Elem(), GetImageRecipesFilterArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*GetImageRecipesFilterArrayInput)(nil)).Elem(), GetImageRecipesFilterArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInfrastructureConfigurationLoggingInput)(nil)).Elem(), GetInfrastructureConfigurationLoggingArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInfrastructureConfigurationLoggingArrayInput)(nil)).Elem(), GetInfrastructureConfigurationLoggingArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*GetInfrastructureConfigurationLoggingS3LogInput)(nil)).Elem(), GetInfrastructureConfigurationLoggingS3LogArgs{})
@@ -3593,6 +3701,8 @@ func init() {
 	pulumi.RegisterOutputType(GetImageRecipeBlockDeviceMappingEbArrayOutput{})
 	pulumi.RegisterOutputType(GetImageRecipeComponentOutput{})
 	pulumi.RegisterOutputType(GetImageRecipeComponentArrayOutput{})
+	pulumi.RegisterOutputType(GetImageRecipesFilterOutput{})
+	pulumi.RegisterOutputType(GetImageRecipesFilterArrayOutput{})
 	pulumi.RegisterOutputType(GetInfrastructureConfigurationLoggingOutput{})
 	pulumi.RegisterOutputType(GetInfrastructureConfigurationLoggingArrayOutput{})
 	pulumi.RegisterOutputType(GetInfrastructureConfigurationLoggingS3LogOutput{})
diff --git a/sdk/go/aws/lambda/getFunction.go b/sdk/go/aws/lambda/getFunction.go
index 56b97e9eebd..a75f3447ae4 100644
--- a/sdk/go/aws/lambda/getFunction.go
+++ b/sdk/go/aws/lambda/getFunction.go
@@ -76,6 +76,8 @@ type LookupFunctionResult struct {
 	Handler string `pulumi:"handler"`
 	// The provider-assigned unique ID for this managed resource.
 	Id string `pulumi:"id"`
+	// The URI of the container image.
+	ImageUri string `pulumi:"imageUri"`
 	// The ARN to be used for invoking Lambda Function from API Gateway.
 	InvokeArn string `pulumi:"invokeArn"`
 	// The ARN for the KMS encryption key.
@@ -200,6 +202,11 @@ func (o LookupFunctionResultOutput) Id() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupFunctionResult) string { return v.Id }).(pulumi.StringOutput)
 }
 
+// The URI of the container image.
+func (o LookupFunctionResultOutput) ImageUri() pulumi.StringOutput {
+	return o.ApplyT(func(v LookupFunctionResult) string { return v.ImageUri }).(pulumi.StringOutput)
+}
+
 // The ARN to be used for invoking Lambda Function from API Gateway.
 func (o LookupFunctionResultOutput) InvokeArn() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupFunctionResult) string { return v.InvokeArn }).(pulumi.StringOutput)
diff --git a/sdk/go/aws/lb/getLoadBalancer.go b/sdk/go/aws/lb/getLoadBalancer.go
index 6a55b1019da..a6a15b38594 100644
--- a/sdk/go/aws/lb/getLoadBalancer.go
+++ b/sdk/go/aws/lb/getLoadBalancer.go
@@ -78,10 +78,12 @@ type LookupLoadBalancerResult struct {
 	Arn                      string                    `pulumi:"arn"`
 	ArnSuffix                string                    `pulumi:"arnSuffix"`
 	CustomerOwnedIpv4Pool    string                    `pulumi:"customerOwnedIpv4Pool"`
+	DesyncMitigationMode     string                    `pulumi:"desyncMitigationMode"`
 	DnsName                  string                    `pulumi:"dnsName"`
 	DropInvalidHeaderFields  bool                      `pulumi:"dropInvalidHeaderFields"`
 	EnableDeletionProtection bool                      `pulumi:"enableDeletionProtection"`
 	EnableHttp2              bool                      `pulumi:"enableHttp2"`
+	EnableWafFailOpen        bool                      `pulumi:"enableWafFailOpen"`
 	// The provider-assigned unique ID for this managed resource.
 	Id               string                         `pulumi:"id"`
 	IdleTimeout      int                            `pulumi:"idleTimeout"`
@@ -151,6 +153,10 @@ func (o LookupLoadBalancerResultOutput) CustomerOwnedIpv4Pool() pulumi.StringOut
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.CustomerOwnedIpv4Pool }).(pulumi.StringOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) DesyncMitigationMode() pulumi.StringOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DesyncMitigationMode }).(pulumi.StringOutput)
+}
+
 func (o LookupLoadBalancerResultOutput) DnsName() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.DnsName }).(pulumi.StringOutput)
 }
@@ -167,6 +173,10 @@ func (o LookupLoadBalancerResultOutput) EnableHttp2() pulumi.BoolOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.EnableHttp2 }).(pulumi.BoolOutput)
 }
 
+func (o LookupLoadBalancerResultOutput) EnableWafFailOpen() pulumi.BoolOutput {
+	return o.ApplyT(func(v LookupLoadBalancerResult) bool { return v.EnableWafFailOpen }).(pulumi.BoolOutput)
+}
+
 // The provider-assigned unique ID for this managed resource.
 func (o LookupLoadBalancerResultOutput) Id() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupLoadBalancerResult) string { return v.Id }).(pulumi.StringOutput)
diff --git a/sdk/go/aws/lb/loadBalancer.go b/sdk/go/aws/lb/loadBalancer.go
index 6caf098f751..3b9565ca490 100644
--- a/sdk/go/aws/lb/loadBalancer.go
+++ b/sdk/go/aws/lb/loadBalancer.go
@@ -98,6 +98,8 @@ type LoadBalancer struct {
 	ArnSuffix pulumi.StringOutput `pulumi:"arnSuffix"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrOutput `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrOutput `pulumi:"desyncMitigationMode"`
 	// The DNS name of the load balancer.
 	DnsName pulumi.StringOutput `pulumi:"dnsName"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -110,6 +112,8 @@ type LoadBalancer struct {
 	EnableDeletionProtection pulumi.BoolPtrOutput `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrOutput `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrOutput `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrOutput `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -132,7 +136,7 @@ type LoadBalancer struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayOutput `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapOutput `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
@@ -185,6 +189,8 @@ type loadBalancerState struct {
 	ArnSuffix *string `pulumi:"arnSuffix"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool *string `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// The DNS name of the load balancer.
 	DnsName *string `pulumi:"dnsName"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -197,6 +203,8 @@ type loadBalancerState struct {
 	EnableDeletionProtection *bool `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 *bool `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen *bool `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout *int `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -219,7 +227,7 @@ type loadBalancerState struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets []string `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll map[string]string `pulumi:"tagsAll"`
@@ -238,6 +246,8 @@ type LoadBalancerState struct {
 	ArnSuffix pulumi.StringPtrInput
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// The DNS name of the load balancer.
 	DnsName pulumi.StringPtrInput
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
@@ -250,6 +260,8 @@ type LoadBalancerState struct {
 	EnableDeletionProtection pulumi.BoolPtrInput
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrInput
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrInput
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrInput
 	// If true, the LB will be internal.
@@ -272,7 +284,7 @@ type LoadBalancerState struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayInput
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 	// A map of tags assigned to the resource, including those inherited from the provider .
 	TagsAll pulumi.StringMapInput
@@ -291,6 +303,8 @@ type loadBalancerArgs struct {
 	AccessLogs *LoadBalancerAccessLogs `pulumi:"accessLogs"`
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool *string `pulumi:"customerOwnedIpv4Pool"`
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode *string `pulumi:"desyncMitigationMode"`
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 	DropInvalidHeaderFields *bool `pulumi:"dropInvalidHeaderFields"`
 	// If true, cross-zone load balancing of the load balancer will be enabled.
@@ -301,6 +315,8 @@ type loadBalancerArgs struct {
 	EnableDeletionProtection *bool `pulumi:"enableDeletionProtection"`
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 *bool `pulumi:"enableHttp2"`
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen *bool `pulumi:"enableWafFailOpen"`
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout *int `pulumi:"idleTimeout"`
 	// If true, the LB will be internal.
@@ -323,7 +339,7 @@ type loadBalancerArgs struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets []string `pulumi:"subnets"`
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags map[string]string `pulumi:"tags"`
 }
 
@@ -333,6 +349,8 @@ type LoadBalancerArgs struct {
 	AccessLogs LoadBalancerAccessLogsPtrInput
 	// The ID of the customer owned ipv4 pool to use for this load balancer.
 	CustomerOwnedIpv4Pool pulumi.StringPtrInput
+	// Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+	DesyncMitigationMode pulumi.StringPtrInput
 	// Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 	DropInvalidHeaderFields pulumi.BoolPtrInput
 	// If true, cross-zone load balancing of the load balancer will be enabled.
@@ -343,6 +361,8 @@ type LoadBalancerArgs struct {
 	EnableDeletionProtection pulumi.BoolPtrInput
 	// Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
 	EnableHttp2 pulumi.BoolPtrInput
+	// Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+	EnableWafFailOpen pulumi.BoolPtrInput
 	// The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
 	IdleTimeout pulumi.IntPtrInput
 	// If true, the LB will be internal.
@@ -365,7 +385,7 @@ type LoadBalancerArgs struct {
 	// cannot be updated for Load Balancers of type `network`. Changing this value
 	// for load balancers of type `network` will force a recreation of the resource.
 	Subnets pulumi.StringArrayInput
-	// A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 	Tags pulumi.StringMapInput
 }
 
diff --git a/sdk/go/aws/pulumiTypes.go b/sdk/go/aws/pulumiTypes.go
index 43523ea7dc9..20cf455e2f7 100644
--- a/sdk/go/aws/pulumiTypes.go
+++ b/sdk/go/aws/pulumiTypes.go
@@ -383,6 +383,7 @@ func (o ProviderDefaultTagsPtrOutput) Tags() pulumi.StringMapOutput {
 
 type ProviderEndpoint struct {
 	Accessanalyzer                  *string `pulumi:"accessanalyzer"`
+	Account                         *string `pulumi:"account"`
 	Acm                             *string `pulumi:"acm"`
 	Acmpca                          *string `pulumi:"acmpca"`
 	Alexaforbusiness                *string `pulumi:"alexaforbusiness"`
@@ -696,6 +697,7 @@ type ProviderEndpointInput interface {
 
 type ProviderEndpointArgs struct {
 	Accessanalyzer                  pulumi.StringPtrInput `pulumi:"accessanalyzer"`
+	Account                         pulumi.StringPtrInput `pulumi:"account"`
 	Acm                             pulumi.StringPtrInput `pulumi:"acm"`
 	Acmpca                          pulumi.StringPtrInput `pulumi:"acmpca"`
 	Alexaforbusiness                pulumi.StringPtrInput `pulumi:"alexaforbusiness"`
@@ -1051,6 +1053,10 @@ func (o ProviderEndpointOutput) Accessanalyzer() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v ProviderEndpoint) *string { return v.Accessanalyzer }).(pulumi.StringPtrOutput)
 }
 
+func (o ProviderEndpointOutput) Account() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v ProviderEndpoint) *string { return v.Account }).(pulumi.StringPtrOutput)
+}
+
 func (o ProviderEndpointOutput) Acm() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v ProviderEndpoint) *string { return v.Acm }).(pulumi.StringPtrOutput)
 }
diff --git a/sdk/go/aws/quicksight/user.go b/sdk/go/aws/quicksight/user.go
index 4aa8816512f..70ecfedbb32 100644
--- a/sdk/go/aws/quicksight/user.go
+++ b/sdk/go/aws/quicksight/user.go
@@ -57,9 +57,9 @@ type User struct {
 	IdentityType pulumi.StringOutput `pulumi:"identityType"`
 	// The namespace. Currently, you should set this to `default`.
 	Namespace pulumi.StringPtrOutput `pulumi:"namespace"`
-	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
 	SessionName pulumi.StringPtrOutput `pulumi:"sessionName"`
-	// The Amazon QuickSight user name that you want to create for the user you are registering.
+	// The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `QUICKSIGHT`.
 	UserName pulumi.StringPtrOutput `pulumi:"userName"`
 	// The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
 	UserRole pulumi.StringOutput `pulumi:"userRole"`
@@ -115,9 +115,9 @@ type userState struct {
 	IdentityType *string `pulumi:"identityType"`
 	// The namespace. Currently, you should set this to `default`.
 	Namespace *string `pulumi:"namespace"`
-	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
 	SessionName *string `pulumi:"sessionName"`
-	// The Amazon QuickSight user name that you want to create for the user you are registering.
+	// The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `QUICKSIGHT`.
 	UserName *string `pulumi:"userName"`
 	// The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
 	UserRole *string `pulumi:"userRole"`
@@ -136,9 +136,9 @@ type UserState struct {
 	IdentityType pulumi.StringPtrInput
 	// The namespace. Currently, you should set this to `default`.
 	Namespace pulumi.StringPtrInput
-	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
 	SessionName pulumi.StringPtrInput
-	// The Amazon QuickSight user name that you want to create for the user you are registering.
+	// The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `QUICKSIGHT`.
 	UserName pulumi.StringPtrInput
 	// The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
 	UserRole pulumi.StringPtrInput
@@ -159,9 +159,9 @@ type userArgs struct {
 	IdentityType string `pulumi:"identityType"`
 	// The namespace. Currently, you should set this to `default`.
 	Namespace *string `pulumi:"namespace"`
-	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
 	SessionName *string `pulumi:"sessionName"`
-	// The Amazon QuickSight user name that you want to create for the user you are registering.
+	// The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `QUICKSIGHT`.
 	UserName *string `pulumi:"userName"`
 	// The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
 	UserRole string `pulumi:"userRole"`
@@ -179,9 +179,9 @@ type UserArgs struct {
 	IdentityType pulumi.StringInput
 	// The namespace. Currently, you should set this to `default`.
 	Namespace pulumi.StringPtrInput
-	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+	// The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
 	SessionName pulumi.StringPtrInput
-	// The Amazon QuickSight user name that you want to create for the user you are registering.
+	// The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `QUICKSIGHT`.
 	UserName pulumi.StringPtrInput
 	// The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
 	UserRole pulumi.StringInput
diff --git a/sdk/go/aws/ssm/pulumiTypes.go b/sdk/go/aws/ssm/pulumiTypes.go
index ade3fefbc9c..46e6488add2 100644
--- a/sdk/go/aws/ssm/pulumiTypes.go
+++ b/sdk/go/aws/ssm/pulumiTypes.go
@@ -15,6 +15,8 @@ type AssociationOutputLocation struct {
 	S3BucketName string `pulumi:"s3BucketName"`
 	// The S3 bucket prefix. Results stored in the root if not configured.
 	S3KeyPrefix *string `pulumi:"s3KeyPrefix"`
+	// The S3 bucket region.
+	S3Region *string `pulumi:"s3Region"`
 }
 
 // AssociationOutputLocationInput is an input type that accepts AssociationOutputLocationArgs and AssociationOutputLocationOutput values.
@@ -33,6 +35,8 @@ type AssociationOutputLocationArgs struct {
 	S3BucketName pulumi.StringInput `pulumi:"s3BucketName"`
 	// The S3 bucket prefix. Results stored in the root if not configured.
 	S3KeyPrefix pulumi.StringPtrInput `pulumi:"s3KeyPrefix"`
+	// The S3 bucket region.
+	S3Region pulumi.StringPtrInput `pulumi:"s3Region"`
 }
 
 func (AssociationOutputLocationArgs) ElementType() reflect.Type {
@@ -122,6 +126,11 @@ func (o AssociationOutputLocationOutput) S3KeyPrefix() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v AssociationOutputLocation) *string { return v.S3KeyPrefix }).(pulumi.StringPtrOutput)
 }
 
+// The S3 bucket region.
+func (o AssociationOutputLocationOutput) S3Region() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v AssociationOutputLocation) *string { return v.S3Region }).(pulumi.StringPtrOutput)
+}
+
 type AssociationOutputLocationPtrOutput struct{ *pulumi.OutputState }
 
 func (AssociationOutputLocationPtrOutput) ElementType() reflect.Type {
@@ -166,6 +175,16 @@ func (o AssociationOutputLocationPtrOutput) S3KeyPrefix() pulumi.StringPtrOutput
 	}).(pulumi.StringPtrOutput)
 }
 
+// The S3 bucket region.
+func (o AssociationOutputLocationPtrOutput) S3Region() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *AssociationOutputLocation) *string {
+		if v == nil {
+			return nil
+		}
+		return v.S3Region
+	}).(pulumi.StringPtrOutput)
+}
+
 type AssociationTarget struct {
 	// Either `InstanceIds` or `tag:Tag Name` to specify an EC2 tag.
 	Key string `pulumi:"key"`
diff --git a/sdk/go/aws/wafv2/pulumiTypes.go b/sdk/go/aws/wafv2/pulumiTypes.go
index 3640a4826d8..0e8b3484be6 100644
--- a/sdk/go/aws/wafv2/pulumiTypes.go
+++ b/sdk/go/aws/wafv2/pulumiTypes.go
@@ -107,6 +107,121 @@ func (o RegexPatternSetRegularExpressionArrayOutput) Index(i pulumi.IntInput) Re
 	}).(RegexPatternSetRegularExpressionOutput)
 }
 
+type RuleGroupCustomResponseBody struct {
+	// The payload of the custom response.
+	Content string `pulumi:"content"`
+	// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+	ContentType string `pulumi:"contentType"`
+	// A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+	Key string `pulumi:"key"`
+}
+
+// RuleGroupCustomResponseBodyInput is an input type that accepts RuleGroupCustomResponseBodyArgs and RuleGroupCustomResponseBodyOutput values.
+// You can construct a concrete instance of `RuleGroupCustomResponseBodyInput` via:
+//
+//          RuleGroupCustomResponseBodyArgs{...}
+type RuleGroupCustomResponseBodyInput interface {
+	pulumi.Input
+
+	ToRuleGroupCustomResponseBodyOutput() RuleGroupCustomResponseBodyOutput
+	ToRuleGroupCustomResponseBodyOutputWithContext(context.Context) RuleGroupCustomResponseBodyOutput
+}
+
+type RuleGroupCustomResponseBodyArgs struct {
+	// The payload of the custom response.
+	Content pulumi.StringInput `pulumi:"content"`
+	// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+	ContentType pulumi.StringInput `pulumi:"contentType"`
+	// A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+	Key pulumi.StringInput `pulumi:"key"`
+}
+
+func (RuleGroupCustomResponseBodyArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupCustomResponseBody)(nil)).Elem()
+}
+
+func (i RuleGroupCustomResponseBodyArgs) ToRuleGroupCustomResponseBodyOutput() RuleGroupCustomResponseBodyOutput {
+	return i.ToRuleGroupCustomResponseBodyOutputWithContext(context.Background())
+}
+
+func (i RuleGroupCustomResponseBodyArgs) ToRuleGroupCustomResponseBodyOutputWithContext(ctx context.Context) RuleGroupCustomResponseBodyOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupCustomResponseBodyOutput)
+}
+
+// RuleGroupCustomResponseBodyArrayInput is an input type that accepts RuleGroupCustomResponseBodyArray and RuleGroupCustomResponseBodyArrayOutput values.
+// You can construct a concrete instance of `RuleGroupCustomResponseBodyArrayInput` via:
+//
+//          RuleGroupCustomResponseBodyArray{ RuleGroupCustomResponseBodyArgs{...} }
+type RuleGroupCustomResponseBodyArrayInput interface {
+	pulumi.Input
+
+	ToRuleGroupCustomResponseBodyArrayOutput() RuleGroupCustomResponseBodyArrayOutput
+	ToRuleGroupCustomResponseBodyArrayOutputWithContext(context.Context) RuleGroupCustomResponseBodyArrayOutput
+}
+
+type RuleGroupCustomResponseBodyArray []RuleGroupCustomResponseBodyInput
+
+func (RuleGroupCustomResponseBodyArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]RuleGroupCustomResponseBody)(nil)).Elem()
+}
+
+func (i RuleGroupCustomResponseBodyArray) ToRuleGroupCustomResponseBodyArrayOutput() RuleGroupCustomResponseBodyArrayOutput {
+	return i.ToRuleGroupCustomResponseBodyArrayOutputWithContext(context.Background())
+}
+
+func (i RuleGroupCustomResponseBodyArray) ToRuleGroupCustomResponseBodyArrayOutputWithContext(ctx context.Context) RuleGroupCustomResponseBodyArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupCustomResponseBodyArrayOutput)
+}
+
+type RuleGroupCustomResponseBodyOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupCustomResponseBodyOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupCustomResponseBody)(nil)).Elem()
+}
+
+func (o RuleGroupCustomResponseBodyOutput) ToRuleGroupCustomResponseBodyOutput() RuleGroupCustomResponseBodyOutput {
+	return o
+}
+
+func (o RuleGroupCustomResponseBodyOutput) ToRuleGroupCustomResponseBodyOutputWithContext(ctx context.Context) RuleGroupCustomResponseBodyOutput {
+	return o
+}
+
+// The payload of the custom response.
+func (o RuleGroupCustomResponseBodyOutput) Content() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupCustomResponseBody) string { return v.Content }).(pulumi.StringOutput)
+}
+
+// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+func (o RuleGroupCustomResponseBodyOutput) ContentType() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupCustomResponseBody) string { return v.ContentType }).(pulumi.StringOutput)
+}
+
+// A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+func (o RuleGroupCustomResponseBodyOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupCustomResponseBody) string { return v.Key }).(pulumi.StringOutput)
+}
+
+type RuleGroupCustomResponseBodyArrayOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupCustomResponseBodyArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]RuleGroupCustomResponseBody)(nil)).Elem()
+}
+
+func (o RuleGroupCustomResponseBodyArrayOutput) ToRuleGroupCustomResponseBodyArrayOutput() RuleGroupCustomResponseBodyArrayOutput {
+	return o
+}
+
+func (o RuleGroupCustomResponseBodyArrayOutput) ToRuleGroupCustomResponseBodyArrayOutputWithContext(ctx context.Context) RuleGroupCustomResponseBodyArrayOutput {
+	return o
+}
+
+func (o RuleGroupCustomResponseBodyArrayOutput) Index(i pulumi.IntInput) RuleGroupCustomResponseBodyOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) RuleGroupCustomResponseBody {
+		return vs[0].([]RuleGroupCustomResponseBody)[vs[1].(int)]
+	}).(RuleGroupCustomResponseBodyOutput)
+}
+
 type RuleGroupRule struct {
 	// The action that AWS WAF should take on a web request when it matches the rule's statement. Settings at the `wafv2.WebAcl` level can override the rule action setting. See Action below for details.
 	Action RuleGroupRuleAction `pulumi:"action"`
@@ -114,6 +229,8 @@ type RuleGroupRule struct {
 	Name string `pulumi:"name"`
 	// If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
 	Priority int `pulumi:"priority"`
+	// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+	RuleLabels []RuleGroupRuleRuleLabel `pulumi:"ruleLabels"`
 	// The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
 	Statement RuleGroupRuleStatement `pulumi:"statement"`
 	// Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
@@ -138,6 +255,8 @@ type RuleGroupRuleArgs struct {
 	Name pulumi.StringInput `pulumi:"name"`
 	// If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
 	Priority pulumi.IntInput `pulumi:"priority"`
+	// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+	RuleLabels RuleGroupRuleRuleLabelArrayInput `pulumi:"ruleLabels"`
 	// The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
 	Statement RuleGroupRuleStatementInput `pulumi:"statement"`
 	// Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
@@ -210,6 +329,11 @@ func (o RuleGroupRuleOutput) Priority() pulumi.IntOutput {
 	return o.ApplyT(func(v RuleGroupRule) int { return v.Priority }).(pulumi.IntOutput)
 }
 
+// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+func (o RuleGroupRuleOutput) RuleLabels() RuleGroupRuleRuleLabelArrayOutput {
+	return o.ApplyT(func(v RuleGroupRule) []RuleGroupRuleRuleLabel { return v.RuleLabels }).(RuleGroupRuleRuleLabelArrayOutput)
+}
+
 // The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
 func (o RuleGroupRuleOutput) Statement() RuleGroupRuleStatementOutput {
 	return o.ApplyT(func(v RuleGroupRule) RuleGroupRuleStatement { return v.Statement }).(RuleGroupRuleStatementOutput)
@@ -589,7 +713,7 @@ func (o RuleGroupRuleActionAllowCustomRequestHandlingPtrOutput) InsertHeaders()
 }
 
 type RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name string `pulumi:"name"`
 	// The value of the custom header.
 	Value string `pulumi:"value"`
@@ -607,7 +731,7 @@ type RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderInput interface {
 }
 
 type RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderArgs struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The value of the custom header.
 	Value pulumi.StringInput `pulumi:"value"`
@@ -664,7 +788,7 @@ func (o RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderOutput) ToRuleG
 	return o
 }
 
-// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+// The label string.
 func (o RuleGroupRuleActionAllowCustomRequestHandlingInsertHeaderOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader) string { return v.Name }).(pulumi.StringOutput)
 }
@@ -832,6 +956,8 @@ func (o RuleGroupRuleActionBlockPtrOutput) CustomResponse() RuleGroupRuleActionB
 }
 
 type RuleGroupRuleActionBlockCustomResponse struct {
+	// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+	CustomResponseBodyKey *string `pulumi:"customResponseBodyKey"`
 	// The HTTP status code to return to the client.
 	ResponseCode int `pulumi:"responseCode"`
 	// The `responseHeader` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
@@ -850,6 +976,8 @@ type RuleGroupRuleActionBlockCustomResponseInput interface {
 }
 
 type RuleGroupRuleActionBlockCustomResponseArgs struct {
+	// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+	CustomResponseBodyKey pulumi.StringPtrInput `pulumi:"customResponseBodyKey"`
 	// The HTTP status code to return to the client.
 	ResponseCode pulumi.IntInput `pulumi:"responseCode"`
 	// The `responseHeader` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
@@ -933,6 +1061,11 @@ func (o RuleGroupRuleActionBlockCustomResponseOutput) ToRuleGroupRuleActionBlock
 	}).(RuleGroupRuleActionBlockCustomResponsePtrOutput)
 }
 
+// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+func (o RuleGroupRuleActionBlockCustomResponseOutput) CustomResponseBodyKey() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleActionBlockCustomResponse) *string { return v.CustomResponseBodyKey }).(pulumi.StringPtrOutput)
+}
+
 // The HTTP status code to return to the client.
 func (o RuleGroupRuleActionBlockCustomResponseOutput) ResponseCode() pulumi.IntOutput {
 	return o.ApplyT(func(v RuleGroupRuleActionBlockCustomResponse) int { return v.ResponseCode }).(pulumi.IntOutput)
@@ -969,6 +1102,16 @@ func (o RuleGroupRuleActionBlockCustomResponsePtrOutput) Elem() RuleGroupRuleAct
 	}).(RuleGroupRuleActionBlockCustomResponseOutput)
 }
 
+// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+func (o RuleGroupRuleActionBlockCustomResponsePtrOutput) CustomResponseBodyKey() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleActionBlockCustomResponse) *string {
+		if v == nil {
+			return nil
+		}
+		return v.CustomResponseBodyKey
+	}).(pulumi.StringPtrOutput)
+}
+
 // The HTTP status code to return to the client.
 func (o RuleGroupRuleActionBlockCustomResponsePtrOutput) ResponseCode() pulumi.IntPtrOutput {
 	return o.ApplyT(func(v *RuleGroupRuleActionBlockCustomResponse) *int {
@@ -990,7 +1133,7 @@ func (o RuleGroupRuleActionBlockCustomResponsePtrOutput) ResponseHeaders() RuleG
 }
 
 type RuleGroupRuleActionBlockCustomResponseResponseHeader struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name string `pulumi:"name"`
 	// The value of the custom header.
 	Value string `pulumi:"value"`
@@ -1008,7 +1151,7 @@ type RuleGroupRuleActionBlockCustomResponseResponseHeaderInput interface {
 }
 
 type RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The value of the custom header.
 	Value pulumi.StringInput `pulumi:"value"`
@@ -1065,7 +1208,7 @@ func (o RuleGroupRuleActionBlockCustomResponseResponseHeaderOutput) ToRuleGroupR
 	return o
 }
 
-// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+// The label string.
 func (o RuleGroupRuleActionBlockCustomResponseResponseHeaderOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v RuleGroupRuleActionBlockCustomResponseResponseHeader) string { return v.Name }).(pulumi.StringOutput)
 }
@@ -1374,7 +1517,7 @@ func (o RuleGroupRuleActionCountCustomRequestHandlingPtrOutput) InsertHeaders()
 }
 
 type RuleGroupRuleActionCountCustomRequestHandlingInsertHeader struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name string `pulumi:"name"`
 	// The value of the custom header.
 	Value string `pulumi:"value"`
@@ -1392,7 +1535,7 @@ type RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderInput interface {
 }
 
 type RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArgs struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The value of the custom header.
 	Value pulumi.StringInput `pulumi:"value"`
@@ -1449,7 +1592,7 @@ func (o RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderOutput) ToRuleG
 	return o
 }
 
-// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+// The label string.
 func (o RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v RuleGroupRuleActionCountCustomRequestHandlingInsertHeader) string { return v.Name }).(pulumi.StringOutput)
 }
@@ -1479,6 +1622,103 @@ func (o RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArrayOutput) In
 	}).(RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderOutput)
 }
 
+type RuleGroupRuleRuleLabel struct {
+	// The label string.
+	Name string `pulumi:"name"`
+}
+
+// RuleGroupRuleRuleLabelInput is an input type that accepts RuleGroupRuleRuleLabelArgs and RuleGroupRuleRuleLabelOutput values.
+// You can construct a concrete instance of `RuleGroupRuleRuleLabelInput` via:
+//
+//          RuleGroupRuleRuleLabelArgs{...}
+type RuleGroupRuleRuleLabelInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleRuleLabelOutput() RuleGroupRuleRuleLabelOutput
+	ToRuleGroupRuleRuleLabelOutputWithContext(context.Context) RuleGroupRuleRuleLabelOutput
+}
+
+type RuleGroupRuleRuleLabelArgs struct {
+	// The label string.
+	Name pulumi.StringInput `pulumi:"name"`
+}
+
+func (RuleGroupRuleRuleLabelArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleRuleLabel)(nil)).Elem()
+}
+
+func (i RuleGroupRuleRuleLabelArgs) ToRuleGroupRuleRuleLabelOutput() RuleGroupRuleRuleLabelOutput {
+	return i.ToRuleGroupRuleRuleLabelOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleRuleLabelArgs) ToRuleGroupRuleRuleLabelOutputWithContext(ctx context.Context) RuleGroupRuleRuleLabelOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleRuleLabelOutput)
+}
+
+// RuleGroupRuleRuleLabelArrayInput is an input type that accepts RuleGroupRuleRuleLabelArray and RuleGroupRuleRuleLabelArrayOutput values.
+// You can construct a concrete instance of `RuleGroupRuleRuleLabelArrayInput` via:
+//
+//          RuleGroupRuleRuleLabelArray{ RuleGroupRuleRuleLabelArgs{...} }
+type RuleGroupRuleRuleLabelArrayInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleRuleLabelArrayOutput() RuleGroupRuleRuleLabelArrayOutput
+	ToRuleGroupRuleRuleLabelArrayOutputWithContext(context.Context) RuleGroupRuleRuleLabelArrayOutput
+}
+
+type RuleGroupRuleRuleLabelArray []RuleGroupRuleRuleLabelInput
+
+func (RuleGroupRuleRuleLabelArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]RuleGroupRuleRuleLabel)(nil)).Elem()
+}
+
+func (i RuleGroupRuleRuleLabelArray) ToRuleGroupRuleRuleLabelArrayOutput() RuleGroupRuleRuleLabelArrayOutput {
+	return i.ToRuleGroupRuleRuleLabelArrayOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleRuleLabelArray) ToRuleGroupRuleRuleLabelArrayOutputWithContext(ctx context.Context) RuleGroupRuleRuleLabelArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleRuleLabelArrayOutput)
+}
+
+type RuleGroupRuleRuleLabelOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleRuleLabelOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleRuleLabel)(nil)).Elem()
+}
+
+func (o RuleGroupRuleRuleLabelOutput) ToRuleGroupRuleRuleLabelOutput() RuleGroupRuleRuleLabelOutput {
+	return o
+}
+
+func (o RuleGroupRuleRuleLabelOutput) ToRuleGroupRuleRuleLabelOutputWithContext(ctx context.Context) RuleGroupRuleRuleLabelOutput {
+	return o
+}
+
+// The label string.
+func (o RuleGroupRuleRuleLabelOutput) Name() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleRuleLabel) string { return v.Name }).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleRuleLabelArrayOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleRuleLabelArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]RuleGroupRuleRuleLabel)(nil)).Elem()
+}
+
+func (o RuleGroupRuleRuleLabelArrayOutput) ToRuleGroupRuleRuleLabelArrayOutput() RuleGroupRuleRuleLabelArrayOutput {
+	return o
+}
+
+func (o RuleGroupRuleRuleLabelArrayOutput) ToRuleGroupRuleRuleLabelArrayOutputWithContext(ctx context.Context) RuleGroupRuleRuleLabelArrayOutput {
+	return o
+}
+
+func (o RuleGroupRuleRuleLabelArrayOutput) Index(i pulumi.IntInput) RuleGroupRuleRuleLabelOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) RuleGroupRuleRuleLabel {
+		return vs[0].([]RuleGroupRuleRuleLabel)[vs[1].(int)]
+	}).(RuleGroupRuleRuleLabelOutput)
+}
+
 type RuleGroupRuleStatement struct {
 	// A logical rule statement used to combine other rule statements with AND logic. See AND Statement below for details.
 	AndStatement *RuleGroupRuleStatementAndStatement `pulumi:"andStatement"`
@@ -1488,6 +1728,8 @@ type RuleGroupRuleStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *RuleGroupRuleStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -1522,6 +1764,8 @@ type RuleGroupRuleStatementArgs struct {
 	GeoMatchStatement RuleGroupRuleStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement RuleGroupRuleStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -1584,6 +1828,13 @@ func (o RuleGroupRuleStatementOutput) IpSetReferenceStatement() RuleGroupRuleSta
 	}).(RuleGroupRuleStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementOutput) LabelMatchStatement() RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatement) *RuleGroupRuleStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o RuleGroupRuleStatementOutput) NotStatement() RuleGroupRuleStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatement) *RuleGroupRuleStatementNotStatement { return v.NotStatement }).(RuleGroupRuleStatementNotStatementPtrOutput)
@@ -1766,6 +2017,8 @@ type RuleGroupRuleStatementAndStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *RuleGroupRuleStatementAndStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -1800,6 +2053,8 @@ type RuleGroupRuleStatementAndStatementStatementArgs struct {
 	GeoMatchStatement RuleGroupRuleStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement RuleGroupRuleStatementAndStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -1893,6 +2148,13 @@ func (o RuleGroupRuleStatementAndStatementStatementOutput) IpSetReferenceStateme
 	}).(RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementAndStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatement) *RuleGroupRuleStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o RuleGroupRuleStatementAndStatementStatementOutput) NotStatement() RuleGroupRuleStatementAndStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatement) *RuleGroupRuleStatementAndStatementStatementNotStatement {
@@ -2101,6 +2363,8 @@ type RuleGroupRuleStatementAndStatementStatementAndStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -2129,6 +2393,8 @@ type RuleGroupRuleStatementAndStatementStatementAndStatementStatementArgs struct
 	GeoMatchStatement RuleGroupRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -2211,6 +2477,13 @@ func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementOutput)
 	}).(RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementAndStatementStatement) *RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementAndStatementStatement) *RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -4365,6 +4638,166 @@ func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetRef
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -12140,6 +12573,162 @@ func (o RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetF
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementAndStatementStatementLabelMatchStatement) *RuleGroupRuleStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementLabelMatchStatement) string { return v.Key }).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementLabelMatchStatement) string { return v.Scope }).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementLabelMatchStatement) RuleGroupRuleStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementAndStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []RuleGroupRuleStatementAndStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -12286,6 +12875,8 @@ type RuleGroupRuleStatementAndStatementStatementNotStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -12314,6 +12905,8 @@ type RuleGroupRuleStatementAndStatementStatementNotStatementStatementArgs struct
 	GeoMatchStatement RuleGroupRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -12396,6 +12989,13 @@ func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementOutput)
 	}).(RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementNotStatementStatement) *RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementNotStatementStatement) *RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -14550,6 +15150,166 @@ func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetRef
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -20371,6 +21131,8 @@ type RuleGroupRuleStatementAndStatementStatementOrStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -20399,6 +21161,8 @@ type RuleGroupRuleStatementAndStatementStatementOrStatementStatementArgs struct
 	GeoMatchStatement RuleGroupRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -20481,6 +21245,13 @@ func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementOutput) I
 	}).(RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementOrStatementStatement) *RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementOrStatementStatement) *RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -22635,6 +23406,166 @@ func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetRefe
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -36067,6 +36998,162 @@ func (o RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOu
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementLabelMatchStatementArgs and RuleGroupRuleStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementLabelMatchStatementOutput() RuleGroupRuleStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementLabelMatchStatementOutput() RuleGroupRuleStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementLabelMatchStatementArgs, RuleGroupRuleStatementLabelMatchStatementPtr and RuleGroupRuleStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementLabelMatchStatementPtrType RuleGroupRuleStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementLabelMatchStatementArgs) RuleGroupRuleStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementLabelMatchStatementOutput() RuleGroupRuleStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementLabelMatchStatement) *RuleGroupRuleStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementLabelMatchStatement) string { return v.Key }).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementLabelMatchStatement) string { return v.Scope }).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementLabelMatchStatement) RuleGroupRuleStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []RuleGroupRuleStatementNotStatementStatement `pulumi:"statements"`
@@ -36215,6 +37302,8 @@ type RuleGroupRuleStatementNotStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *RuleGroupRuleStatementNotStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -36249,6 +37338,8 @@ type RuleGroupRuleStatementNotStatementStatementArgs struct {
 	GeoMatchStatement RuleGroupRuleStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement RuleGroupRuleStatementNotStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -36342,6 +37433,13 @@ func (o RuleGroupRuleStatementNotStatementStatementOutput) IpSetReferenceStateme
 	}).(RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementNotStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatement) *RuleGroupRuleStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o RuleGroupRuleStatementNotStatementStatementOutput) NotStatement() RuleGroupRuleStatementNotStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatement) *RuleGroupRuleStatementNotStatementStatementNotStatement {
@@ -36550,6 +37648,8 @@ type RuleGroupRuleStatementNotStatementStatementAndStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -36578,6 +37678,8 @@ type RuleGroupRuleStatementNotStatementStatementAndStatementStatementArgs struct
 	GeoMatchStatement RuleGroupRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -36660,6 +37762,13 @@ func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementOutput)
 	}).(RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementAndStatementStatement) *RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementAndStatementStatement) *RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -38814,6 +39923,166 @@ func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetRef
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -46589,6 +47858,162 @@ func (o RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetF
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementNotStatementStatementLabelMatchStatement) *RuleGroupRuleStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementLabelMatchStatement) string { return v.Key }).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementLabelMatchStatement) string { return v.Scope }).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementLabelMatchStatement) RuleGroupRuleStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementNotStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []RuleGroupRuleStatementNotStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -46735,6 +48160,8 @@ type RuleGroupRuleStatementNotStatementStatementNotStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -46763,6 +48190,8 @@ type RuleGroupRuleStatementNotStatementStatementNotStatementStatementArgs struct
 	GeoMatchStatement RuleGroupRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -46845,6 +48274,13 @@ func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementOutput)
 	}).(RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementNotStatementStatement) *RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementNotStatementStatement) *RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -48999,6 +50435,166 @@ func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetRef
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -54820,6 +56416,8 @@ type RuleGroupRuleStatementNotStatementStatementOrStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -54848,6 +56446,8 @@ type RuleGroupRuleStatementNotStatementStatementOrStatementStatementArgs struct
 	GeoMatchStatement RuleGroupRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -54930,6 +56530,13 @@ func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementOutput) I
 	}).(RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementOrStatementStatement) *RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementOrStatementStatement) *RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -57084,6 +58691,166 @@ func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetRefe
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -68580,6 +70347,8 @@ type RuleGroupRuleStatementOrStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *RuleGroupRuleStatementOrStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -68614,6 +70383,8 @@ type RuleGroupRuleStatementOrStatementStatementArgs struct {
 	GeoMatchStatement RuleGroupRuleStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement RuleGroupRuleStatementOrStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -68707,6 +70478,13 @@ func (o RuleGroupRuleStatementOrStatementStatementOutput) IpSetReferenceStatemen
 	}).(RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementOrStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatement) *RuleGroupRuleStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o RuleGroupRuleStatementOrStatementStatementOutput) NotStatement() RuleGroupRuleStatementOrStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatement) *RuleGroupRuleStatementOrStatementStatementNotStatement {
@@ -68915,6 +70693,8 @@ type RuleGroupRuleStatementOrStatementStatementAndStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -68943,6 +70723,8 @@ type RuleGroupRuleStatementOrStatementStatementAndStatementStatementArgs struct
 	GeoMatchStatement RuleGroupRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -69025,6 +70807,13 @@ func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementOutput) I
 	}).(RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementAndStatementStatement) *RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementAndStatementStatement) *RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -71179,6 +72968,166 @@ func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetRefe
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -78954,6 +80903,162 @@ func (o RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetFo
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementOrStatementStatementLabelMatchStatement) *RuleGroupRuleStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementLabelMatchStatement) string { return v.Key }).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementLabelMatchStatement) string { return v.Scope }).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementLabelMatchStatement) RuleGroupRuleStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementOrStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []RuleGroupRuleStatementOrStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -79100,6 +81205,8 @@ type RuleGroupRuleStatementOrStatementStatementNotStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -79128,6 +81235,8 @@ type RuleGroupRuleStatementOrStatementStatementNotStatementStatementArgs struct
 	GeoMatchStatement RuleGroupRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -79210,6 +81319,13 @@ func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementOutput) I
 	}).(RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementNotStatementStatement) *RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementNotStatementStatement) *RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -81364,6 +83480,166 @@ func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetRefe
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -87185,6 +89461,8 @@ type RuleGroupRuleStatementOrStatementStatementOrStatementStatement struct {
 	GeoMatchStatement *RuleGroupRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -87213,6 +89491,8 @@ type RuleGroupRuleStatementOrStatementStatementOrStatementStatementArgs struct {
 	GeoMatchStatement RuleGroupRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -87295,6 +89575,13 @@ func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementOutput) Ip
 	}).(RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementOutput) LabelMatchStatement() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementOrStatementStatement) *RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementOrStatementStatement) *RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -89449,6 +91736,166 @@ func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetRefer
 	}).(pulumi.StringPtrOutput)
 }
 
+type RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs and RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput).ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs, RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr and RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type ruleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr(v *RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*ruleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*ruleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *ruleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *ruleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToRuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -106689,6 +109136,121 @@ func (o RuleGroupVisibilityConfigPtrOutput) SampledRequestsEnabled() pulumi.Bool
 	}).(pulumi.BoolPtrOutput)
 }
 
+type WebAclCustomResponseBody struct {
+	// The payload of the custom response.
+	Content string `pulumi:"content"`
+	// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+	ContentType string `pulumi:"contentType"`
+	// A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+	Key string `pulumi:"key"`
+}
+
+// WebAclCustomResponseBodyInput is an input type that accepts WebAclCustomResponseBodyArgs and WebAclCustomResponseBodyOutput values.
+// You can construct a concrete instance of `WebAclCustomResponseBodyInput` via:
+//
+//          WebAclCustomResponseBodyArgs{...}
+type WebAclCustomResponseBodyInput interface {
+	pulumi.Input
+
+	ToWebAclCustomResponseBodyOutput() WebAclCustomResponseBodyOutput
+	ToWebAclCustomResponseBodyOutputWithContext(context.Context) WebAclCustomResponseBodyOutput
+}
+
+type WebAclCustomResponseBodyArgs struct {
+	// The payload of the custom response.
+	Content pulumi.StringInput `pulumi:"content"`
+	// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+	ContentType pulumi.StringInput `pulumi:"contentType"`
+	// A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+	Key pulumi.StringInput `pulumi:"key"`
+}
+
+func (WebAclCustomResponseBodyArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclCustomResponseBody)(nil)).Elem()
+}
+
+func (i WebAclCustomResponseBodyArgs) ToWebAclCustomResponseBodyOutput() WebAclCustomResponseBodyOutput {
+	return i.ToWebAclCustomResponseBodyOutputWithContext(context.Background())
+}
+
+func (i WebAclCustomResponseBodyArgs) ToWebAclCustomResponseBodyOutputWithContext(ctx context.Context) WebAclCustomResponseBodyOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclCustomResponseBodyOutput)
+}
+
+// WebAclCustomResponseBodyArrayInput is an input type that accepts WebAclCustomResponseBodyArray and WebAclCustomResponseBodyArrayOutput values.
+// You can construct a concrete instance of `WebAclCustomResponseBodyArrayInput` via:
+//
+//          WebAclCustomResponseBodyArray{ WebAclCustomResponseBodyArgs{...} }
+type WebAclCustomResponseBodyArrayInput interface {
+	pulumi.Input
+
+	ToWebAclCustomResponseBodyArrayOutput() WebAclCustomResponseBodyArrayOutput
+	ToWebAclCustomResponseBodyArrayOutputWithContext(context.Context) WebAclCustomResponseBodyArrayOutput
+}
+
+type WebAclCustomResponseBodyArray []WebAclCustomResponseBodyInput
+
+func (WebAclCustomResponseBodyArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]WebAclCustomResponseBody)(nil)).Elem()
+}
+
+func (i WebAclCustomResponseBodyArray) ToWebAclCustomResponseBodyArrayOutput() WebAclCustomResponseBodyArrayOutput {
+	return i.ToWebAclCustomResponseBodyArrayOutputWithContext(context.Background())
+}
+
+func (i WebAclCustomResponseBodyArray) ToWebAclCustomResponseBodyArrayOutputWithContext(ctx context.Context) WebAclCustomResponseBodyArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclCustomResponseBodyArrayOutput)
+}
+
+type WebAclCustomResponseBodyOutput struct{ *pulumi.OutputState }
+
+func (WebAclCustomResponseBodyOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclCustomResponseBody)(nil)).Elem()
+}
+
+func (o WebAclCustomResponseBodyOutput) ToWebAclCustomResponseBodyOutput() WebAclCustomResponseBodyOutput {
+	return o
+}
+
+func (o WebAclCustomResponseBodyOutput) ToWebAclCustomResponseBodyOutputWithContext(ctx context.Context) WebAclCustomResponseBodyOutput {
+	return o
+}
+
+// The payload of the custom response.
+func (o WebAclCustomResponseBodyOutput) Content() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclCustomResponseBody) string { return v.Content }).(pulumi.StringOutput)
+}
+
+// The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+func (o WebAclCustomResponseBodyOutput) ContentType() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclCustomResponseBody) string { return v.ContentType }).(pulumi.StringOutput)
+}
+
+// A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+func (o WebAclCustomResponseBodyOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclCustomResponseBody) string { return v.Key }).(pulumi.StringOutput)
+}
+
+type WebAclCustomResponseBodyArrayOutput struct{ *pulumi.OutputState }
+
+func (WebAclCustomResponseBodyArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]WebAclCustomResponseBody)(nil)).Elem()
+}
+
+func (o WebAclCustomResponseBodyArrayOutput) ToWebAclCustomResponseBodyArrayOutput() WebAclCustomResponseBodyArrayOutput {
+	return o
+}
+
+func (o WebAclCustomResponseBodyArrayOutput) ToWebAclCustomResponseBodyArrayOutputWithContext(ctx context.Context) WebAclCustomResponseBodyArrayOutput {
+	return o
+}
+
+func (o WebAclCustomResponseBodyArrayOutput) Index(i pulumi.IntInput) WebAclCustomResponseBodyOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) WebAclCustomResponseBody {
+		return vs[0].([]WebAclCustomResponseBody)[vs[1].(int)]
+	}).(WebAclCustomResponseBodyOutput)
+}
+
 type WebAclDefaultAction struct {
 	// Specifies that AWS WAF should allow requests by default. See Allow below for details.
 	Allow *WebAclDefaultActionAllow `pulumi:"allow"`
@@ -107124,7 +109686,7 @@ func (o WebAclDefaultActionAllowCustomRequestHandlingPtrOutput) InsertHeaders()
 }
 
 type WebAclDefaultActionAllowCustomRequestHandlingInsertHeader struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name string `pulumi:"name"`
 	// The value of the custom header.
 	Value string `pulumi:"value"`
@@ -107142,7 +109704,7 @@ type WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderInput interface {
 }
 
 type WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderArgs struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The value of the custom header.
 	Value pulumi.StringInput `pulumi:"value"`
@@ -107199,7 +109761,7 @@ func (o WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderOutput) ToWebAc
 	return o
 }
 
-// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+// The label string.
 func (o WebAclDefaultActionAllowCustomRequestHandlingInsertHeaderOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v WebAclDefaultActionAllowCustomRequestHandlingInsertHeader) string { return v.Name }).(pulumi.StringOutput)
 }
@@ -107367,6 +109929,8 @@ func (o WebAclDefaultActionBlockPtrOutput) CustomResponse() WebAclDefaultActionB
 }
 
 type WebAclDefaultActionBlockCustomResponse struct {
+	// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+	CustomResponseBodyKey *string `pulumi:"customResponseBodyKey"`
 	// The HTTP status code to return to the client.
 	ResponseCode int `pulumi:"responseCode"`
 	// The `responseHeader` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
@@ -107385,6 +109949,8 @@ type WebAclDefaultActionBlockCustomResponseInput interface {
 }
 
 type WebAclDefaultActionBlockCustomResponseArgs struct {
+	// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+	CustomResponseBodyKey pulumi.StringPtrInput `pulumi:"customResponseBodyKey"`
 	// The HTTP status code to return to the client.
 	ResponseCode pulumi.IntInput `pulumi:"responseCode"`
 	// The `responseHeader` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
@@ -107468,6 +110034,11 @@ func (o WebAclDefaultActionBlockCustomResponseOutput) ToWebAclDefaultActionBlock
 	}).(WebAclDefaultActionBlockCustomResponsePtrOutput)
 }
 
+// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+func (o WebAclDefaultActionBlockCustomResponseOutput) CustomResponseBodyKey() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v WebAclDefaultActionBlockCustomResponse) *string { return v.CustomResponseBodyKey }).(pulumi.StringPtrOutput)
+}
+
 // The HTTP status code to return to the client.
 func (o WebAclDefaultActionBlockCustomResponseOutput) ResponseCode() pulumi.IntOutput {
 	return o.ApplyT(func(v WebAclDefaultActionBlockCustomResponse) int { return v.ResponseCode }).(pulumi.IntOutput)
@@ -107504,6 +110075,16 @@ func (o WebAclDefaultActionBlockCustomResponsePtrOutput) Elem() WebAclDefaultAct
 	}).(WebAclDefaultActionBlockCustomResponseOutput)
 }
 
+// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+func (o WebAclDefaultActionBlockCustomResponsePtrOutput) CustomResponseBodyKey() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclDefaultActionBlockCustomResponse) *string {
+		if v == nil {
+			return nil
+		}
+		return v.CustomResponseBodyKey
+	}).(pulumi.StringPtrOutput)
+}
+
 // The HTTP status code to return to the client.
 func (o WebAclDefaultActionBlockCustomResponsePtrOutput) ResponseCode() pulumi.IntPtrOutput {
 	return o.ApplyT(func(v *WebAclDefaultActionBlockCustomResponse) *int {
@@ -107525,7 +110106,7 @@ func (o WebAclDefaultActionBlockCustomResponsePtrOutput) ResponseHeaders() WebAc
 }
 
 type WebAclDefaultActionBlockCustomResponseResponseHeader struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name string `pulumi:"name"`
 	// The value of the custom header.
 	Value string `pulumi:"value"`
@@ -107543,7 +110124,7 @@ type WebAclDefaultActionBlockCustomResponseResponseHeaderInput interface {
 }
 
 type WebAclDefaultActionBlockCustomResponseResponseHeaderArgs struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The value of the custom header.
 	Value pulumi.StringInput `pulumi:"value"`
@@ -107600,7 +110181,7 @@ func (o WebAclDefaultActionBlockCustomResponseResponseHeaderOutput) ToWebAclDefa
 	return o
 }
 
-// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+// The label string.
 func (o WebAclDefaultActionBlockCustomResponseResponseHeaderOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v WebAclDefaultActionBlockCustomResponseResponseHeader) string { return v.Name }).(pulumi.StringOutput)
 }
@@ -109355,6 +111936,8 @@ type WebAclRule struct {
 	OverrideAction *WebAclRuleOverrideAction `pulumi:"overrideAction"`
 	// If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
 	Priority int `pulumi:"priority"`
+	// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+	RuleLabels []WebAclRuleRuleLabel `pulumi:"ruleLabels"`
 	// The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
 	Statement WebAclRuleStatement `pulumi:"statement"`
 	// Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
@@ -109381,6 +111964,8 @@ type WebAclRuleArgs struct {
 	OverrideAction WebAclRuleOverrideActionPtrInput `pulumi:"overrideAction"`
 	// If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
 	Priority pulumi.IntInput `pulumi:"priority"`
+	// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+	RuleLabels WebAclRuleRuleLabelArrayInput `pulumi:"ruleLabels"`
 	// The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
 	Statement WebAclRuleStatementInput `pulumi:"statement"`
 	// Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
@@ -109458,6 +112043,11 @@ func (o WebAclRuleOutput) Priority() pulumi.IntOutput {
 	return o.ApplyT(func(v WebAclRule) int { return v.Priority }).(pulumi.IntOutput)
 }
 
+// Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+func (o WebAclRuleOutput) RuleLabels() WebAclRuleRuleLabelArrayOutput {
+	return o.ApplyT(func(v WebAclRule) []WebAclRuleRuleLabel { return v.RuleLabels }).(WebAclRuleRuleLabelArrayOutput)
+}
+
 // The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
 func (o WebAclRuleOutput) Statement() WebAclRuleStatementOutput {
 	return o.ApplyT(func(v WebAclRule) WebAclRuleStatement { return v.Statement }).(WebAclRuleStatementOutput)
@@ -109942,7 +112532,7 @@ func (o WebAclRuleActionAllowCustomRequestHandlingPtrOutput) InsertHeaders() Web
 }
 
 type WebAclRuleActionAllowCustomRequestHandlingInsertHeader struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name string `pulumi:"name"`
 	// The value of the custom header.
 	Value string `pulumi:"value"`
@@ -109960,7 +112550,7 @@ type WebAclRuleActionAllowCustomRequestHandlingInsertHeaderInput interface {
 }
 
 type WebAclRuleActionAllowCustomRequestHandlingInsertHeaderArgs struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The value of the custom header.
 	Value pulumi.StringInput `pulumi:"value"`
@@ -110017,7 +112607,7 @@ func (o WebAclRuleActionAllowCustomRequestHandlingInsertHeaderOutput) ToWebAclRu
 	return o
 }
 
-// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+// The label string.
 func (o WebAclRuleActionAllowCustomRequestHandlingInsertHeaderOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v WebAclRuleActionAllowCustomRequestHandlingInsertHeader) string { return v.Name }).(pulumi.StringOutput)
 }
@@ -110185,6 +112775,8 @@ func (o WebAclRuleActionBlockPtrOutput) CustomResponse() WebAclRuleActionBlockCu
 }
 
 type WebAclRuleActionBlockCustomResponse struct {
+	// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+	CustomResponseBodyKey *string `pulumi:"customResponseBodyKey"`
 	// The HTTP status code to return to the client.
 	ResponseCode int `pulumi:"responseCode"`
 	// The `responseHeader` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
@@ -110203,6 +112795,8 @@ type WebAclRuleActionBlockCustomResponseInput interface {
 }
 
 type WebAclRuleActionBlockCustomResponseArgs struct {
+	// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+	CustomResponseBodyKey pulumi.StringPtrInput `pulumi:"customResponseBodyKey"`
 	// The HTTP status code to return to the client.
 	ResponseCode pulumi.IntInput `pulumi:"responseCode"`
 	// The `responseHeader` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
@@ -110286,6 +112880,11 @@ func (o WebAclRuleActionBlockCustomResponseOutput) ToWebAclRuleActionBlockCustom
 	}).(WebAclRuleActionBlockCustomResponsePtrOutput)
 }
 
+// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+func (o WebAclRuleActionBlockCustomResponseOutput) CustomResponseBodyKey() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v WebAclRuleActionBlockCustomResponse) *string { return v.CustomResponseBodyKey }).(pulumi.StringPtrOutput)
+}
+
 // The HTTP status code to return to the client.
 func (o WebAclRuleActionBlockCustomResponseOutput) ResponseCode() pulumi.IntOutput {
 	return o.ApplyT(func(v WebAclRuleActionBlockCustomResponse) int { return v.ResponseCode }).(pulumi.IntOutput)
@@ -110322,6 +112921,16 @@ func (o WebAclRuleActionBlockCustomResponsePtrOutput) Elem() WebAclRuleActionBlo
 	}).(WebAclRuleActionBlockCustomResponseOutput)
 }
 
+// References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+func (o WebAclRuleActionBlockCustomResponsePtrOutput) CustomResponseBodyKey() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleActionBlockCustomResponse) *string {
+		if v == nil {
+			return nil
+		}
+		return v.CustomResponseBodyKey
+	}).(pulumi.StringPtrOutput)
+}
+
 // The HTTP status code to return to the client.
 func (o WebAclRuleActionBlockCustomResponsePtrOutput) ResponseCode() pulumi.IntPtrOutput {
 	return o.ApplyT(func(v *WebAclRuleActionBlockCustomResponse) *int {
@@ -110343,7 +112952,7 @@ func (o WebAclRuleActionBlockCustomResponsePtrOutput) ResponseHeaders() WebAclRu
 }
 
 type WebAclRuleActionBlockCustomResponseResponseHeader struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name string `pulumi:"name"`
 	// The value of the custom header.
 	Value string `pulumi:"value"`
@@ -110361,7 +112970,7 @@ type WebAclRuleActionBlockCustomResponseResponseHeaderInput interface {
 }
 
 type WebAclRuleActionBlockCustomResponseResponseHeaderArgs struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The value of the custom header.
 	Value pulumi.StringInput `pulumi:"value"`
@@ -110418,7 +113027,7 @@ func (o WebAclRuleActionBlockCustomResponseResponseHeaderOutput) ToWebAclRuleAct
 	return o
 }
 
-// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+// The label string.
 func (o WebAclRuleActionBlockCustomResponseResponseHeaderOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v WebAclRuleActionBlockCustomResponseResponseHeader) string { return v.Name }).(pulumi.StringOutput)
 }
@@ -110727,7 +113336,7 @@ func (o WebAclRuleActionCountCustomRequestHandlingPtrOutput) InsertHeaders() Web
 }
 
 type WebAclRuleActionCountCustomRequestHandlingInsertHeader struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name string `pulumi:"name"`
 	// The value of the custom header.
 	Value string `pulumi:"value"`
@@ -110745,7 +113354,7 @@ type WebAclRuleActionCountCustomRequestHandlingInsertHeaderInput interface {
 }
 
 type WebAclRuleActionCountCustomRequestHandlingInsertHeaderArgs struct {
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The value of the custom header.
 	Value pulumi.StringInput `pulumi:"value"`
@@ -110802,7 +113411,7 @@ func (o WebAclRuleActionCountCustomRequestHandlingInsertHeaderOutput) ToWebAclRu
 	return o
 }
 
-// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+// The label string.
 func (o WebAclRuleActionCountCustomRequestHandlingInsertHeaderOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v WebAclRuleActionCountCustomRequestHandlingInsertHeader) string { return v.Name }).(pulumi.StringOutput)
 }
@@ -111224,6 +113833,103 @@ func (o WebAclRuleOverrideActionNonePtrOutput) Elem() WebAclRuleOverrideActionNo
 	}).(WebAclRuleOverrideActionNoneOutput)
 }
 
+type WebAclRuleRuleLabel struct {
+	// The label string.
+	Name string `pulumi:"name"`
+}
+
+// WebAclRuleRuleLabelInput is an input type that accepts WebAclRuleRuleLabelArgs and WebAclRuleRuleLabelOutput values.
+// You can construct a concrete instance of `WebAclRuleRuleLabelInput` via:
+//
+//          WebAclRuleRuleLabelArgs{...}
+type WebAclRuleRuleLabelInput interface {
+	pulumi.Input
+
+	ToWebAclRuleRuleLabelOutput() WebAclRuleRuleLabelOutput
+	ToWebAclRuleRuleLabelOutputWithContext(context.Context) WebAclRuleRuleLabelOutput
+}
+
+type WebAclRuleRuleLabelArgs struct {
+	// The label string.
+	Name pulumi.StringInput `pulumi:"name"`
+}
+
+func (WebAclRuleRuleLabelArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleRuleLabel)(nil)).Elem()
+}
+
+func (i WebAclRuleRuleLabelArgs) ToWebAclRuleRuleLabelOutput() WebAclRuleRuleLabelOutput {
+	return i.ToWebAclRuleRuleLabelOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleRuleLabelArgs) ToWebAclRuleRuleLabelOutputWithContext(ctx context.Context) WebAclRuleRuleLabelOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleRuleLabelOutput)
+}
+
+// WebAclRuleRuleLabelArrayInput is an input type that accepts WebAclRuleRuleLabelArray and WebAclRuleRuleLabelArrayOutput values.
+// You can construct a concrete instance of `WebAclRuleRuleLabelArrayInput` via:
+//
+//          WebAclRuleRuleLabelArray{ WebAclRuleRuleLabelArgs{...} }
+type WebAclRuleRuleLabelArrayInput interface {
+	pulumi.Input
+
+	ToWebAclRuleRuleLabelArrayOutput() WebAclRuleRuleLabelArrayOutput
+	ToWebAclRuleRuleLabelArrayOutputWithContext(context.Context) WebAclRuleRuleLabelArrayOutput
+}
+
+type WebAclRuleRuleLabelArray []WebAclRuleRuleLabelInput
+
+func (WebAclRuleRuleLabelArray) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]WebAclRuleRuleLabel)(nil)).Elem()
+}
+
+func (i WebAclRuleRuleLabelArray) ToWebAclRuleRuleLabelArrayOutput() WebAclRuleRuleLabelArrayOutput {
+	return i.ToWebAclRuleRuleLabelArrayOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleRuleLabelArray) ToWebAclRuleRuleLabelArrayOutputWithContext(ctx context.Context) WebAclRuleRuleLabelArrayOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleRuleLabelArrayOutput)
+}
+
+type WebAclRuleRuleLabelOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleRuleLabelOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleRuleLabel)(nil)).Elem()
+}
+
+func (o WebAclRuleRuleLabelOutput) ToWebAclRuleRuleLabelOutput() WebAclRuleRuleLabelOutput {
+	return o
+}
+
+func (o WebAclRuleRuleLabelOutput) ToWebAclRuleRuleLabelOutputWithContext(ctx context.Context) WebAclRuleRuleLabelOutput {
+	return o
+}
+
+// The label string.
+func (o WebAclRuleRuleLabelOutput) Name() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleRuleLabel) string { return v.Name }).(pulumi.StringOutput)
+}
+
+type WebAclRuleRuleLabelArrayOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleRuleLabelArrayOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*[]WebAclRuleRuleLabel)(nil)).Elem()
+}
+
+func (o WebAclRuleRuleLabelArrayOutput) ToWebAclRuleRuleLabelArrayOutput() WebAclRuleRuleLabelArrayOutput {
+	return o
+}
+
+func (o WebAclRuleRuleLabelArrayOutput) ToWebAclRuleRuleLabelArrayOutputWithContext(ctx context.Context) WebAclRuleRuleLabelArrayOutput {
+	return o
+}
+
+func (o WebAclRuleRuleLabelArrayOutput) Index(i pulumi.IntInput) WebAclRuleRuleLabelOutput {
+	return pulumi.All(o, i).ApplyT(func(vs []interface{}) WebAclRuleRuleLabel {
+		return vs[0].([]WebAclRuleRuleLabel)[vs[1].(int)]
+	}).(WebAclRuleRuleLabelOutput)
+}
+
 type WebAclRuleStatement struct {
 	// A logical rule statement used to combine other rule statements with AND logic. See AND Statement below for details.
 	AndStatement *WebAclRuleStatementAndStatement `pulumi:"andStatement"`
@@ -111233,6 +113939,8 @@ type WebAclRuleStatement struct {
 	GeoMatchStatement *WebAclRuleStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
 	ManagedRuleGroupStatement *WebAclRuleStatementManagedRuleGroupStatement `pulumi:"managedRuleGroupStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
@@ -111273,6 +113981,8 @@ type WebAclRuleStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
 	ManagedRuleGroupStatement WebAclRuleStatementManagedRuleGroupStatementPtrInput `pulumi:"managedRuleGroupStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
@@ -111341,6 +114051,11 @@ func (o WebAclRuleStatementOutput) IpSetReferenceStatement() WebAclRuleStatement
 	}).(WebAclRuleStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOutput) LabelMatchStatement() WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatement) *WebAclRuleStatementLabelMatchStatement { return v.LabelMatchStatement }).(WebAclRuleStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
 func (o WebAclRuleStatementOutput) ManagedRuleGroupStatement() WebAclRuleStatementManagedRuleGroupStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatement) *WebAclRuleStatementManagedRuleGroupStatement {
@@ -111542,6 +114257,8 @@ type WebAclRuleStatementAndStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementAndStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -111576,6 +114293,8 @@ type WebAclRuleStatementAndStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementAndStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -111669,6 +114388,13 @@ func (o WebAclRuleStatementAndStatementStatementOutput) IpSetReferenceStatement(
 	}).(WebAclRuleStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementOutput) NotStatement() WebAclRuleStatementAndStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatement {
@@ -111879,6 +114605,8 @@ type WebAclRuleStatementAndStatementStatementAndStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -111913,6 +114641,8 @@ type WebAclRuleStatementAndStatementStatementAndStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -112006,6 +114736,13 @@ func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOutput) IpS
 	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOutput) NotStatement() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement {
@@ -112214,6 +114951,8 @@ type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementSt
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -112242,6 +114981,8 @@ type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementSt
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -112324,6 +115065,13 @@ func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatemen
 	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -114478,6 +117226,166 @@ func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -122259,6 +125167,166 @@ func (o WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetRefere
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -122405,6 +125473,8 @@ type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementSt
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -122433,6 +125503,8 @@ type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementSt
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -122515,6 +125587,13 @@ func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatemen
 	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -124669,6 +127748,166 @@ func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -130490,6 +133729,8 @@ type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementSta
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -130518,6 +133759,8 @@ type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementSta
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -130600,6 +133843,13 @@ func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatement
 	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -132754,6 +136004,166 @@ func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -146204,6 +149614,162 @@ func (o WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForw
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementLabelMatchStatement) string { return v.Key }).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementLabelMatchStatement) string { return v.Scope }).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementAndStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -146352,6 +149918,8 @@ type WebAclRuleStatementAndStatementStatementNotStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -146386,6 +149954,8 @@ type WebAclRuleStatementAndStatementStatementNotStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -146479,6 +150049,13 @@ func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOutput) IpS
 	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOutput) NotStatement() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement {
@@ -146687,6 +150264,8 @@ type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementSt
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -146715,6 +150294,8 @@ type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementSt
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -146797,6 +150378,13 @@ func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatemen
 	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -148951,6 +152539,166 @@ func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -156732,6 +160480,166 @@ func (o WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetRefere
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -156878,6 +160786,8 @@ type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementSt
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -156906,6 +160816,8 @@ type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementSt
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -156988,6 +160900,13 @@ func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatemen
 	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -159142,6 +163061,166 @@ func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -164963,6 +169042,8 @@ type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementSta
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -164991,6 +169072,8 @@ type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementSta
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -165073,6 +169156,13 @@ func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatement
 	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -167227,6 +171317,166 @@ func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -178725,6 +182975,8 @@ type WebAclRuleStatementAndStatementStatementOrStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -178759,6 +183011,8 @@ type WebAclRuleStatementAndStatementStatementOrStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -178852,6 +183106,13 @@ func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOutput) IpSe
 	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOutput) NotStatement() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement {
@@ -179060,6 +183321,8 @@ type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementSta
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -179088,6 +183351,8 @@ type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementSta
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -179170,6 +183435,13 @@ func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatement
 	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -181324,6 +185596,166 @@ func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -189105,6 +193537,166 @@ func (o WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -189251,6 +193843,8 @@ type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementSta
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -189279,6 +193873,8 @@ type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementSta
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -189361,6 +193957,13 @@ func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement
 	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -191515,6 +196118,166 @@ func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -197336,6 +202099,8 @@ type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStat
 	GeoMatchStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -197364,6 +202129,8 @@ type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStat
 	GeoMatchStatement WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -197446,6 +202213,13 @@ func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementS
 	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -199600,6 +204374,166 @@ func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementS
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -218703,6 +223637,162 @@ func (o WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutpu
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementLabelMatchStatementArgs and WebAclRuleStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementLabelMatchStatementOutput() WebAclRuleStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementLabelMatchStatementArgs) ToWebAclRuleStatementLabelMatchStatementOutput() WebAclRuleStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementLabelMatchStatementArgs) ToWebAclRuleStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementLabelMatchStatementArgs) ToWebAclRuleStatementLabelMatchStatementPtrOutput() WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementLabelMatchStatementArgs) ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementLabelMatchStatementOutput).ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementLabelMatchStatementArgs, WebAclRuleStatementLabelMatchStatementPtr and WebAclRuleStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementLabelMatchStatementPtrOutput() WebAclRuleStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementLabelMatchStatementPtrType WebAclRuleStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementLabelMatchStatementPtr(v *WebAclRuleStatementLabelMatchStatementArgs) WebAclRuleStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementLabelMatchStatementPtrType) ToWebAclRuleStatementLabelMatchStatementPtrOutput() WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementLabelMatchStatementPtrType) ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementLabelMatchStatementOutput) ToWebAclRuleStatementLabelMatchStatementOutput() WebAclRuleStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementLabelMatchStatementOutput) ToWebAclRuleStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementLabelMatchStatementOutput) ToWebAclRuleStatementLabelMatchStatementPtrOutput() WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementLabelMatchStatementOutput) ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementLabelMatchStatement) *WebAclRuleStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementLabelMatchStatement) string { return v.Key }).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementLabelMatchStatement) string { return v.Scope }).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementLabelMatchStatementPtrOutput() WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementLabelMatchStatement) WebAclRuleStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatement struct {
 	// The `rules` whose actions are set to `COUNT` by the web ACL, regardless of the action that is set on the rule. See Excluded Rule below for details.
 	ExcludedRules []WebAclRuleStatementManagedRuleGroupStatementExcludedRule `pulumi:"excludedRules"`
@@ -219007,6 +224097,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement struct {
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -219041,6 +224133,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -219160,6 +224254,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOutput) Ip
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOutput) NotStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement {
@@ -219266,6 +224367,16 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementPtrOutput)
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementPtrOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement {
+		if v == nil {
+			return nil
+		}
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementPtrOutput) NotStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement {
@@ -219474,6 +224585,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementS
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -219508,6 +224621,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementS
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -219601,6 +224716,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOutput) NotStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement {
@@ -219809,6 +224931,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementS
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -219837,6 +224961,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementS
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -219919,6 +225045,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -222073,6 +227206,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -229854,6 +235147,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -230000,6 +235453,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementS
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -230028,6 +235483,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementS
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -230110,6 +235567,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -232264,6 +237728,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -238085,6 +243709,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementS
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -238113,6 +243739,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementS
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -238195,6 +243823,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -240349,6 +245984,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStateme
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -253805,6 +259600,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetRefer
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatement `pulumi:"statements"`
@@ -253953,6 +259908,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementS
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -253987,6 +259944,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementS
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -254080,6 +260039,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOutput) NotStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement {
@@ -254288,6 +260254,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementS
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -254316,6 +260284,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementS
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -254398,6 +260368,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -256552,6 +262529,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -264333,6 +270470,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -264479,6 +270776,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementS
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -264507,6 +270806,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementS
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -264589,6 +270890,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -266743,6 +273051,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -272564,6 +279032,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementS
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -272592,6 +279062,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementS
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -272674,6 +279146,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -274828,6 +281307,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStateme
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -286326,6 +292965,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementSt
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -286360,6 +293001,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementSt
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -286453,6 +293096,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOutput) NotStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement {
@@ -286661,6 +293311,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementSt
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -286689,6 +293341,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementSt
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -286771,6 +293425,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -288925,6 +295586,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -296706,6 +303527,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -296852,6 +303833,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementSt
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -296880,6 +303863,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementSt
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -296962,6 +303947,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -299116,6 +306108,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -304937,6 +312089,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementSt
 	GeoMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -304965,6 +312119,8 @@ type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementSt
 	GeoMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -305047,6 +312203,13 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -307201,6 +314364,166 @@ func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -324374,6 +331697,8 @@ type WebAclRuleStatementNotStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementNotStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -324408,6 +331733,8 @@ type WebAclRuleStatementNotStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementNotStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -324501,6 +331828,13 @@ func (o WebAclRuleStatementNotStatementStatementOutput) IpSetReferenceStatement(
 	}).(WebAclRuleStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementOutput) NotStatement() WebAclRuleStatementNotStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatement {
@@ -324711,6 +332045,8 @@ type WebAclRuleStatementNotStatementStatementAndStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -324745,6 +332081,8 @@ type WebAclRuleStatementNotStatementStatementAndStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -324838,6 +332176,13 @@ func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOutput) IpS
 	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOutput) NotStatement() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement {
@@ -325046,6 +332391,8 @@ type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementSt
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -325074,6 +332421,8 @@ type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementSt
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -325156,6 +332505,13 @@ func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatemen
 	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -327310,6 +334666,166 @@ func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -335091,6 +342607,166 @@ func (o WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetRefere
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -335237,6 +342913,8 @@ type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementSt
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -335265,6 +342943,8 @@ type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementSt
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -335347,6 +343027,13 @@ func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatemen
 	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -337501,6 +345188,166 @@ func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -343322,6 +351169,8 @@ type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementSta
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -343350,6 +351199,8 @@ type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementSta
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -343432,6 +351283,13 @@ func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatement
 	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -345586,6 +353444,166 @@ func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -359036,6 +367054,162 @@ func (o WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForw
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementLabelMatchStatement) string { return v.Key }).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementLabelMatchStatement) string { return v.Scope }).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementNotStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -359184,6 +367358,8 @@ type WebAclRuleStatementNotStatementStatementNotStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -359218,6 +367394,8 @@ type WebAclRuleStatementNotStatementStatementNotStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -359311,6 +367489,13 @@ func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOutput) IpS
 	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOutput) NotStatement() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement {
@@ -359519,6 +367704,8 @@ type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementSt
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -359547,6 +367734,8 @@ type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementSt
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -359629,6 +367818,13 @@ func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatemen
 	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -361783,6 +369979,166 @@ func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -369564,6 +377920,166 @@ func (o WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetRefere
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -369710,6 +378226,8 @@ type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementSt
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -369738,6 +378256,8 @@ type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementSt
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -369820,6 +378340,13 @@ func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatemen
 	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -371974,6 +380501,166 @@ func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatemen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -377795,6 +386482,8 @@ type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementSta
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -377823,6 +386512,8 @@ type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementSta
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -377905,6 +386596,13 @@ func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatement
 	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -380059,6 +388757,166 @@ func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -391557,6 +400415,8 @@ type WebAclRuleStatementNotStatementStatementOrStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -391591,6 +400451,8 @@ type WebAclRuleStatementNotStatementStatementOrStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -391684,6 +400546,13 @@ func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOutput) IpSe
 	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOutput) NotStatement() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement {
@@ -391892,6 +400761,8 @@ type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementSta
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -391920,6 +400791,8 @@ type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementSta
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -392002,6 +400875,13 @@ func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatement
 	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -394156,6 +403036,166 @@ func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -401937,6 +410977,166 @@ func (o WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -402083,6 +411283,8 @@ type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementSta
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -402111,6 +411313,8 @@ type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementSta
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -402193,6 +411397,13 @@ func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement
 	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -404347,6 +413558,166 @@ func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -410168,6 +419539,8 @@ type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStat
 	GeoMatchStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -410196,6 +419569,8 @@ type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStat
 	GeoMatchStatement WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -410278,6 +419653,13 @@ func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementS
 	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -412432,6 +421814,166 @@ func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementS
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -429599,6 +439141,8 @@ type WebAclRuleStatementOrStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementOrStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -429633,6 +439177,8 @@ type WebAclRuleStatementOrStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementOrStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -429726,6 +439272,13 @@ func (o WebAclRuleStatementOrStatementStatementOutput) IpSetReferenceStatement()
 	}).(WebAclRuleStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementOutput) NotStatement() WebAclRuleStatementOrStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatement {
@@ -429936,6 +439489,8 @@ type WebAclRuleStatementOrStatementStatementAndStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -429970,6 +439525,8 @@ type WebAclRuleStatementOrStatementStatementAndStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -430063,6 +439620,13 @@ func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOutput) IpSe
 	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOutput) NotStatement() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement {
@@ -430271,6 +439835,8 @@ type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementSta
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -430299,6 +439865,8 @@ type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementSta
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -430381,6 +439949,13 @@ func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatement
 	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -432535,6 +442110,166 @@ func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -440316,6 +450051,166 @@ func (o WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -440462,6 +450357,8 @@ type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementSta
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -440490,6 +450387,8 @@ type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementSta
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -440572,6 +450471,13 @@ func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement
 	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -442726,6 +452632,166 @@ func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -448547,6 +458613,8 @@ type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStat
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -448575,6 +458643,8 @@ type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStat
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -448657,6 +458727,13 @@ func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementS
 	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -450811,6 +460888,166 @@ func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementS
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -464261,6 +474498,162 @@ func (o WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwa
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementLabelMatchStatement) string { return v.Key }).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementLabelMatchStatement) string { return v.Scope }).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementOrStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -464409,6 +474802,8 @@ type WebAclRuleStatementOrStatementStatementNotStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -464443,6 +474838,8 @@ type WebAclRuleStatementOrStatementStatementNotStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -464536,6 +474933,13 @@ func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOutput) IpSe
 	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOutput) NotStatement() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement {
@@ -464744,6 +475148,8 @@ type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementSta
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -464772,6 +475178,8 @@ type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementSta
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -464854,6 +475262,13 @@ func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatement
 	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -467008,6 +477423,166 @@ func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -474789,6 +485364,166 @@ func (o WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferen
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -474935,6 +485670,8 @@ type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementSta
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -474963,6 +485700,8 @@ type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementSta
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -475045,6 +485784,13 @@ func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement
 	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -477199,6 +487945,166 @@ func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -483020,6 +493926,8 @@ type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStat
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -483048,6 +493956,8 @@ type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStat
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -483130,6 +494040,13 @@ func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementS
 	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -485284,6 +496201,166 @@ func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementS
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -496782,6 +507859,8 @@ type WebAclRuleStatementOrStatementStatementOrStatementStatement struct {
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -496816,6 +507895,8 @@ type WebAclRuleStatementOrStatementStatementOrStatementStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -496909,6 +507990,13 @@ func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOutput) IpSet
 	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOutput) NotStatement() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement {
@@ -497117,6 +508205,8 @@ type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStat
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -497145,6 +508235,8 @@ type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStat
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -497227,6 +508319,13 @@ func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementS
 	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -499381,6 +510480,166 @@ func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementS
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -507162,6 +518421,166 @@ func (o WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenc
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -507308,6 +518727,8 @@ type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStat
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -507336,6 +518757,8 @@ type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStat
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -507418,6 +518841,13 @@ func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementS
 	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -509572,6 +521002,166 @@ func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementS
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -515393,6 +526983,8 @@ type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementState
 	GeoMatchStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -515421,6 +527013,8 @@ type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementState
 	GeoMatchStatement WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -515503,6 +527097,13 @@ func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementSt
 	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -517657,6 +529258,166 @@ func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementSt
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -535041,6 +546802,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatement struct {
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -535075,6 +546838,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementArgs struct {
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -535194,6 +546959,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOutput) IpSetRefe
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOutput) NotStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement {
@@ -535300,6 +547072,16 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementPtrOutput) IpSetR
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementPtrOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement {
+		if v == nil {
+			return nil
+		}
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementPtrOutput) NotStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement {
@@ -535508,6 +547290,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatemen
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -535542,6 +547326,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatemen
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -535635,6 +547421,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOutput) NotStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement {
@@ -535843,6 +547636,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatemen
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -535871,6 +547666,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatemen
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -535953,6 +547750,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -538107,6 +549911,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -545888,6 +557852,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -546034,6 +558158,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatemen
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -546062,6 +558188,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatemen
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -546144,6 +558272,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -548298,6 +560433,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -554119,6 +566414,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatemen
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -554147,6 +566444,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatemen
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -554229,6 +566528,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -556383,6 +568689,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementState
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -569839,6 +582305,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceSta
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatement `pulumi:"statements"`
@@ -569987,6 +582613,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatemen
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -570021,6 +582649,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatemen
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -570114,6 +582744,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOutput) NotStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement {
@@ -570322,6 +582959,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatemen
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -570350,6 +582989,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatemen
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -570432,6 +583073,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -572586,6 +585234,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -580367,6 +593175,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -580513,6 +593481,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatemen
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -580541,6 +593511,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatemen
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -580623,6 +593595,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -582777,6 +595756,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -588598,6 +601737,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatemen
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -588626,6 +601767,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatemen
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -588708,6 +601851,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -590862,6 +604012,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementState
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -602360,6 +615670,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -602394,6 +615706,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 	NotStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementPtrInput `pulumi:"notStatement"`
 	// A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -602487,6 +615801,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOutput) NotStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement {
@@ -602695,6 +616016,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -602723,6 +616046,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -602805,6 +616130,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
@@ -604959,6 +618291,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -612740,6 +626232,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement struct {
 	// The statement to negate. You can use any statement that can be nested. See Statement above for details.
 	Statements []WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatement `pulumi:"statements"`
@@ -612886,6 +626538,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -612914,6 +626568,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -612996,6 +626652,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
@@ -615150,6 +628813,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -620971,6 +634794,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement
 	GeoMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatement `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -620999,6 +634824,8 @@ type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatement
 	GeoMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementPtrInput `pulumi:"geoMatchStatement"`
 	// A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
 	IpSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput `pulumi:"ipSetReferenceStatement"`
+	// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+	LabelMatchStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput `pulumi:"labelMatchStatement"`
 	// A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 	RegexPatternSetReferenceStatement WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput `pulumi:"regexPatternSetReferenceStatement"`
 	// A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
@@ -621081,6 +634908,13 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput)
 }
 
+// A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementOutput) LabelMatchStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return v.LabelMatchStatement
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
 // A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
 func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementOutput) RegexPatternSetReferenceStatement() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput {
 	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
@@ -623235,6 +637069,166 @@ func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatem
 	}).(pulumi.StringPtrOutput)
 }
 
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement struct {
+	// The string to match against.
+	Key string `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope string `pulumi:"scope"`
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs and WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs struct {
+	// The string to match against.
+	Key pulumi.StringInput `pulumi:"key"`
+	// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+	Scope pulumi.StringInput `pulumi:"scope"`
+}
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput).ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx)
+}
+
+// WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput is an input type that accepts WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs, WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr and WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput values.
+// You can construct a concrete instance of `WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput` via:
+//
+//          WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{...}
+//
+//  or:
+//
+//          nil
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput interface {
+	pulumi.Input
+
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+	ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput
+}
+
+type webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs
+
+func WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtr(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput {
+	return (*webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType)(v)
+}
+
+func (*webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return i.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (i *webAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrType) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return pulumi.ToOutputWithContext(ctx, i).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(context.Background())
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o.ApplyTWithContext(ctx, func(_ context.Context, v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		return &v
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Key() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Key
+	}).(pulumi.StringOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput) Scope() pulumi.StringOutput {
+	return o.ApplyT(func(v WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) string {
+		return v.Scope
+	}).(pulumi.StringOutput)
+}
+
+type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput struct{ *pulumi.OutputState }
+
+func (WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ElementType() reflect.Type {
+	return reflect.TypeOf((**WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement)(nil)).Elem()
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) ToWebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutputWithContext(ctx context.Context) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput {
+	return o
+}
+
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Elem() WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+		if v != nil {
+			return *v
+		}
+		var ret WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement
+		return ret
+	}).(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput)
+}
+
+// The string to match against.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Key() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Key
+	}).(pulumi.StringPtrOutput)
+}
+
+// Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+func (o WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput) Scope() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement) *string {
+		if v == nil {
+			return nil
+		}
+		return &v.Scope
+	}).(pulumi.StringPtrOutput)
+}
+
 type WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement struct {
 	// The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
 	Arn string `pulumi:"arn"`
@@ -646503,6 +660497,8 @@ func (o GetRegexPatternSetRegularExpressionArrayOutput) Index(i pulumi.IntInput)
 func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RegexPatternSetRegularExpressionInput)(nil)).Elem(), RegexPatternSetRegularExpressionArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RegexPatternSetRegularExpressionArrayInput)(nil)).Elem(), RegexPatternSetRegularExpressionArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupCustomResponseBodyInput)(nil)).Elem(), RuleGroupCustomResponseBodyArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupCustomResponseBodyArrayInput)(nil)).Elem(), RuleGroupCustomResponseBodyArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleInput)(nil)).Elem(), RuleGroupRuleArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleArrayInput)(nil)).Elem(), RuleGroupRuleArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleActionInput)(nil)).Elem(), RuleGroupRuleActionArgs{})
@@ -646524,6 +660520,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleActionCountCustomRequestHandlingPtrInput)(nil)).Elem(), RuleGroupRuleActionCountCustomRequestHandlingArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderInput)(nil)).Elem(), RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArrayInput)(nil)).Elem(), RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArray{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleRuleLabelInput)(nil)).Elem(), RuleGroupRuleRuleLabelArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleRuleLabelArrayInput)(nil)).Elem(), RuleGroupRuleRuleLabelArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementInput)(nil)).Elem(), RuleGroupRuleStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementArgs{})
@@ -646561,6 +660559,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -646669,6 +660669,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementArgs{})
@@ -646701,6 +660703,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -646813,6 +660817,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -647001,6 +661007,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementArgs{})
@@ -647037,6 +661045,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -647145,6 +661155,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementArgs{})
@@ -647177,6 +661189,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -647289,6 +661303,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -647485,6 +661501,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -647593,6 +661611,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementArgs{})
@@ -647625,6 +661645,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -647737,6 +661759,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -647980,6 +662004,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupRuleVisibilityConfigInput)(nil)).Elem(), RuleGroupRuleVisibilityConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupVisibilityConfigInput)(nil)).Elem(), RuleGroupVisibilityConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*RuleGroupVisibilityConfigPtrInput)(nil)).Elem(), RuleGroupVisibilityConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclCustomResponseBodyInput)(nil)).Elem(), WebAclCustomResponseBodyArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclCustomResponseBodyArrayInput)(nil)).Elem(), WebAclCustomResponseBodyArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclDefaultActionInput)(nil)).Elem(), WebAclDefaultActionArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclDefaultActionPtrInput)(nil)).Elem(), WebAclDefaultActionArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclDefaultActionAllowInput)(nil)).Elem(), WebAclDefaultActionAllowArgs{})
@@ -648048,6 +662074,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleOverrideActionCountPtrInput)(nil)).Elem(), WebAclRuleOverrideActionCountArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleOverrideActionNoneInput)(nil)).Elem(), WebAclRuleOverrideActionNoneArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleOverrideActionNonePtrInput)(nil)).Elem(), WebAclRuleOverrideActionNoneArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleRuleLabelInput)(nil)).Elem(), WebAclRuleRuleLabelArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleRuleLabelArrayInput)(nil)).Elem(), WebAclRuleRuleLabelArray{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementInput)(nil)).Elem(), WebAclRuleStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementArgs{})
@@ -648089,6 +662117,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -648197,6 +662227,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementArgs{})
@@ -648229,6 +662261,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -648341,6 +662375,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -648529,6 +662565,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementArgs{})
@@ -648565,6 +662603,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -648673,6 +662713,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementArgs{})
@@ -648705,6 +662747,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -648817,6 +662861,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -649013,6 +663059,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -649121,6 +663169,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementArgs{})
@@ -649153,6 +663203,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -649265,6 +663317,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -649533,6 +663587,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementExcludedRuleInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementExcludedRuleArgs{})
@@ -649575,6 +663631,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -649683,6 +663741,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs{})
@@ -649715,6 +663775,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -649827,6 +663889,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -650015,6 +664079,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementArgs{})
@@ -650051,6 +664117,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -650159,6 +664227,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs{})
@@ -650191,6 +664261,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -650303,6 +664375,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -650499,6 +664573,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -650607,6 +664683,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs{})
@@ -650639,6 +664717,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -650751,6 +664831,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -651031,6 +665113,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -651139,6 +665223,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementArgs{})
@@ -651171,6 +665257,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -651283,6 +665371,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -651471,6 +665561,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementArgs{})
@@ -651507,6 +665599,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -651615,6 +665709,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementArgs{})
@@ -651647,6 +665743,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -651759,6 +665857,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -651955,6 +666055,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -652063,6 +666165,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementArgs{})
@@ -652095,6 +666199,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -652207,6 +666313,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -652487,6 +666595,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -652595,6 +666705,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementArgs{})
@@ -652627,6 +666739,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -652739,6 +666853,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -652927,6 +667043,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementArgs{})
@@ -652963,6 +667081,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -653071,6 +667191,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementArgs{})
@@ -653103,6 +667225,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -653215,6 +667339,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -653411,6 +667537,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -653519,6 +667647,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementArgs{})
@@ -653551,6 +667681,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -653663,6 +667795,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -653945,6 +668079,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -654053,6 +668189,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs{})
@@ -654085,6 +668223,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -654197,6 +668337,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -654385,6 +668527,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementArgs{})
@@ -654421,6 +668565,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -654529,6 +668675,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs{})
@@ -654561,6 +668709,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -654673,6 +668823,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -654869,6 +669021,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -654977,6 +669131,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs{})
@@ -655009,6 +669165,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -655121,6 +669279,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
+	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs{})
 	pulumi.RegisterInputType(reflect.TypeOf((*WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchInput)(nil)).Elem(), WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs{})
@@ -655452,6 +669612,8 @@ func init() {
 	pulumi.RegisterInputType(reflect.TypeOf((*GetRegexPatternSetRegularExpressionArrayInput)(nil)).Elem(), GetRegexPatternSetRegularExpressionArray{})
 	pulumi.RegisterOutputType(RegexPatternSetRegularExpressionOutput{})
 	pulumi.RegisterOutputType(RegexPatternSetRegularExpressionArrayOutput{})
+	pulumi.RegisterOutputType(RuleGroupCustomResponseBodyOutput{})
+	pulumi.RegisterOutputType(RuleGroupCustomResponseBodyArrayOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleArrayOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleActionOutput{})
@@ -655473,6 +669635,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleActionCountCustomRequestHandlingPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArrayOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleRuleLabelOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleRuleLabelArrayOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementPtrOutput{})
@@ -655510,6 +669674,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -655618,6 +669784,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementOutput{})
@@ -655650,6 +669818,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -655762,6 +669932,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -655950,6 +670122,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOutput{})
@@ -655986,6 +670160,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -656094,6 +670270,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementOutput{})
@@ -656126,6 +670304,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -656238,6 +670418,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -656434,6 +670616,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -656542,6 +670726,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementOutput{})
@@ -656574,6 +670760,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -656686,6 +670874,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -656929,6 +671119,8 @@ func init() {
 	pulumi.RegisterOutputType(RuleGroupRuleVisibilityConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupVisibilityConfigOutput{})
 	pulumi.RegisterOutputType(RuleGroupVisibilityConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclCustomResponseBodyOutput{})
+	pulumi.RegisterOutputType(WebAclCustomResponseBodyArrayOutput{})
 	pulumi.RegisterOutputType(WebAclDefaultActionOutput{})
 	pulumi.RegisterOutputType(WebAclDefaultActionPtrOutput{})
 	pulumi.RegisterOutputType(WebAclDefaultActionAllowOutput{})
@@ -656997,6 +671189,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleOverrideActionCountPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleOverrideActionNoneOutput{})
 	pulumi.RegisterOutputType(WebAclRuleOverrideActionNonePtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleRuleLabelOutput{})
+	pulumi.RegisterOutputType(WebAclRuleRuleLabelArrayOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementPtrOutput{})
@@ -657038,6 +671232,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -657146,6 +671342,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementOutput{})
@@ -657178,6 +671376,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -657290,6 +671490,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -657478,6 +671680,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOutput{})
@@ -657514,6 +671718,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -657622,6 +671828,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementOutput{})
@@ -657654,6 +671862,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -657766,6 +671976,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -657962,6 +672174,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -658070,6 +672284,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementOutput{})
@@ -658102,6 +672318,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -658214,6 +672432,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -658482,6 +672702,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementExcludedRuleOutput{})
@@ -658524,6 +672746,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -658632,6 +672856,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementOutput{})
@@ -658664,6 +672890,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -658776,6 +673004,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -658964,6 +673194,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOutput{})
@@ -659000,6 +673232,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -659108,6 +673342,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementOutput{})
@@ -659140,6 +673376,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -659252,6 +673490,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -659448,6 +673688,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -659556,6 +673798,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementOutput{})
@@ -659588,6 +673832,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -659700,6 +673946,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -659980,6 +674228,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -660088,6 +674338,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementOutput{})
@@ -660120,6 +674372,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -660232,6 +674486,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -660420,6 +674676,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOutput{})
@@ -660456,6 +674714,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -660564,6 +674824,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementOutput{})
@@ -660596,6 +674858,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -660708,6 +674972,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -660904,6 +675170,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -661012,6 +675280,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementOutput{})
@@ -661044,6 +675314,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -661156,6 +675428,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -661436,6 +675710,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -661544,6 +675820,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementOutput{})
@@ -661576,6 +675854,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -661688,6 +675968,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -661876,6 +676158,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOutput{})
@@ -661912,6 +676196,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -662020,6 +676306,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementOutput{})
@@ -662052,6 +676340,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -662164,6 +676454,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -662360,6 +676652,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -662468,6 +676762,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementOutput{})
@@ -662500,6 +676796,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -662612,6 +676910,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -662894,6 +677194,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -663002,6 +677304,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementOutput{})
@@ -663034,6 +677338,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -663146,6 +677452,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -663334,6 +677642,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOutput{})
@@ -663370,6 +677680,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -663478,6 +677790,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementOutput{})
@@ -663510,6 +677824,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -663622,6 +677938,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -663818,6 +678136,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -663926,6 +678246,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementOutput{})
@@ -663958,6 +678280,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
@@ -664070,6 +678394,8 @@ func init() {
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigPtrOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementOutput{})
+	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementPtrOutput{})
 	pulumi.RegisterOutputType(WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchOutput{})
diff --git a/sdk/go/aws/wafv2/ruleGroup.go b/sdk/go/aws/wafv2/ruleGroup.go
index b8835146bd6..22b61282fc4 100644
--- a/sdk/go/aws/wafv2/ruleGroup.go
+++ b/sdk/go/aws/wafv2/ruleGroup.go
@@ -306,10 +306,12 @@ type RuleGroup struct {
 	Arn pulumi.StringOutput `pulumi:"arn"`
 	// The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
 	Capacity pulumi.IntOutput `pulumi:"capacity"`
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies RuleGroupCustomResponseBodyArrayOutput `pulumi:"customResponseBodies"`
 	// A friendly description of the rule group.
 	Description pulumi.StringPtrOutput `pulumi:"description"`
 	LockToken   pulumi.StringOutput    `pulumi:"lockToken"`
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringOutput `pulumi:"name"`
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules RuleGroupRuleArrayOutput `pulumi:"rules"`
@@ -365,10 +367,12 @@ type ruleGroupState struct {
 	Arn *string `pulumi:"arn"`
 	// The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
 	Capacity *int `pulumi:"capacity"`
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies []RuleGroupCustomResponseBody `pulumi:"customResponseBodies"`
 	// A friendly description of the rule group.
 	Description *string `pulumi:"description"`
 	LockToken   *string `pulumi:"lockToken"`
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name *string `pulumi:"name"`
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules []RuleGroupRule `pulumi:"rules"`
@@ -387,10 +391,12 @@ type RuleGroupState struct {
 	Arn pulumi.StringPtrInput
 	// The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
 	Capacity pulumi.IntPtrInput
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies RuleGroupCustomResponseBodyArrayInput
 	// A friendly description of the rule group.
 	Description pulumi.StringPtrInput
 	LockToken   pulumi.StringPtrInput
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringPtrInput
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules RuleGroupRuleArrayInput
@@ -411,9 +417,11 @@ func (RuleGroupState) ElementType() reflect.Type {
 type ruleGroupArgs struct {
 	// The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
 	Capacity int `pulumi:"capacity"`
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies []RuleGroupCustomResponseBody `pulumi:"customResponseBodies"`
 	// A friendly description of the rule group.
 	Description *string `pulumi:"description"`
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name *string `pulumi:"name"`
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules []RuleGroupRule `pulumi:"rules"`
@@ -431,9 +439,11 @@ type ruleGroupArgs struct {
 type RuleGroupArgs struct {
 	// The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
 	Capacity pulumi.IntInput
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies RuleGroupCustomResponseBodyArrayInput
 	// A friendly description of the rule group.
 	Description pulumi.StringPtrInput
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringPtrInput
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules RuleGroupRuleArrayInput
diff --git a/sdk/go/aws/wafv2/webAcl.go b/sdk/go/aws/wafv2/webAcl.go
index 2b8a49c4ea0..2d675442e12 100644
--- a/sdk/go/aws/wafv2/webAcl.go
+++ b/sdk/go/aws/wafv2/webAcl.go
@@ -88,6 +88,7 @@ import (
 // }
 // ```
 // ### Rate Based
+// Rate-limit US and NL-based clients to 10,000 requests for every 5 minutes.
 //
 // ```go
 // package main
@@ -101,13 +102,13 @@ import (
 // 	pulumi.Run(func(ctx *pulumi.Context) error {
 // 		_, err := wafv2.NewWebAcl(ctx, "example", &wafv2.WebAclArgs{
 // 			DefaultAction: &wafv2.WebAclDefaultActionArgs{
-// 				Block: nil,
+// 				Allow: nil,
 // 			},
-// 			Description: pulumi.String("Example of a rate based statement."),
+// 			Description: pulumi.String("Example of a Cloudfront rate based statement."),
 // 			Rules: wafv2.WebAclRuleArray{
 // 				&wafv2.WebAclRuleArgs{
 // 					Action: &wafv2.WebAclRuleActionArgs{
-// 						Count: nil,
+// 						Block: nil,
 // 					},
 // 					Name:     pulumi.String("rule-1"),
 // 					Priority: pulumi.Int(1),
@@ -132,7 +133,7 @@ import (
 // 					},
 // 				},
 // 			},
-// 			Scope: pulumi.String("REGIONAL"),
+// 			Scope: pulumi.String("CLOUDFRONT"),
 // 			Tags: pulumi.StringMap{
 // 				"Tag1": pulumi.String("Value1"),
 // 				"Tag2": pulumi.String("Value2"),
@@ -297,12 +298,14 @@ type WebAcl struct {
 	Arn pulumi.StringOutput `pulumi:"arn"`
 	// The web ACL capacity units (WCUs) currently being used by this web ACL.
 	Capacity pulumi.IntOutput `pulumi:"capacity"`
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies WebAclCustomResponseBodyArrayOutput `pulumi:"customResponseBodies"`
 	// The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
 	DefaultAction WebAclDefaultActionOutput `pulumi:"defaultAction"`
 	// A friendly description of the WebACL.
 	Description pulumi.StringPtrOutput `pulumi:"description"`
 	LockToken   pulumi.StringOutput    `pulumi:"lockToken"`
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringOutput `pulumi:"name"`
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules WebAclRuleArrayOutput `pulumi:"rules"`
@@ -358,12 +361,14 @@ type webAclState struct {
 	Arn *string `pulumi:"arn"`
 	// The web ACL capacity units (WCUs) currently being used by this web ACL.
 	Capacity *int `pulumi:"capacity"`
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies []WebAclCustomResponseBody `pulumi:"customResponseBodies"`
 	// The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
 	DefaultAction *WebAclDefaultAction `pulumi:"defaultAction"`
 	// A friendly description of the WebACL.
 	Description *string `pulumi:"description"`
 	LockToken   *string `pulumi:"lockToken"`
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name *string `pulumi:"name"`
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules []WebAclRule `pulumi:"rules"`
@@ -382,12 +387,14 @@ type WebAclState struct {
 	Arn pulumi.StringPtrInput
 	// The web ACL capacity units (WCUs) currently being used by this web ACL.
 	Capacity pulumi.IntPtrInput
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies WebAclCustomResponseBodyArrayInput
 	// The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
 	DefaultAction WebAclDefaultActionPtrInput
 	// A friendly description of the WebACL.
 	Description pulumi.StringPtrInput
 	LockToken   pulumi.StringPtrInput
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringPtrInput
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules WebAclRuleArrayInput
@@ -406,11 +413,13 @@ func (WebAclState) ElementType() reflect.Type {
 }
 
 type webAclArgs struct {
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies []WebAclCustomResponseBody `pulumi:"customResponseBodies"`
 	// The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
 	DefaultAction WebAclDefaultAction `pulumi:"defaultAction"`
 	// A friendly description of the WebACL.
 	Description *string `pulumi:"description"`
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name *string `pulumi:"name"`
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules []WebAclRule `pulumi:"rules"`
@@ -426,11 +435,13 @@ type webAclArgs struct {
 
 // The set of arguments for constructing a WebAcl resource.
 type WebAclArgs struct {
+	// Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+	CustomResponseBodies WebAclCustomResponseBodyArrayInput
 	// The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
 	DefaultAction WebAclDefaultActionInput
 	// A friendly description of the WebACL.
 	Description pulumi.StringPtrInput
-	// The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+	// The label string.
 	Name pulumi.StringPtrInput
 	// The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
 	Rules WebAclRuleArrayInput
diff --git a/sdk/nodejs/account/alternativeContact.ts b/sdk/nodejs/account/alternativeContact.ts
new file mode 100644
index 00000000000..46b14b7e109
--- /dev/null
+++ b/sdk/nodejs/account/alternativeContact.ts
@@ -0,0 +1,176 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+/**
+ * Manages the specified alternate contact attached to an AWS Account.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const operations = new aws.account.AlternativeContact("operations", {
+ *     alternateContactType: "OPERATIONS",
+ *     emailAddress: "test@example.com",
+ *     phoneNumber: "+1234567890",
+ *     title: "Example",
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * The current Alternate Contact can be imported using the `alternate_contact_type`, e.g.,
+ *
+ * ```sh
+ *  $ pulumi import aws:account/alternativeContact:AlternativeContact operations OPERATIONS
+ * ```
+ */
+export class AlternativeContact extends pulumi.CustomResource {
+    /**
+     * Get an existing AlternativeContact resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AlternativeContactState, opts?: pulumi.CustomResourceOptions): AlternativeContact {
+        return new AlternativeContact(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'aws:account/alternativeContact:AlternativeContact';
+
+    /**
+     * Returns true if the given object is an instance of AlternativeContact.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is AlternativeContact {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === AlternativeContact.__pulumiType;
+    }
+
+    /**
+     * The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+     */
+    public readonly alternateContactType!: pulumi.Output<string>;
+    /**
+     * An email address for the alternate contact.
+     */
+    public readonly emailAddress!: pulumi.Output<string>;
+    /**
+     * The name of the alternate contact.
+     */
+    public readonly name!: pulumi.Output<string>;
+    /**
+     * A phone number for the alternate contact.
+     */
+    public readonly phoneNumber!: pulumi.Output<string>;
+    /**
+     * A title for the alternate contact.
+     */
+    public readonly title!: pulumi.Output<string>;
+
+    /**
+     * Create a AlternativeContact resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: AlternativeContactArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: AlternativeContactArgs | AlternativeContactState, opts?: pulumi.CustomResourceOptions) {
+        let inputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as AlternativeContactState | undefined;
+            inputs["alternateContactType"] = state ? state.alternateContactType : undefined;
+            inputs["emailAddress"] = state ? state.emailAddress : undefined;
+            inputs["name"] = state ? state.name : undefined;
+            inputs["phoneNumber"] = state ? state.phoneNumber : undefined;
+            inputs["title"] = state ? state.title : undefined;
+        } else {
+            const args = argsOrState as AlternativeContactArgs | undefined;
+            if ((!args || args.alternateContactType === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'alternateContactType'");
+            }
+            if ((!args || args.emailAddress === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'emailAddress'");
+            }
+            if ((!args || args.phoneNumber === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'phoneNumber'");
+            }
+            if ((!args || args.title === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'title'");
+            }
+            inputs["alternateContactType"] = args ? args.alternateContactType : undefined;
+            inputs["emailAddress"] = args ? args.emailAddress : undefined;
+            inputs["name"] = args ? args.name : undefined;
+            inputs["phoneNumber"] = args ? args.phoneNumber : undefined;
+            inputs["title"] = args ? args.title : undefined;
+        }
+        if (!opts.version) {
+            opts = pulumi.mergeOptions(opts, { version: utilities.getVersion()});
+        }
+        super(AlternativeContact.__pulumiType, name, inputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering AlternativeContact resources.
+ */
+export interface AlternativeContactState {
+    /**
+     * The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+     */
+    alternateContactType?: pulumi.Input<string>;
+    /**
+     * An email address for the alternate contact.
+     */
+    emailAddress?: pulumi.Input<string>;
+    /**
+     * The name of the alternate contact.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * A phone number for the alternate contact.
+     */
+    phoneNumber?: pulumi.Input<string>;
+    /**
+     * A title for the alternate contact.
+     */
+    title?: pulumi.Input<string>;
+}
+
+/**
+ * The set of arguments for constructing a AlternativeContact resource.
+ */
+export interface AlternativeContactArgs {
+    /**
+     * The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+     */
+    alternateContactType: pulumi.Input<string>;
+    /**
+     * An email address for the alternate contact.
+     */
+    emailAddress: pulumi.Input<string>;
+    /**
+     * The name of the alternate contact.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * A phone number for the alternate contact.
+     */
+    phoneNumber: pulumi.Input<string>;
+    /**
+     * A title for the alternate contact.
+     */
+    title: pulumi.Input<string>;
+}
diff --git a/sdk/nodejs/account/index.ts b/sdk/nodejs/account/index.ts
new file mode 100644
index 00000000000..7a9faab861b
--- /dev/null
+++ b/sdk/nodejs/account/index.ts
@@ -0,0 +1,24 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+// Export members:
+export * from "./alternativeContact";
+
+// Import resources to register:
+import { AlternativeContact } from "./alternativeContact";
+
+const _module = {
+    version: utilities.getVersion(),
+    construct: (name: string, type: string, urn: string): pulumi.Resource => {
+        switch (type) {
+            case "aws:account/alternativeContact:AlternativeContact":
+                return new AlternativeContact(name, <any>undefined, { urn })
+            default:
+                throw new Error(`unknown resource type ${type}`);
+        }
+    },
+};
+pulumi.runtime.registerResourceModule("aws", "account/alternativeContact", _module)
diff --git a/sdk/nodejs/alb/getLoadBalancer.ts b/sdk/nodejs/alb/getLoadBalancer.ts
index e397cd13e8a..1e2bc2fd8f9 100644
--- a/sdk/nodejs/alb/getLoadBalancer.ts
+++ b/sdk/nodejs/alb/getLoadBalancer.ts
@@ -71,10 +71,12 @@ export interface GetLoadBalancerResult {
     readonly arn: string;
     readonly arnSuffix: string;
     readonly customerOwnedIpv4Pool: string;
+    readonly desyncMitigationMode: string;
     readonly dnsName: string;
     readonly dropInvalidHeaderFields: boolean;
     readonly enableDeletionProtection: boolean;
     readonly enableHttp2: boolean;
+    readonly enableWafFailOpen: boolean;
     /**
      * The provider-assigned unique ID for this managed resource.
      */
diff --git a/sdk/nodejs/alb/loadBalancer.ts b/sdk/nodejs/alb/loadBalancer.ts
index 0733d2a6c6a..a0e6c2f7eca 100644
--- a/sdk/nodejs/alb/loadBalancer.ts
+++ b/sdk/nodejs/alb/loadBalancer.ts
@@ -144,6 +144,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     public readonly customerOwnedIpv4Pool!: pulumi.Output<string | undefined>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    public readonly desyncMitigationMode!: pulumi.Output<string | undefined>;
     /**
      * The DNS name of the load balancer.
      */
@@ -166,6 +170,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     public readonly enableHttp2!: pulumi.Output<boolean | undefined>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    public readonly enableWafFailOpen!: pulumi.Output<boolean | undefined>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -207,7 +215,7 @@ export class LoadBalancer extends pulumi.CustomResource {
      */
     public readonly subnets!: pulumi.Output<string[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     public readonly tags!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
@@ -238,11 +246,13 @@ export class LoadBalancer extends pulumi.CustomResource {
             inputs["arn"] = state ? state.arn : undefined;
             inputs["arnSuffix"] = state ? state.arnSuffix : undefined;
             inputs["customerOwnedIpv4Pool"] = state ? state.customerOwnedIpv4Pool : undefined;
+            inputs["desyncMitigationMode"] = state ? state.desyncMitigationMode : undefined;
             inputs["dnsName"] = state ? state.dnsName : undefined;
             inputs["dropInvalidHeaderFields"] = state ? state.dropInvalidHeaderFields : undefined;
             inputs["enableCrossZoneLoadBalancing"] = state ? state.enableCrossZoneLoadBalancing : undefined;
             inputs["enableDeletionProtection"] = state ? state.enableDeletionProtection : undefined;
             inputs["enableHttp2"] = state ? state.enableHttp2 : undefined;
+            inputs["enableWafFailOpen"] = state ? state.enableWafFailOpen : undefined;
             inputs["idleTimeout"] = state ? state.idleTimeout : undefined;
             inputs["internal"] = state ? state.internal : undefined;
             inputs["ipAddressType"] = state ? state.ipAddressType : undefined;
@@ -260,10 +270,12 @@ export class LoadBalancer extends pulumi.CustomResource {
             const args = argsOrState as LoadBalancerArgs | undefined;
             inputs["accessLogs"] = args ? args.accessLogs : undefined;
             inputs["customerOwnedIpv4Pool"] = args ? args.customerOwnedIpv4Pool : undefined;
+            inputs["desyncMitigationMode"] = args ? args.desyncMitigationMode : undefined;
             inputs["dropInvalidHeaderFields"] = args ? args.dropInvalidHeaderFields : undefined;
             inputs["enableCrossZoneLoadBalancing"] = args ? args.enableCrossZoneLoadBalancing : undefined;
             inputs["enableDeletionProtection"] = args ? args.enableDeletionProtection : undefined;
             inputs["enableHttp2"] = args ? args.enableHttp2 : undefined;
+            inputs["enableWafFailOpen"] = args ? args.enableWafFailOpen : undefined;
             inputs["idleTimeout"] = args ? args.idleTimeout : undefined;
             inputs["internal"] = args ? args.internal : undefined;
             inputs["ipAddressType"] = args ? args.ipAddressType : undefined;
@@ -310,6 +322,10 @@ export interface LoadBalancerState {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     customerOwnedIpv4Pool?: pulumi.Input<string>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * The DNS name of the load balancer.
      */
@@ -332,6 +348,10 @@ export interface LoadBalancerState {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     enableHttp2?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    enableWafFailOpen?: pulumi.Input<boolean>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -373,7 +393,7 @@ export interface LoadBalancerState {
      */
     subnets?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
@@ -400,6 +420,10 @@ export interface LoadBalancerArgs {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     customerOwnedIpv4Pool?: pulumi.Input<string>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
      */
@@ -418,6 +442,10 @@ export interface LoadBalancerArgs {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     enableHttp2?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    enableWafFailOpen?: pulumi.Input<boolean>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -459,7 +487,7 @@ export interface LoadBalancerArgs {
      */
     subnets?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
 }
diff --git a/sdk/nodejs/applicationloadbalancing/getLoadBalancer.ts b/sdk/nodejs/applicationloadbalancing/getLoadBalancer.ts
index ae18e646e1d..c44d51ff227 100644
--- a/sdk/nodejs/applicationloadbalancing/getLoadBalancer.ts
+++ b/sdk/nodejs/applicationloadbalancing/getLoadBalancer.ts
@@ -73,10 +73,12 @@ export interface GetLoadBalancerResult {
     readonly arn: string;
     readonly arnSuffix: string;
     readonly customerOwnedIpv4Pool: string;
+    readonly desyncMitigationMode: string;
     readonly dnsName: string;
     readonly dropInvalidHeaderFields: boolean;
     readonly enableDeletionProtection: boolean;
     readonly enableHttp2: boolean;
+    readonly enableWafFailOpen: boolean;
     /**
      * The provider-assigned unique ID for this managed resource.
      */
diff --git a/sdk/nodejs/applicationloadbalancing/loadBalancer.ts b/sdk/nodejs/applicationloadbalancing/loadBalancer.ts
index 9213aea32a8..cf0939d93b8 100644
--- a/sdk/nodejs/applicationloadbalancing/loadBalancer.ts
+++ b/sdk/nodejs/applicationloadbalancing/loadBalancer.ts
@@ -147,6 +147,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     public readonly customerOwnedIpv4Pool!: pulumi.Output<string | undefined>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    public readonly desyncMitigationMode!: pulumi.Output<string | undefined>;
     /**
      * The DNS name of the load balancer.
      */
@@ -169,6 +173,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     public readonly enableHttp2!: pulumi.Output<boolean | undefined>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    public readonly enableWafFailOpen!: pulumi.Output<boolean | undefined>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -210,7 +218,7 @@ export class LoadBalancer extends pulumi.CustomResource {
      */
     public readonly subnets!: pulumi.Output<string[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     public readonly tags!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
@@ -244,11 +252,13 @@ export class LoadBalancer extends pulumi.CustomResource {
             inputs["arn"] = state ? state.arn : undefined;
             inputs["arnSuffix"] = state ? state.arnSuffix : undefined;
             inputs["customerOwnedIpv4Pool"] = state ? state.customerOwnedIpv4Pool : undefined;
+            inputs["desyncMitigationMode"] = state ? state.desyncMitigationMode : undefined;
             inputs["dnsName"] = state ? state.dnsName : undefined;
             inputs["dropInvalidHeaderFields"] = state ? state.dropInvalidHeaderFields : undefined;
             inputs["enableCrossZoneLoadBalancing"] = state ? state.enableCrossZoneLoadBalancing : undefined;
             inputs["enableDeletionProtection"] = state ? state.enableDeletionProtection : undefined;
             inputs["enableHttp2"] = state ? state.enableHttp2 : undefined;
+            inputs["enableWafFailOpen"] = state ? state.enableWafFailOpen : undefined;
             inputs["idleTimeout"] = state ? state.idleTimeout : undefined;
             inputs["internal"] = state ? state.internal : undefined;
             inputs["ipAddressType"] = state ? state.ipAddressType : undefined;
@@ -266,10 +276,12 @@ export class LoadBalancer extends pulumi.CustomResource {
             const args = argsOrState as LoadBalancerArgs | undefined;
             inputs["accessLogs"] = args ? args.accessLogs : undefined;
             inputs["customerOwnedIpv4Pool"] = args ? args.customerOwnedIpv4Pool : undefined;
+            inputs["desyncMitigationMode"] = args ? args.desyncMitigationMode : undefined;
             inputs["dropInvalidHeaderFields"] = args ? args.dropInvalidHeaderFields : undefined;
             inputs["enableCrossZoneLoadBalancing"] = args ? args.enableCrossZoneLoadBalancing : undefined;
             inputs["enableDeletionProtection"] = args ? args.enableDeletionProtection : undefined;
             inputs["enableHttp2"] = args ? args.enableHttp2 : undefined;
+            inputs["enableWafFailOpen"] = args ? args.enableWafFailOpen : undefined;
             inputs["idleTimeout"] = args ? args.idleTimeout : undefined;
             inputs["internal"] = args ? args.internal : undefined;
             inputs["ipAddressType"] = args ? args.ipAddressType : undefined;
@@ -314,6 +326,10 @@ export interface LoadBalancerState {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     customerOwnedIpv4Pool?: pulumi.Input<string>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * The DNS name of the load balancer.
      */
@@ -336,6 +352,10 @@ export interface LoadBalancerState {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     enableHttp2?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    enableWafFailOpen?: pulumi.Input<boolean>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -377,7 +397,7 @@ export interface LoadBalancerState {
      */
     subnets?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
@@ -404,6 +424,10 @@ export interface LoadBalancerArgs {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     customerOwnedIpv4Pool?: pulumi.Input<string>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
      */
@@ -422,6 +446,10 @@ export interface LoadBalancerArgs {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     enableHttp2?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    enableWafFailOpen?: pulumi.Input<boolean>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -463,7 +491,7 @@ export interface LoadBalancerArgs {
      */
     subnets?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
 }
diff --git a/sdk/nodejs/appstream/fleetStackAssociation.ts b/sdk/nodejs/appstream/fleetStackAssociation.ts
new file mode 100644
index 00000000000..a78befd8964
--- /dev/null
+++ b/sdk/nodejs/appstream/fleetStackAssociation.ts
@@ -0,0 +1,134 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+/**
+ * Manages an AppStream Fleet Stack association.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const exampleFleet = new aws.appstream.Fleet("exampleFleet", {
+ *     imageName: "Amazon-AppStream2-Sample-Image-02-04-2019",
+ *     instanceType: "stream.standard.small",
+ *     computeCapacity: {
+ *         desiredInstances: 1,
+ *     },
+ * });
+ * const exampleStack = new aws.appstream.Stack("exampleStack", {});
+ * const exampleFleetStackAssociation = new aws.appstream.FleetStackAssociation("exampleFleetStackAssociation", {
+ *     fleetName: exampleFleet.name,
+ *     stackName: exampleStack.name,
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * AppStream Stack Fleet Association can be imported by using the `fleet_name` and `stack_name` separated by a slash (`/`), e.g.,
+ *
+ * ```sh
+ *  $ pulumi import aws:appstream/fleetStackAssociation:FleetStackAssociation example fleetName/stackName
+ * ```
+ */
+export class FleetStackAssociation extends pulumi.CustomResource {
+    /**
+     * Get an existing FleetStackAssociation resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: FleetStackAssociationState, opts?: pulumi.CustomResourceOptions): FleetStackAssociation {
+        return new FleetStackAssociation(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'aws:appstream/fleetStackAssociation:FleetStackAssociation';
+
+    /**
+     * Returns true if the given object is an instance of FleetStackAssociation.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is FleetStackAssociation {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === FleetStackAssociation.__pulumiType;
+    }
+
+    /**
+     * Name of the fleet.
+     */
+    public readonly fleetName!: pulumi.Output<string>;
+    /**
+     * Name of the stack.
+     */
+    public readonly stackName!: pulumi.Output<string>;
+
+    /**
+     * Create a FleetStackAssociation resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: FleetStackAssociationArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: FleetStackAssociationArgs | FleetStackAssociationState, opts?: pulumi.CustomResourceOptions) {
+        let inputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as FleetStackAssociationState | undefined;
+            inputs["fleetName"] = state ? state.fleetName : undefined;
+            inputs["stackName"] = state ? state.stackName : undefined;
+        } else {
+            const args = argsOrState as FleetStackAssociationArgs | undefined;
+            if ((!args || args.fleetName === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'fleetName'");
+            }
+            if ((!args || args.stackName === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'stackName'");
+            }
+            inputs["fleetName"] = args ? args.fleetName : undefined;
+            inputs["stackName"] = args ? args.stackName : undefined;
+        }
+        if (!opts.version) {
+            opts = pulumi.mergeOptions(opts, { version: utilities.getVersion()});
+        }
+        super(FleetStackAssociation.__pulumiType, name, inputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering FleetStackAssociation resources.
+ */
+export interface FleetStackAssociationState {
+    /**
+     * Name of the fleet.
+     */
+    fleetName?: pulumi.Input<string>;
+    /**
+     * Name of the stack.
+     */
+    stackName?: pulumi.Input<string>;
+}
+
+/**
+ * The set of arguments for constructing a FleetStackAssociation resource.
+ */
+export interface FleetStackAssociationArgs {
+    /**
+     * Name of the fleet.
+     */
+    fleetName: pulumi.Input<string>;
+    /**
+     * Name of the stack.
+     */
+    stackName: pulumi.Input<string>;
+}
diff --git a/sdk/nodejs/appstream/index.ts b/sdk/nodejs/appstream/index.ts
index 9161423b213..bf8af0a8123 100644
--- a/sdk/nodejs/appstream/index.ts
+++ b/sdk/nodejs/appstream/index.ts
@@ -7,14 +7,20 @@ import * as utilities from "../utilities";
 // Export members:
 export * from "./directoryConfig";
 export * from "./fleet";
+export * from "./fleetStackAssociation";
 export * from "./imageBuilder";
 export * from "./stack";
+export * from "./user";
+export * from "./userStackAssociation";
 
 // Import resources to register:
 import { DirectoryConfig } from "./directoryConfig";
 import { Fleet } from "./fleet";
+import { FleetStackAssociation } from "./fleetStackAssociation";
 import { ImageBuilder } from "./imageBuilder";
 import { Stack } from "./stack";
+import { User } from "./user";
+import { UserStackAssociation } from "./userStackAssociation";
 
 const _module = {
     version: utilities.getVersion(),
@@ -24,10 +30,16 @@ const _module = {
                 return new DirectoryConfig(name, <any>undefined, { urn })
             case "aws:appstream/fleet:Fleet":
                 return new Fleet(name, <any>undefined, { urn })
+            case "aws:appstream/fleetStackAssociation:FleetStackAssociation":
+                return new FleetStackAssociation(name, <any>undefined, { urn })
             case "aws:appstream/imageBuilder:ImageBuilder":
                 return new ImageBuilder(name, <any>undefined, { urn })
             case "aws:appstream/stack:Stack":
                 return new Stack(name, <any>undefined, { urn })
+            case "aws:appstream/user:User":
+                return new User(name, <any>undefined, { urn })
+            case "aws:appstream/userStackAssociation:UserStackAssociation":
+                return new UserStackAssociation(name, <any>undefined, { urn })
             default:
                 throw new Error(`unknown resource type ${type}`);
         }
@@ -35,5 +47,8 @@ const _module = {
 };
 pulumi.runtime.registerResourceModule("aws", "appstream/directoryConfig", _module)
 pulumi.runtime.registerResourceModule("aws", "appstream/fleet", _module)
+pulumi.runtime.registerResourceModule("aws", "appstream/fleetStackAssociation", _module)
 pulumi.runtime.registerResourceModule("aws", "appstream/imageBuilder", _module)
 pulumi.runtime.registerResourceModule("aws", "appstream/stack", _module)
+pulumi.runtime.registerResourceModule("aws", "appstream/user", _module)
+pulumi.runtime.registerResourceModule("aws", "appstream/userStackAssociation", _module)
diff --git a/sdk/nodejs/appstream/user.ts b/sdk/nodejs/appstream/user.ts
new file mode 100644
index 00000000000..b869a42a714
--- /dev/null
+++ b/sdk/nodejs/appstream/user.ts
@@ -0,0 +1,204 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+/**
+ * Provides an AppStream user.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.appstream.User("example", {
+ *     authenticationType: "USERPOOL",
+ *     firstName: "FIRST NAME",
+ *     lastName: "LAST NAME",
+ *     userName: "EMAIL ADDRESS",
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * `aws_appstream_user` can be imported using the `user_name` and `authentication_type` separated by a slash (`/`), e.g.,
+ *
+ * ```sh
+ *  $ pulumi import aws:appstream/user:User example UserName/AuthenticationType
+ * ```
+ */
+export class User extends pulumi.CustomResource {
+    /**
+     * Get an existing User resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: UserState, opts?: pulumi.CustomResourceOptions): User {
+        return new User(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'aws:appstream/user:User';
+
+    /**
+     * Returns true if the given object is an instance of User.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is User {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === User.__pulumiType;
+    }
+
+    /**
+     * ARN of the appstream user.
+     */
+    public /*out*/ readonly arn!: pulumi.Output<string>;
+    /**
+     * Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+     */
+    public readonly authenticationType!: pulumi.Output<string>;
+    /**
+     * Date and time, in UTC and extended RFC 3339 format, when the user was created.
+     */
+    public /*out*/ readonly createdTime!: pulumi.Output<string>;
+    /**
+     * Specifies whether the user in the user pool is enabled.
+     */
+    public readonly enabled!: pulumi.Output<boolean | undefined>;
+    /**
+     * First name, or given name, of the user.
+     */
+    public readonly firstName!: pulumi.Output<string | undefined>;
+    /**
+     * Last name, or surname, of the user.
+     */
+    public readonly lastName!: pulumi.Output<string | undefined>;
+    /**
+     * Send an email notification.
+     */
+    public readonly sendEmailNotification!: pulumi.Output<boolean | undefined>;
+    /**
+     * Email address of the user.
+     */
+    public readonly userName!: pulumi.Output<string>;
+
+    /**
+     * Create a User resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: UserArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: UserArgs | UserState, opts?: pulumi.CustomResourceOptions) {
+        let inputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as UserState | undefined;
+            inputs["arn"] = state ? state.arn : undefined;
+            inputs["authenticationType"] = state ? state.authenticationType : undefined;
+            inputs["createdTime"] = state ? state.createdTime : undefined;
+            inputs["enabled"] = state ? state.enabled : undefined;
+            inputs["firstName"] = state ? state.firstName : undefined;
+            inputs["lastName"] = state ? state.lastName : undefined;
+            inputs["sendEmailNotification"] = state ? state.sendEmailNotification : undefined;
+            inputs["userName"] = state ? state.userName : undefined;
+        } else {
+            const args = argsOrState as UserArgs | undefined;
+            if ((!args || args.authenticationType === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'authenticationType'");
+            }
+            if ((!args || args.userName === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'userName'");
+            }
+            inputs["authenticationType"] = args ? args.authenticationType : undefined;
+            inputs["enabled"] = args ? args.enabled : undefined;
+            inputs["firstName"] = args ? args.firstName : undefined;
+            inputs["lastName"] = args ? args.lastName : undefined;
+            inputs["sendEmailNotification"] = args ? args.sendEmailNotification : undefined;
+            inputs["userName"] = args ? args.userName : undefined;
+            inputs["arn"] = undefined /*out*/;
+            inputs["createdTime"] = undefined /*out*/;
+        }
+        if (!opts.version) {
+            opts = pulumi.mergeOptions(opts, { version: utilities.getVersion()});
+        }
+        super(User.__pulumiType, name, inputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering User resources.
+ */
+export interface UserState {
+    /**
+     * ARN of the appstream user.
+     */
+    arn?: pulumi.Input<string>;
+    /**
+     * Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+     */
+    authenticationType?: pulumi.Input<string>;
+    /**
+     * Date and time, in UTC and extended RFC 3339 format, when the user was created.
+     */
+    createdTime?: pulumi.Input<string>;
+    /**
+     * Specifies whether the user in the user pool is enabled.
+     */
+    enabled?: pulumi.Input<boolean>;
+    /**
+     * First name, or given name, of the user.
+     */
+    firstName?: pulumi.Input<string>;
+    /**
+     * Last name, or surname, of the user.
+     */
+    lastName?: pulumi.Input<string>;
+    /**
+     * Send an email notification.
+     */
+    sendEmailNotification?: pulumi.Input<boolean>;
+    /**
+     * Email address of the user.
+     */
+    userName?: pulumi.Input<string>;
+}
+
+/**
+ * The set of arguments for constructing a User resource.
+ */
+export interface UserArgs {
+    /**
+     * Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+     */
+    authenticationType: pulumi.Input<string>;
+    /**
+     * Specifies whether the user in the user pool is enabled.
+     */
+    enabled?: pulumi.Input<boolean>;
+    /**
+     * First name, or given name, of the user.
+     */
+    firstName?: pulumi.Input<string>;
+    /**
+     * Last name, or surname, of the user.
+     */
+    lastName?: pulumi.Input<string>;
+    /**
+     * Send an email notification.
+     */
+    sendEmailNotification?: pulumi.Input<boolean>;
+    /**
+     * Email address of the user.
+     */
+    userName: pulumi.Input<string>;
+}
diff --git a/sdk/nodejs/appstream/userStackAssociation.ts b/sdk/nodejs/appstream/userStackAssociation.ts
new file mode 100644
index 00000000000..eb5807135da
--- /dev/null
+++ b/sdk/nodejs/appstream/userStackAssociation.ts
@@ -0,0 +1,163 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+/**
+ * Manages an AppStream User Stack association.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const testStack = new aws.appstream.Stack("testStack", {});
+ * const testUser = new aws.appstream.User("testUser", {
+ *     authenticationType: "USERPOOL",
+ *     userName: "EMAIL",
+ * });
+ * const testUserStackAssociation = new aws.appstream.UserStackAssociation("testUserStackAssociation", {
+ *     authenticationType: testUser.authenticationType,
+ *     stackName: testStack.name,
+ *     userName: testUser.userName,
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * AppStream User Stack Association can be imported by using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`), e.g.,
+ *
+ * ```sh
+ *  $ pulumi import aws:appstream/userStackAssociation:UserStackAssociation example userName/auhtenticationType/stackName
+ * ```
+ */
+export class UserStackAssociation extends pulumi.CustomResource {
+    /**
+     * Get an existing UserStackAssociation resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: UserStackAssociationState, opts?: pulumi.CustomResourceOptions): UserStackAssociation {
+        return new UserStackAssociation(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'aws:appstream/userStackAssociation:UserStackAssociation';
+
+    /**
+     * Returns true if the given object is an instance of UserStackAssociation.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is UserStackAssociation {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === UserStackAssociation.__pulumiType;
+    }
+
+    /**
+     * Authentication type for the user.
+     */
+    public readonly authenticationType!: pulumi.Output<string>;
+    /**
+     * Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+     */
+    public readonly sendEmailNotification!: pulumi.Output<boolean | undefined>;
+    /**
+     * Name of the stack that is associated with the user.
+     */
+    public readonly stackName!: pulumi.Output<string>;
+    /**
+     * Email address of the user who is associated with the stack.
+     */
+    public readonly userName!: pulumi.Output<string>;
+
+    /**
+     * Create a UserStackAssociation resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: UserStackAssociationArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: UserStackAssociationArgs | UserStackAssociationState, opts?: pulumi.CustomResourceOptions) {
+        let inputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as UserStackAssociationState | undefined;
+            inputs["authenticationType"] = state ? state.authenticationType : undefined;
+            inputs["sendEmailNotification"] = state ? state.sendEmailNotification : undefined;
+            inputs["stackName"] = state ? state.stackName : undefined;
+            inputs["userName"] = state ? state.userName : undefined;
+        } else {
+            const args = argsOrState as UserStackAssociationArgs | undefined;
+            if ((!args || args.authenticationType === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'authenticationType'");
+            }
+            if ((!args || args.stackName === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'stackName'");
+            }
+            if ((!args || args.userName === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'userName'");
+            }
+            inputs["authenticationType"] = args ? args.authenticationType : undefined;
+            inputs["sendEmailNotification"] = args ? args.sendEmailNotification : undefined;
+            inputs["stackName"] = args ? args.stackName : undefined;
+            inputs["userName"] = args ? args.userName : undefined;
+        }
+        if (!opts.version) {
+            opts = pulumi.mergeOptions(opts, { version: utilities.getVersion()});
+        }
+        super(UserStackAssociation.__pulumiType, name, inputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering UserStackAssociation resources.
+ */
+export interface UserStackAssociationState {
+    /**
+     * Authentication type for the user.
+     */
+    authenticationType?: pulumi.Input<string>;
+    /**
+     * Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+     */
+    sendEmailNotification?: pulumi.Input<boolean>;
+    /**
+     * Name of the stack that is associated with the user.
+     */
+    stackName?: pulumi.Input<string>;
+    /**
+     * Email address of the user who is associated with the stack.
+     */
+    userName?: pulumi.Input<string>;
+}
+
+/**
+ * The set of arguments for constructing a UserStackAssociation resource.
+ */
+export interface UserStackAssociationArgs {
+    /**
+     * Authentication type for the user.
+     */
+    authenticationType: pulumi.Input<string>;
+    /**
+     * Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+     */
+    sendEmailNotification?: pulumi.Input<boolean>;
+    /**
+     * Name of the stack that is associated with the user.
+     */
+    stackName: pulumi.Input<string>;
+    /**
+     * Email address of the user who is associated with the stack.
+     */
+    userName: pulumi.Input<string>;
+}
diff --git a/sdk/nodejs/cfg/remediationConfiguration.ts b/sdk/nodejs/cfg/remediationConfiguration.ts
index 10a2f8d78e1..ff8326c3c87 100644
--- a/sdk/nodejs/cfg/remediationConfiguration.ts
+++ b/sdk/nodejs/cfg/remediationConfiguration.ts
@@ -42,6 +42,15 @@ import * as utilities from "../utilities";
  *             staticValue: "AES256",
  *         },
  *     ],
+ *     automatic: true,
+ *     maximumAutomaticAttempts: 10,
+ *     retryAttemptSeconds: 600,
+ *     executionControls: {
+ *         ssmControls: {
+ *             concurrentExecutionRatePercentage: 25,
+ *             errorPercentage: 20,
+ *         },
+ *     },
  * });
  * ```
  *
@@ -82,28 +91,43 @@ export class RemediationConfiguration extends pulumi.CustomResource {
     }
 
     /**
-     * Amazon Resource Name (ARN) of the Config Remediation Configuration.
+     * ARN of the Config Remediation Configuration.
      */
     public /*out*/ readonly arn!: pulumi.Output<string>;
     /**
-     * The name of the AWS Config rule
+     * Remediation is triggered automatically if `true`.
+     */
+    public readonly automatic!: pulumi.Output<boolean | undefined>;
+    /**
+     * Name of the AWS Config rule.
      */
     public readonly configRuleName!: pulumi.Output<string>;
     /**
-     * Can be specified multiple times for each
-     * parameter. Each parameter block supports fields documented below.
+     * Configuration block for execution controls. See below.
+     */
+    public readonly executionControls!: pulumi.Output<outputs.cfg.RemediationConfigurationExecutionControls | undefined>;
+    /**
+     * Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+     */
+    public readonly maximumAutomaticAttempts!: pulumi.Output<number | undefined>;
+    /**
+     * Can be specified multiple times for each parameter. Each parameter block supports arguments below.
      */
     public readonly parameters!: pulumi.Output<outputs.cfg.RemediationConfigurationParameter[] | undefined>;
     /**
-     * The type of a resource
+     * Type of resource.
      */
     public readonly resourceType!: pulumi.Output<string | undefined>;
     /**
-     * Target ID is the name of the public document
+     * Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+     */
+    public readonly retryAttemptSeconds!: pulumi.Output<number | undefined>;
+    /**
+     * Target ID is the name of the public document.
      */
     public readonly targetId!: pulumi.Output<string>;
     /**
-     * The type of the target. Target executes remediation. For example, SSM document
+     * Type of the target. Target executes remediation. For example, SSM document.
      */
     public readonly targetType!: pulumi.Output<string>;
     /**
@@ -125,9 +149,13 @@ export class RemediationConfiguration extends pulumi.CustomResource {
         if (opts.id) {
             const state = argsOrState as RemediationConfigurationState | undefined;
             inputs["arn"] = state ? state.arn : undefined;
+            inputs["automatic"] = state ? state.automatic : undefined;
             inputs["configRuleName"] = state ? state.configRuleName : undefined;
+            inputs["executionControls"] = state ? state.executionControls : undefined;
+            inputs["maximumAutomaticAttempts"] = state ? state.maximumAutomaticAttempts : undefined;
             inputs["parameters"] = state ? state.parameters : undefined;
             inputs["resourceType"] = state ? state.resourceType : undefined;
+            inputs["retryAttemptSeconds"] = state ? state.retryAttemptSeconds : undefined;
             inputs["targetId"] = state ? state.targetId : undefined;
             inputs["targetType"] = state ? state.targetType : undefined;
             inputs["targetVersion"] = state ? state.targetVersion : undefined;
@@ -142,9 +170,13 @@ export class RemediationConfiguration extends pulumi.CustomResource {
             if ((!args || args.targetType === undefined) && !opts.urn) {
                 throw new Error("Missing required property 'targetType'");
             }
+            inputs["automatic"] = args ? args.automatic : undefined;
             inputs["configRuleName"] = args ? args.configRuleName : undefined;
+            inputs["executionControls"] = args ? args.executionControls : undefined;
+            inputs["maximumAutomaticAttempts"] = args ? args.maximumAutomaticAttempts : undefined;
             inputs["parameters"] = args ? args.parameters : undefined;
             inputs["resourceType"] = args ? args.resourceType : undefined;
+            inputs["retryAttemptSeconds"] = args ? args.retryAttemptSeconds : undefined;
             inputs["targetId"] = args ? args.targetId : undefined;
             inputs["targetType"] = args ? args.targetType : undefined;
             inputs["targetVersion"] = args ? args.targetVersion : undefined;
@@ -162,28 +194,43 @@ export class RemediationConfiguration extends pulumi.CustomResource {
  */
 export interface RemediationConfigurationState {
     /**
-     * Amazon Resource Name (ARN) of the Config Remediation Configuration.
+     * ARN of the Config Remediation Configuration.
      */
     arn?: pulumi.Input<string>;
     /**
-     * The name of the AWS Config rule
+     * Remediation is triggered automatically if `true`.
+     */
+    automatic?: pulumi.Input<boolean>;
+    /**
+     * Name of the AWS Config rule.
      */
     configRuleName?: pulumi.Input<string>;
     /**
-     * Can be specified multiple times for each
-     * parameter. Each parameter block supports fields documented below.
+     * Configuration block for execution controls. See below.
+     */
+    executionControls?: pulumi.Input<inputs.cfg.RemediationConfigurationExecutionControls>;
+    /**
+     * Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+     */
+    maximumAutomaticAttempts?: pulumi.Input<number>;
+    /**
+     * Can be specified multiple times for each parameter. Each parameter block supports arguments below.
      */
     parameters?: pulumi.Input<pulumi.Input<inputs.cfg.RemediationConfigurationParameter>[]>;
     /**
-     * The type of a resource
+     * Type of resource.
      */
     resourceType?: pulumi.Input<string>;
     /**
-     * Target ID is the name of the public document
+     * Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+     */
+    retryAttemptSeconds?: pulumi.Input<number>;
+    /**
+     * Target ID is the name of the public document.
      */
     targetId?: pulumi.Input<string>;
     /**
-     * The type of the target. Target executes remediation. For example, SSM document
+     * Type of the target. Target executes remediation. For example, SSM document.
      */
     targetType?: pulumi.Input<string>;
     /**
@@ -197,24 +244,39 @@ export interface RemediationConfigurationState {
  */
 export interface RemediationConfigurationArgs {
     /**
-     * The name of the AWS Config rule
+     * Remediation is triggered automatically if `true`.
+     */
+    automatic?: pulumi.Input<boolean>;
+    /**
+     * Name of the AWS Config rule.
      */
     configRuleName: pulumi.Input<string>;
     /**
-     * Can be specified multiple times for each
-     * parameter. Each parameter block supports fields documented below.
+     * Configuration block for execution controls. See below.
+     */
+    executionControls?: pulumi.Input<inputs.cfg.RemediationConfigurationExecutionControls>;
+    /**
+     * Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+     */
+    maximumAutomaticAttempts?: pulumi.Input<number>;
+    /**
+     * Can be specified multiple times for each parameter. Each parameter block supports arguments below.
      */
     parameters?: pulumi.Input<pulumi.Input<inputs.cfg.RemediationConfigurationParameter>[]>;
     /**
-     * The type of a resource
+     * Type of resource.
      */
     resourceType?: pulumi.Input<string>;
     /**
-     * Target ID is the name of the public document
+     * Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+     */
+    retryAttemptSeconds?: pulumi.Input<number>;
+    /**
+     * Target ID is the name of the public document.
      */
     targetId: pulumi.Input<string>;
     /**
-     * The type of the target. Target executes remediation. For example, SSM document
+     * Type of the target. Target executes remediation. For example, SSM document.
      */
     targetType: pulumi.Input<string>;
     /**
diff --git a/sdk/nodejs/dlm/lifecyclePolicy.ts b/sdk/nodejs/dlm/lifecyclePolicy.ts
index 2cb3aae496a..79add0d090c 100644
--- a/sdk/nodejs/dlm/lifecyclePolicy.ts
+++ b/sdk/nodejs/dlm/lifecyclePolicy.ts
@@ -9,6 +9,7 @@ import * as utilities from "../utilities";
  * Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
  *
  * ## Example Usage
+ * ### Basic
  *
  * ```typescript
  * import * as pulumi from "@pulumi/pulumi";
@@ -83,10 +84,75 @@ import * as utilities from "../utilities";
  *     },
  * });
  * ```
+ * ### Example Cross-Region Snapshot Copy Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * // ...other configuration...
+ * const dlmCrossRegionCopyCmk = new aws.kms.Key("dlmCrossRegionCopyCmk", {
+ *     description: "Example Alternate Region KMS Key",
+ *     policy: `{
+ *   "Version": "2012-10-17",
+ *   "Id": "dlm-cross-region-copy-cmk",
+ *   "Statement": [
+ *     {
+ *       "Sid": "Enable IAM User Permissions",
+ *       "Effect": "Allow",
+ *       "Principal": {
+ *         "AWS": "*"
+ *       },
+ *       "Action": "kms:*",
+ *       "Resource": "*"
+ *     }
+ *   ]
+ * }
+ * `,
+ * }, {
+ *     provider: aws.alternate,
+ * });
+ * const example = new aws.dlm.LifecyclePolicy("example", {
+ *     description: "example DLM lifecycle policy",
+ *     executionRoleArn: aws_iam_role.dlm_lifecycle_role.arn,
+ *     state: "ENABLED",
+ *     policyDetails: {
+ *         resourceTypes: ["VOLUME"],
+ *         schedules: [{
+ *             name: "2 weeks of daily snapshots",
+ *             createRule: {
+ *                 interval: 24,
+ *                 intervalUnit: "HOURS",
+ *                 times: ["23:45"],
+ *             },
+ *             retainRule: {
+ *                 count: 14,
+ *             },
+ *             tagsToAdd: {
+ *                 SnapshotCreator: "DLM",
+ *             },
+ *             copyTags: false,
+ *             crossRegionCopyRules: [{
+ *                 target: "us-west-2",
+ *                 encrypted: true,
+ *                 cmkArn: dlmCrossRegionCopyCmk.arn,
+ *                 copyTags: true,
+ *                 retainRule: {
+ *                     interval: 30,
+ *                     intervalUnit: "DAYS",
+ *                 },
+ *             }],
+ *         }],
+ *         targetTags: {
+ *             Snapshot: "true",
+ *         },
+ *     },
+ * });
+ * ```
  *
  * ## Import
  *
- * DLM lifecyle policies can be imported by their policy ID
+ * DLM lifecycle policies can be imported by their policy ID
  *
  * ```sh
  *  $ pulumi import aws:dlm/lifecyclePolicy:LifecyclePolicy example policy-abcdef12345678901
diff --git a/sdk/nodejs/ec2/getInstanceTypes.ts b/sdk/nodejs/ec2/getInstanceTypes.ts
new file mode 100644
index 00000000000..26846bb9e27
--- /dev/null
+++ b/sdk/nodejs/ec2/getInstanceTypes.ts
@@ -0,0 +1,93 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import { input as inputs, output as outputs, enums } from "../types";
+import * as utilities from "../utilities";
+
+/**
+ * Information about EC2 Instance Types.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const test = pulumi.output(aws.ec2.getInstanceTypes({
+ *     filters: [
+ *         {
+ *             name: "auto-recovery-supported",
+ *             values: ["true"],
+ *         },
+ *         {
+ *             name: "network-info.encryption-in-transit-supported",
+ *             values: ["true"],
+ *         },
+ *         {
+ *             name: "instance-storage-supported",
+ *             values: ["true"],
+ *         },
+ *         {
+ *             name: "instance-type",
+ *             values: [
+ *                 "g5.2xlarge",
+ *                 "g5.4xlarge",
+ *             ],
+ *         },
+ *     ],
+ * }));
+ * ```
+ */
+export function getInstanceTypes(args?: GetInstanceTypesArgs, opts?: pulumi.InvokeOptions): Promise<GetInstanceTypesResult> {
+    args = args || {};
+    if (!opts) {
+        opts = {}
+    }
+
+    if (!opts.version) {
+        opts.version = utilities.getVersion();
+    }
+    return pulumi.runtime.invoke("aws:ec2/getInstanceTypes:getInstanceTypes", {
+        "filters": args.filters,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getInstanceTypes.
+ */
+export interface GetInstanceTypesArgs {
+    /**
+     * One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
+     */
+    filters?: inputs.ec2.GetInstanceTypesFilter[];
+}
+
+/**
+ * A collection of values returned by getInstanceTypes.
+ */
+export interface GetInstanceTypesResult {
+    readonly filters?: outputs.ec2.GetInstanceTypesFilter[];
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    /**
+     * List of EC2 Instance Types.
+     */
+    readonly instanceTypes: string[];
+}
+
+export function getInstanceTypesOutput(args?: GetInstanceTypesOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetInstanceTypesResult> {
+    return pulumi.output(args).apply(a => getInstanceTypes(a, opts))
+}
+
+/**
+ * A collection of arguments for invoking getInstanceTypes.
+ */
+export interface GetInstanceTypesOutputArgs {
+    /**
+     * One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
+     */
+    filters?: pulumi.Input<pulumi.Input<inputs.ec2.GetInstanceTypesFilterArgs>[]>;
+}
diff --git a/sdk/nodejs/ec2/index.ts b/sdk/nodejs/ec2/index.ts
index 1fd18dabbee..06ff24373f3 100644
--- a/sdk/nodejs/ec2/index.ts
+++ b/sdk/nodejs/ec2/index.ts
@@ -36,6 +36,7 @@ export * from "./getInstance";
 export * from "./getInstanceType";
 export * from "./getInstanceTypeOffering";
 export * from "./getInstanceTypeOfferings";
+export * from "./getInstanceTypes";
 export * from "./getInstances";
 export * from "./getInternetGateway";
 export * from "./getKeyPair";
diff --git a/sdk/nodejs/ecs/capacityProvider.ts b/sdk/nodejs/ecs/capacityProvider.ts
index 118c460310f..3b65462dc3a 100644
--- a/sdk/nodejs/ecs/capacityProvider.ts
+++ b/sdk/nodejs/ecs/capacityProvider.ts
@@ -19,7 +19,7 @@ import * as utilities from "../utilities";
  * // ... other configuration, including potentially other tags ...
  * const testGroup = new aws.autoscaling.Group("testGroup", {tags: [{
  *     key: "AmazonECSManaged",
- *     value: "",
+ *     value: true,
  *     propagateAtLaunch: true,
  * }]});
  * const testCapacityProvider = new aws.ecs.CapacityProvider("testCapacityProvider", {autoScalingGroupProvider: {
diff --git a/sdk/nodejs/ecs/service.ts b/sdk/nodejs/ecs/service.ts
index ee3e9eb92d5..81a8f8c6f88 100644
--- a/sdk/nodejs/ecs/service.ts
+++ b/sdk/nodejs/ecs/service.ts
@@ -114,19 +114,19 @@ export class Service extends pulumi.CustomResource {
     }
 
     /**
-     * Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+     * Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `forceNewDeployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
      */
     public readonly capacityProviderStrategies!: pulumi.Output<outputs.ecs.ServiceCapacityProviderStrategy[] | undefined>;
     /**
-     * ARN of an ECS cluster
+     * ARN of an ECS cluster.
      */
     public readonly cluster!: pulumi.Output<string>;
     /**
-     * Configuration block for deployment circuit breaker. Detailed below.
+     * Configuration block for deployment circuit breaker. See below.
      */
     public readonly deploymentCircuitBreaker!: pulumi.Output<outputs.ecs.ServiceDeploymentCircuitBreaker | undefined>;
     /**
-     * Configuration block for deployment controller configuration. Detailed below.
+     * Configuration block for deployment controller configuration. See below.
      */
     public readonly deploymentController!: pulumi.Output<outputs.ecs.ServiceDeploymentController | undefined>;
     /**
@@ -166,7 +166,7 @@ export class Service extends pulumi.CustomResource {
      */
     public readonly launchType!: pulumi.Output<string>;
     /**
-     * Configuration block for load balancers. Detailed below.
+     * Configuration block for load balancers. See below.
      */
     public readonly loadBalancers!: pulumi.Output<outputs.ecs.ServiceLoadBalancer[] | undefined>;
     /**
@@ -174,15 +174,15 @@ export class Service extends pulumi.CustomResource {
      */
     public readonly name!: pulumi.Output<string>;
     /**
-     * Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+     * Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
      */
     public readonly networkConfiguration!: pulumi.Output<outputs.ecs.ServiceNetworkConfiguration | undefined>;
     /**
-     * Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. Detailed below.
+     * Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
      */
     public readonly orderedPlacementStrategies!: pulumi.Output<outputs.ecs.ServiceOrderedPlacementStrategy[] | undefined>;
     /**
-     * Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. Detailed below.
+     * Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
      */
     public readonly placementConstraints!: pulumi.Output<outputs.ecs.ServicePlacementConstraint[] | undefined>;
     /**
@@ -198,11 +198,11 @@ export class Service extends pulumi.CustomResource {
      */
     public readonly schedulingStrategy!: pulumi.Output<string | undefined>;
     /**
-     * Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. Detailed below.
+     * Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
      */
     public readonly serviceRegistries!: pulumi.Output<outputs.ecs.ServiceServiceRegistries | undefined>;
     /**
-     * Key-value map of resource tags.
+     * Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     public readonly tags!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
@@ -298,19 +298,19 @@ export class Service extends pulumi.CustomResource {
  */
 export interface ServiceState {
     /**
-     * Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+     * Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `forceNewDeployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
      */
     capacityProviderStrategies?: pulumi.Input<pulumi.Input<inputs.ecs.ServiceCapacityProviderStrategy>[]>;
     /**
-     * ARN of an ECS cluster
+     * ARN of an ECS cluster.
      */
     cluster?: pulumi.Input<string>;
     /**
-     * Configuration block for deployment circuit breaker. Detailed below.
+     * Configuration block for deployment circuit breaker. See below.
      */
     deploymentCircuitBreaker?: pulumi.Input<inputs.ecs.ServiceDeploymentCircuitBreaker>;
     /**
-     * Configuration block for deployment controller configuration. Detailed below.
+     * Configuration block for deployment controller configuration. See below.
      */
     deploymentController?: pulumi.Input<inputs.ecs.ServiceDeploymentController>;
     /**
@@ -350,7 +350,7 @@ export interface ServiceState {
      */
     launchType?: pulumi.Input<string>;
     /**
-     * Configuration block for load balancers. Detailed below.
+     * Configuration block for load balancers. See below.
      */
     loadBalancers?: pulumi.Input<pulumi.Input<inputs.ecs.ServiceLoadBalancer>[]>;
     /**
@@ -358,15 +358,15 @@ export interface ServiceState {
      */
     name?: pulumi.Input<string>;
     /**
-     * Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+     * Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
      */
     networkConfiguration?: pulumi.Input<inputs.ecs.ServiceNetworkConfiguration>;
     /**
-     * Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. Detailed below.
+     * Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
      */
     orderedPlacementStrategies?: pulumi.Input<pulumi.Input<inputs.ecs.ServiceOrderedPlacementStrategy>[]>;
     /**
-     * Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. Detailed below.
+     * Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
      */
     placementConstraints?: pulumi.Input<pulumi.Input<inputs.ecs.ServicePlacementConstraint>[]>;
     /**
@@ -382,11 +382,11 @@ export interface ServiceState {
      */
     schedulingStrategy?: pulumi.Input<string>;
     /**
-     * Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. Detailed below.
+     * Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
      */
     serviceRegistries?: pulumi.Input<inputs.ecs.ServiceServiceRegistries>;
     /**
-     * Key-value map of resource tags.
+     * Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
@@ -408,19 +408,19 @@ export interface ServiceState {
  */
 export interface ServiceArgs {
     /**
-     * Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+     * Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `forceNewDeployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
      */
     capacityProviderStrategies?: pulumi.Input<pulumi.Input<inputs.ecs.ServiceCapacityProviderStrategy>[]>;
     /**
-     * ARN of an ECS cluster
+     * ARN of an ECS cluster.
      */
     cluster?: pulumi.Input<string>;
     /**
-     * Configuration block for deployment circuit breaker. Detailed below.
+     * Configuration block for deployment circuit breaker. See below.
      */
     deploymentCircuitBreaker?: pulumi.Input<inputs.ecs.ServiceDeploymentCircuitBreaker>;
     /**
-     * Configuration block for deployment controller configuration. Detailed below.
+     * Configuration block for deployment controller configuration. See below.
      */
     deploymentController?: pulumi.Input<inputs.ecs.ServiceDeploymentController>;
     /**
@@ -460,7 +460,7 @@ export interface ServiceArgs {
      */
     launchType?: pulumi.Input<string>;
     /**
-     * Configuration block for load balancers. Detailed below.
+     * Configuration block for load balancers. See below.
      */
     loadBalancers?: pulumi.Input<pulumi.Input<inputs.ecs.ServiceLoadBalancer>[]>;
     /**
@@ -468,15 +468,15 @@ export interface ServiceArgs {
      */
     name?: pulumi.Input<string>;
     /**
-     * Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+     * Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
      */
     networkConfiguration?: pulumi.Input<inputs.ecs.ServiceNetworkConfiguration>;
     /**
-     * Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. Detailed below.
+     * Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
      */
     orderedPlacementStrategies?: pulumi.Input<pulumi.Input<inputs.ecs.ServiceOrderedPlacementStrategy>[]>;
     /**
-     * Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. Detailed below.
+     * Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
      */
     placementConstraints?: pulumi.Input<pulumi.Input<inputs.ecs.ServicePlacementConstraint>[]>;
     /**
@@ -492,11 +492,11 @@ export interface ServiceArgs {
      */
     schedulingStrategy?: pulumi.Input<string>;
     /**
-     * Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. Detailed below.
+     * Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
      */
     serviceRegistries?: pulumi.Input<inputs.ecs.ServiceServiceRegistries>;
     /**
-     * Key-value map of resource tags.
+     * Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
diff --git a/sdk/nodejs/elasticloadbalancing/getLoadBalancer.ts b/sdk/nodejs/elasticloadbalancing/getLoadBalancer.ts
index cbc3a5f384c..03b5a1e2301 100644
--- a/sdk/nodejs/elasticloadbalancing/getLoadBalancer.ts
+++ b/sdk/nodejs/elasticloadbalancing/getLoadBalancer.ts
@@ -64,6 +64,7 @@ export interface GetLoadBalancerResult {
     readonly connectionDraining: boolean;
     readonly connectionDrainingTimeout: number;
     readonly crossZoneLoadBalancing: boolean;
+    readonly desyncMitigationMode: string;
     readonly dnsName: string;
     readonly healthCheck: outputs.elasticloadbalancing.GetLoadBalancerHealthCheck;
     /**
diff --git a/sdk/nodejs/elasticloadbalancing/loadBalancer.ts b/sdk/nodejs/elasticloadbalancing/loadBalancer.ts
index a88d96f55c0..e3e69c2353f 100644
--- a/sdk/nodejs/elasticloadbalancing/loadBalancer.ts
+++ b/sdk/nodejs/elasticloadbalancing/loadBalancer.ts
@@ -138,6 +138,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * Enable cross-zone load balancing. Default: `true`
      */
     public readonly crossZoneLoadBalancing!: pulumi.Output<boolean | undefined>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    public readonly desyncMitigationMode!: pulumi.Output<string | undefined>;
     /**
      * The DNS name of the ELB
      */
@@ -224,6 +228,7 @@ export class LoadBalancer extends pulumi.CustomResource {
             inputs["connectionDraining"] = state ? state.connectionDraining : undefined;
             inputs["connectionDrainingTimeout"] = state ? state.connectionDrainingTimeout : undefined;
             inputs["crossZoneLoadBalancing"] = state ? state.crossZoneLoadBalancing : undefined;
+            inputs["desyncMitigationMode"] = state ? state.desyncMitigationMode : undefined;
             inputs["dnsName"] = state ? state.dnsName : undefined;
             inputs["healthCheck"] = state ? state.healthCheck : undefined;
             inputs["idleTimeout"] = state ? state.idleTimeout : undefined;
@@ -249,6 +254,7 @@ export class LoadBalancer extends pulumi.CustomResource {
             inputs["connectionDraining"] = args ? args.connectionDraining : undefined;
             inputs["connectionDrainingTimeout"] = args ? args.connectionDrainingTimeout : undefined;
             inputs["crossZoneLoadBalancing"] = args ? args.crossZoneLoadBalancing : undefined;
+            inputs["desyncMitigationMode"] = args ? args.desyncMitigationMode : undefined;
             inputs["healthCheck"] = args ? args.healthCheck : undefined;
             inputs["idleTimeout"] = args ? args.idleTimeout : undefined;
             inputs["instances"] = args ? args.instances : undefined;
@@ -301,6 +307,10 @@ export interface LoadBalancerState {
      * Enable cross-zone load balancing. Default: `true`
      */
     crossZoneLoadBalancing?: pulumi.Input<boolean>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * The DNS name of the ELB
      */
@@ -390,6 +400,10 @@ export interface LoadBalancerArgs {
      * Enable cross-zone load balancing. Default: `true`
      */
     crossZoneLoadBalancing?: pulumi.Input<boolean>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * A healthCheck block. Health Check documented below.
      */
diff --git a/sdk/nodejs/elasticloadbalancingv2/getLoadBalancer.ts b/sdk/nodejs/elasticloadbalancingv2/getLoadBalancer.ts
index 522d76fedbe..ae582bb8870 100644
--- a/sdk/nodejs/elasticloadbalancingv2/getLoadBalancer.ts
+++ b/sdk/nodejs/elasticloadbalancingv2/getLoadBalancer.ts
@@ -73,10 +73,12 @@ export interface GetLoadBalancerResult {
     readonly arn: string;
     readonly arnSuffix: string;
     readonly customerOwnedIpv4Pool: string;
+    readonly desyncMitigationMode: string;
     readonly dnsName: string;
     readonly dropInvalidHeaderFields: boolean;
     readonly enableDeletionProtection: boolean;
     readonly enableHttp2: boolean;
+    readonly enableWafFailOpen: boolean;
     /**
      * The provider-assigned unique ID for this managed resource.
      */
diff --git a/sdk/nodejs/elasticloadbalancingv2/loadBalancer.ts b/sdk/nodejs/elasticloadbalancingv2/loadBalancer.ts
index 2e959aa52ff..3808a67e83d 100644
--- a/sdk/nodejs/elasticloadbalancingv2/loadBalancer.ts
+++ b/sdk/nodejs/elasticloadbalancingv2/loadBalancer.ts
@@ -145,6 +145,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     public readonly customerOwnedIpv4Pool!: pulumi.Output<string | undefined>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    public readonly desyncMitigationMode!: pulumi.Output<string | undefined>;
     /**
      * The DNS name of the load balancer.
      */
@@ -167,6 +171,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     public readonly enableHttp2!: pulumi.Output<boolean | undefined>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    public readonly enableWafFailOpen!: pulumi.Output<boolean | undefined>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -208,7 +216,7 @@ export class LoadBalancer extends pulumi.CustomResource {
      */
     public readonly subnets!: pulumi.Output<string[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     public readonly tags!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
@@ -242,11 +250,13 @@ export class LoadBalancer extends pulumi.CustomResource {
             inputs["arn"] = state ? state.arn : undefined;
             inputs["arnSuffix"] = state ? state.arnSuffix : undefined;
             inputs["customerOwnedIpv4Pool"] = state ? state.customerOwnedIpv4Pool : undefined;
+            inputs["desyncMitigationMode"] = state ? state.desyncMitigationMode : undefined;
             inputs["dnsName"] = state ? state.dnsName : undefined;
             inputs["dropInvalidHeaderFields"] = state ? state.dropInvalidHeaderFields : undefined;
             inputs["enableCrossZoneLoadBalancing"] = state ? state.enableCrossZoneLoadBalancing : undefined;
             inputs["enableDeletionProtection"] = state ? state.enableDeletionProtection : undefined;
             inputs["enableHttp2"] = state ? state.enableHttp2 : undefined;
+            inputs["enableWafFailOpen"] = state ? state.enableWafFailOpen : undefined;
             inputs["idleTimeout"] = state ? state.idleTimeout : undefined;
             inputs["internal"] = state ? state.internal : undefined;
             inputs["ipAddressType"] = state ? state.ipAddressType : undefined;
@@ -264,10 +274,12 @@ export class LoadBalancer extends pulumi.CustomResource {
             const args = argsOrState as LoadBalancerArgs | undefined;
             inputs["accessLogs"] = args ? args.accessLogs : undefined;
             inputs["customerOwnedIpv4Pool"] = args ? args.customerOwnedIpv4Pool : undefined;
+            inputs["desyncMitigationMode"] = args ? args.desyncMitigationMode : undefined;
             inputs["dropInvalidHeaderFields"] = args ? args.dropInvalidHeaderFields : undefined;
             inputs["enableCrossZoneLoadBalancing"] = args ? args.enableCrossZoneLoadBalancing : undefined;
             inputs["enableDeletionProtection"] = args ? args.enableDeletionProtection : undefined;
             inputs["enableHttp2"] = args ? args.enableHttp2 : undefined;
+            inputs["enableWafFailOpen"] = args ? args.enableWafFailOpen : undefined;
             inputs["idleTimeout"] = args ? args.idleTimeout : undefined;
             inputs["internal"] = args ? args.internal : undefined;
             inputs["ipAddressType"] = args ? args.ipAddressType : undefined;
@@ -312,6 +324,10 @@ export interface LoadBalancerState {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     customerOwnedIpv4Pool?: pulumi.Input<string>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * The DNS name of the load balancer.
      */
@@ -334,6 +350,10 @@ export interface LoadBalancerState {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     enableHttp2?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    enableWafFailOpen?: pulumi.Input<boolean>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -375,7 +395,7 @@ export interface LoadBalancerState {
      */
     subnets?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
@@ -402,6 +422,10 @@ export interface LoadBalancerArgs {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     customerOwnedIpv4Pool?: pulumi.Input<string>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
      */
@@ -420,6 +444,10 @@ export interface LoadBalancerArgs {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     enableHttp2?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    enableWafFailOpen?: pulumi.Input<boolean>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -461,7 +489,7 @@ export interface LoadBalancerArgs {
      */
     subnets?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
 }
diff --git a/sdk/nodejs/elb/getLoadBalancer.ts b/sdk/nodejs/elb/getLoadBalancer.ts
index 05027726ae4..9f9ba75131e 100644
--- a/sdk/nodejs/elb/getLoadBalancer.ts
+++ b/sdk/nodejs/elb/getLoadBalancer.ts
@@ -62,6 +62,7 @@ export interface GetLoadBalancerResult {
     readonly connectionDraining: boolean;
     readonly connectionDrainingTimeout: number;
     readonly crossZoneLoadBalancing: boolean;
+    readonly desyncMitigationMode: string;
     readonly dnsName: string;
     readonly healthCheck: outputs.elb.GetLoadBalancerHealthCheck;
     /**
diff --git a/sdk/nodejs/elb/loadBalancer.ts b/sdk/nodejs/elb/loadBalancer.ts
index 5f0c13283a6..580e3717e3a 100644
--- a/sdk/nodejs/elb/loadBalancer.ts
+++ b/sdk/nodejs/elb/loadBalancer.ts
@@ -135,6 +135,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * Enable cross-zone load balancing. Default: `true`
      */
     public readonly crossZoneLoadBalancing!: pulumi.Output<boolean | undefined>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    public readonly desyncMitigationMode!: pulumi.Output<string | undefined>;
     /**
      * The DNS name of the ELB
      */
@@ -218,6 +222,7 @@ export class LoadBalancer extends pulumi.CustomResource {
             inputs["connectionDraining"] = state ? state.connectionDraining : undefined;
             inputs["connectionDrainingTimeout"] = state ? state.connectionDrainingTimeout : undefined;
             inputs["crossZoneLoadBalancing"] = state ? state.crossZoneLoadBalancing : undefined;
+            inputs["desyncMitigationMode"] = state ? state.desyncMitigationMode : undefined;
             inputs["dnsName"] = state ? state.dnsName : undefined;
             inputs["healthCheck"] = state ? state.healthCheck : undefined;
             inputs["idleTimeout"] = state ? state.idleTimeout : undefined;
@@ -243,6 +248,7 @@ export class LoadBalancer extends pulumi.CustomResource {
             inputs["connectionDraining"] = args ? args.connectionDraining : undefined;
             inputs["connectionDrainingTimeout"] = args ? args.connectionDrainingTimeout : undefined;
             inputs["crossZoneLoadBalancing"] = args ? args.crossZoneLoadBalancing : undefined;
+            inputs["desyncMitigationMode"] = args ? args.desyncMitigationMode : undefined;
             inputs["healthCheck"] = args ? args.healthCheck : undefined;
             inputs["idleTimeout"] = args ? args.idleTimeout : undefined;
             inputs["instances"] = args ? args.instances : undefined;
@@ -297,6 +303,10 @@ export interface LoadBalancerState {
      * Enable cross-zone load balancing. Default: `true`
      */
     crossZoneLoadBalancing?: pulumi.Input<boolean>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * The DNS name of the ELB
      */
@@ -386,6 +396,10 @@ export interface LoadBalancerArgs {
      * Enable cross-zone load balancing. Default: `true`
      */
     crossZoneLoadBalancing?: pulumi.Input<boolean>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * A healthCheck block. Health Check documented below.
      */
diff --git a/sdk/nodejs/fsx/index.ts b/sdk/nodejs/fsx/index.ts
index 1a1cf155263..cec0b33302e 100644
--- a/sdk/nodejs/fsx/index.ts
+++ b/sdk/nodejs/fsx/index.ts
@@ -8,12 +8,16 @@ import * as utilities from "../utilities";
 export * from "./backup";
 export * from "./lustreFileSystem";
 export * from "./ontapFileSystem";
+export * from "./ontapStorageVirtualMachine";
+export * from "./ontapVolume";
 export * from "./windowsFileSystem";
 
 // Import resources to register:
 import { Backup } from "./backup";
 import { LustreFileSystem } from "./lustreFileSystem";
 import { OntapFileSystem } from "./ontapFileSystem";
+import { OntapStorageVirtualMachine } from "./ontapStorageVirtualMachine";
+import { OntapVolume } from "./ontapVolume";
 import { WindowsFileSystem } from "./windowsFileSystem";
 
 const _module = {
@@ -26,6 +30,10 @@ const _module = {
                 return new LustreFileSystem(name, <any>undefined, { urn })
             case "aws:fsx/ontapFileSystem:OntapFileSystem":
                 return new OntapFileSystem(name, <any>undefined, { urn })
+            case "aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine":
+                return new OntapStorageVirtualMachine(name, <any>undefined, { urn })
+            case "aws:fsx/ontapVolume:OntapVolume":
+                return new OntapVolume(name, <any>undefined, { urn })
             case "aws:fsx/windowsFileSystem:WindowsFileSystem":
                 return new WindowsFileSystem(name, <any>undefined, { urn })
             default:
@@ -36,4 +44,6 @@ const _module = {
 pulumi.runtime.registerResourceModule("aws", "fsx/backup", _module)
 pulumi.runtime.registerResourceModule("aws", "fsx/lustreFileSystem", _module)
 pulumi.runtime.registerResourceModule("aws", "fsx/ontapFileSystem", _module)
+pulumi.runtime.registerResourceModule("aws", "fsx/ontapStorageVirtualMachine", _module)
+pulumi.runtime.registerResourceModule("aws", "fsx/ontapVolume", _module)
 pulumi.runtime.registerResourceModule("aws", "fsx/windowsFileSystem", _module)
diff --git a/sdk/nodejs/fsx/ontapStorageVirtualMachine.ts b/sdk/nodejs/fsx/ontapStorageVirtualMachine.ts
new file mode 100644
index 00000000000..f09bcb21ddc
--- /dev/null
+++ b/sdk/nodejs/fsx/ontapStorageVirtualMachine.ts
@@ -0,0 +1,262 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import { input as inputs, output as outputs, enums } from "../types";
+import * as utilities from "../utilities";
+
+/**
+ * Manages a FSx Storage Virtual Machine.
+ * See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html) for more information.
+ *
+ * ## Example Usage
+ * ### Basic Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const test = new aws.fsx.OntapStorageVirtualMachine("test", {fileSystemId: aws_fsx_ontap_file_system.test.id});
+ * ```
+ * ### Using a Self-Managed Microsoft Active Directory
+ *
+ * Additional information for using AWS Directory Service with ONTAP File Systems can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD.html).
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const test = new aws.fsx.OntapStorageVirtualMachine("test", {
+ *     fileSystemId: aws_fsx_ontap_file_system.test.id,
+ *     activeDirectoryConfiguration: {
+ *         netbiosName: "mysvm",
+ *         selfManagedActiveDirectoryConfiguration: {
+ *             dnsIps: [
+ *                 "10.0.0.111",
+ *                 "10.0.0.222",
+ *             ],
+ *             domainName: "corp.example.com",
+ *             password: "avoid-plaintext-passwords",
+ *             username: "Admin",
+ *         },
+ *     },
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * FSx Storage Virtual Machine can be imported using the `id`, e.g.,
+ *
+ * ```sh
+ *  $ pulumi import aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine example svm-12345678abcdef123
+ * ```
+ *
+ *  Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g., terraform resource "aws_fsx_ontap_storage_virtual_machine" "example" {
+ *
+ * # ... other configuration ...
+ *
+ *  svm_admin_password = "avoid-plaintext-passwords"
+ *
+ * # There is no FSx API for reading svm_admin_password
+ *
+ *  lifecycle {
+ *
+ *  ignore_changes = [svm_admin_password]
+ *
+ *  } }
+ */
+export class OntapStorageVirtualMachine extends pulumi.CustomResource {
+    /**
+     * Get an existing OntapStorageVirtualMachine resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: OntapStorageVirtualMachineState, opts?: pulumi.CustomResourceOptions): OntapStorageVirtualMachine {
+        return new OntapStorageVirtualMachine(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine';
+
+    /**
+     * Returns true if the given object is an instance of OntapStorageVirtualMachine.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is OntapStorageVirtualMachine {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === OntapStorageVirtualMachine.__pulumiType;
+    }
+
+    /**
+     * Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+     */
+    public readonly activeDirectoryConfiguration!: pulumi.Output<outputs.fsx.OntapStorageVirtualMachineActiveDirectoryConfiguration | undefined>;
+    /**
+     * Amazon Resource Name of the storage virtual machine.
+     */
+    public /*out*/ readonly arn!: pulumi.Output<string>;
+    /**
+     * The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+     */
+    public /*out*/ readonly endpoints!: pulumi.Output<outputs.fsx.OntapStorageVirtualMachineEndpoint[]>;
+    /**
+     * The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+     */
+    public readonly fileSystemId!: pulumi.Output<string>;
+    /**
+     * The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+     */
+    public readonly name!: pulumi.Output<string>;
+    /**
+     * Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+     */
+    public readonly rootVolumeSecurityStyle!: pulumi.Output<string | undefined>;
+    /**
+     * Describes the SVM's subtype, e.g. `DEFAULT`
+     */
+    public /*out*/ readonly subtype!: pulumi.Output<string>;
+    public readonly svmAdminPassword!: pulumi.Output<string | undefined>;
+    /**
+     * A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+     */
+    public readonly tags!: pulumi.Output<{[key: string]: string} | undefined>;
+    /**
+     * A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+     */
+    public readonly tagsAll!: pulumi.Output<{[key: string]: string}>;
+    /**
+     * The SVM's UUID (universally unique identifier).
+     */
+    public /*out*/ readonly uuid!: pulumi.Output<string>;
+
+    /**
+     * Create a OntapStorageVirtualMachine resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: OntapStorageVirtualMachineArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: OntapStorageVirtualMachineArgs | OntapStorageVirtualMachineState, opts?: pulumi.CustomResourceOptions) {
+        let inputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as OntapStorageVirtualMachineState | undefined;
+            inputs["activeDirectoryConfiguration"] = state ? state.activeDirectoryConfiguration : undefined;
+            inputs["arn"] = state ? state.arn : undefined;
+            inputs["endpoints"] = state ? state.endpoints : undefined;
+            inputs["fileSystemId"] = state ? state.fileSystemId : undefined;
+            inputs["name"] = state ? state.name : undefined;
+            inputs["rootVolumeSecurityStyle"] = state ? state.rootVolumeSecurityStyle : undefined;
+            inputs["subtype"] = state ? state.subtype : undefined;
+            inputs["svmAdminPassword"] = state ? state.svmAdminPassword : undefined;
+            inputs["tags"] = state ? state.tags : undefined;
+            inputs["tagsAll"] = state ? state.tagsAll : undefined;
+            inputs["uuid"] = state ? state.uuid : undefined;
+        } else {
+            const args = argsOrState as OntapStorageVirtualMachineArgs | undefined;
+            if ((!args || args.fileSystemId === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'fileSystemId'");
+            }
+            inputs["activeDirectoryConfiguration"] = args ? args.activeDirectoryConfiguration : undefined;
+            inputs["fileSystemId"] = args ? args.fileSystemId : undefined;
+            inputs["name"] = args ? args.name : undefined;
+            inputs["rootVolumeSecurityStyle"] = args ? args.rootVolumeSecurityStyle : undefined;
+            inputs["svmAdminPassword"] = args ? args.svmAdminPassword : undefined;
+            inputs["tags"] = args ? args.tags : undefined;
+            inputs["tagsAll"] = args ? args.tagsAll : undefined;
+            inputs["arn"] = undefined /*out*/;
+            inputs["endpoints"] = undefined /*out*/;
+            inputs["subtype"] = undefined /*out*/;
+            inputs["uuid"] = undefined /*out*/;
+        }
+        if (!opts.version) {
+            opts = pulumi.mergeOptions(opts, { version: utilities.getVersion()});
+        }
+        super(OntapStorageVirtualMachine.__pulumiType, name, inputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering OntapStorageVirtualMachine resources.
+ */
+export interface OntapStorageVirtualMachineState {
+    /**
+     * Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+     */
+    activeDirectoryConfiguration?: pulumi.Input<inputs.fsx.OntapStorageVirtualMachineActiveDirectoryConfiguration>;
+    /**
+     * Amazon Resource Name of the storage virtual machine.
+     */
+    arn?: pulumi.Input<string>;
+    /**
+     * The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+     */
+    endpoints?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpoint>[]>;
+    /**
+     * The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+     */
+    fileSystemId?: pulumi.Input<string>;
+    /**
+     * The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+     */
+    rootVolumeSecurityStyle?: pulumi.Input<string>;
+    /**
+     * Describes the SVM's subtype, e.g. `DEFAULT`
+     */
+    subtype?: pulumi.Input<string>;
+    svmAdminPassword?: pulumi.Input<string>;
+    /**
+     * A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+     */
+    tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
+    /**
+     * A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+     */
+    tagsAll?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
+    /**
+     * The SVM's UUID (universally unique identifier).
+     */
+    uuid?: pulumi.Input<string>;
+}
+
+/**
+ * The set of arguments for constructing a OntapStorageVirtualMachine resource.
+ */
+export interface OntapStorageVirtualMachineArgs {
+    /**
+     * Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+     */
+    activeDirectoryConfiguration?: pulumi.Input<inputs.fsx.OntapStorageVirtualMachineActiveDirectoryConfiguration>;
+    /**
+     * The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+     */
+    fileSystemId: pulumi.Input<string>;
+    /**
+     * The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+     */
+    rootVolumeSecurityStyle?: pulumi.Input<string>;
+    svmAdminPassword?: pulumi.Input<string>;
+    /**
+     * A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+     */
+    tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
+    /**
+     * A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+     */
+    tagsAll?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
+}
diff --git a/sdk/nodejs/fsx/ontapVolume.ts b/sdk/nodejs/fsx/ontapVolume.ts
new file mode 100644
index 00000000000..362800a98b3
--- /dev/null
+++ b/sdk/nodejs/fsx/ontapVolume.ts
@@ -0,0 +1,309 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import { input as inputs, output as outputs, enums } from "../types";
+import * as utilities from "../utilities";
+
+/**
+ * Manages a FSx ONTAP Volume.
+ * See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html) for more information.
+ *
+ * ## Example Usage
+ * ### Basic Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const test = new aws.fsx.OntapVolume("test", {
+ *     junctionPath: "/test",
+ *     sizeInMegabytes: 1024,
+ *     storageEfficiencyEnabled: true,
+ *     storageVirtualMachineId: aws_fsx_ontap_storage_virtual_machine.test.id,
+ * });
+ * ```
+ * ### Using Tiering Policy
+ *
+ * Additional information on tiering policy with ONTAP Volumes can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html).
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const test = new aws.fsx.OntapVolume("test", {
+ *     junctionPath: "/test",
+ *     sizeInMegabytes: 1024,
+ *     storageEfficiencyEnabled: true,
+ *     storageVirtualMachineId: aws_fsx_ontap_storage_virtual_machine.test.id,
+ *     tieringPolicy: {
+ *         name: "AUTO",
+ *         coolingPeriod: 31,
+ *     },
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * FSx ONTAP volume can be imported using the `id`, e.g.,
+ *
+ * ```sh
+ *  $ pulumi import aws:fsx/ontapVolume:OntapVolume example fsvol-12345678abcdef123
+ * ```
+ */
+export class OntapVolume extends pulumi.CustomResource {
+    /**
+     * Get an existing OntapVolume resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: OntapVolumeState, opts?: pulumi.CustomResourceOptions): OntapVolume {
+        return new OntapVolume(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'aws:fsx/ontapVolume:OntapVolume';
+
+    /**
+     * Returns true if the given object is an instance of OntapVolume.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is OntapVolume {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === OntapVolume.__pulumiType;
+    }
+
+    /**
+     * Amazon Resource Name of the volune.
+     */
+    public /*out*/ readonly arn!: pulumi.Output<string>;
+    /**
+     * Describes the file system for the volume, e.g. `fs-12345679`
+     */
+    public /*out*/ readonly fileSystemId!: pulumi.Output<string>;
+    /**
+     * Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+     */
+    public /*out*/ readonly flexcacheEndpointType!: pulumi.Output<string>;
+    /**
+     * Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junctionPath must have a leading forward slash, such as `/vol3`
+     */
+    public readonly junctionPath!: pulumi.Output<string>;
+    /**
+     * Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+     */
+    public readonly name!: pulumi.Output<string>;
+    /**
+     * Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+     */
+    public /*out*/ readonly ontapVolumeType!: pulumi.Output<string>;
+    /**
+     * Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+     */
+    public readonly securityStyle!: pulumi.Output<string | undefined>;
+    /**
+     * Specifies the size of the volume, in megabytes (MB), that you are creating.
+     */
+    public readonly sizeInMegabytes!: pulumi.Output<number>;
+    /**
+     * Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+     */
+    public readonly storageEfficiencyEnabled!: pulumi.Output<boolean>;
+    /**
+     * Specifies the storage virtual machine in which to create the volume.
+     */
+    public readonly storageVirtualMachineId!: pulumi.Output<string>;
+    /**
+     * A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+     */
+    public readonly tags!: pulumi.Output<{[key: string]: string} | undefined>;
+    /**
+     * A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+     */
+    public readonly tagsAll!: pulumi.Output<{[key: string]: string}>;
+    public readonly tieringPolicy!: pulumi.Output<outputs.fsx.OntapVolumeTieringPolicy | undefined>;
+    /**
+     * The Volume's UUID (universally unique identifier).
+     */
+    public /*out*/ readonly uuid!: pulumi.Output<string>;
+    /**
+     * The type of volume, currently the only valid value is `ONTAP`.
+     */
+    public readonly volumeType!: pulumi.Output<string | undefined>;
+
+    /**
+     * Create a OntapVolume resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: OntapVolumeArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: OntapVolumeArgs | OntapVolumeState, opts?: pulumi.CustomResourceOptions) {
+        let inputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as OntapVolumeState | undefined;
+            inputs["arn"] = state ? state.arn : undefined;
+            inputs["fileSystemId"] = state ? state.fileSystemId : undefined;
+            inputs["flexcacheEndpointType"] = state ? state.flexcacheEndpointType : undefined;
+            inputs["junctionPath"] = state ? state.junctionPath : undefined;
+            inputs["name"] = state ? state.name : undefined;
+            inputs["ontapVolumeType"] = state ? state.ontapVolumeType : undefined;
+            inputs["securityStyle"] = state ? state.securityStyle : undefined;
+            inputs["sizeInMegabytes"] = state ? state.sizeInMegabytes : undefined;
+            inputs["storageEfficiencyEnabled"] = state ? state.storageEfficiencyEnabled : undefined;
+            inputs["storageVirtualMachineId"] = state ? state.storageVirtualMachineId : undefined;
+            inputs["tags"] = state ? state.tags : undefined;
+            inputs["tagsAll"] = state ? state.tagsAll : undefined;
+            inputs["tieringPolicy"] = state ? state.tieringPolicy : undefined;
+            inputs["uuid"] = state ? state.uuid : undefined;
+            inputs["volumeType"] = state ? state.volumeType : undefined;
+        } else {
+            const args = argsOrState as OntapVolumeArgs | undefined;
+            if ((!args || args.junctionPath === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'junctionPath'");
+            }
+            if ((!args || args.sizeInMegabytes === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'sizeInMegabytes'");
+            }
+            if ((!args || args.storageEfficiencyEnabled === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'storageEfficiencyEnabled'");
+            }
+            if ((!args || args.storageVirtualMachineId === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'storageVirtualMachineId'");
+            }
+            inputs["junctionPath"] = args ? args.junctionPath : undefined;
+            inputs["name"] = args ? args.name : undefined;
+            inputs["securityStyle"] = args ? args.securityStyle : undefined;
+            inputs["sizeInMegabytes"] = args ? args.sizeInMegabytes : undefined;
+            inputs["storageEfficiencyEnabled"] = args ? args.storageEfficiencyEnabled : undefined;
+            inputs["storageVirtualMachineId"] = args ? args.storageVirtualMachineId : undefined;
+            inputs["tags"] = args ? args.tags : undefined;
+            inputs["tagsAll"] = args ? args.tagsAll : undefined;
+            inputs["tieringPolicy"] = args ? args.tieringPolicy : undefined;
+            inputs["volumeType"] = args ? args.volumeType : undefined;
+            inputs["arn"] = undefined /*out*/;
+            inputs["fileSystemId"] = undefined /*out*/;
+            inputs["flexcacheEndpointType"] = undefined /*out*/;
+            inputs["ontapVolumeType"] = undefined /*out*/;
+            inputs["uuid"] = undefined /*out*/;
+        }
+        if (!opts.version) {
+            opts = pulumi.mergeOptions(opts, { version: utilities.getVersion()});
+        }
+        super(OntapVolume.__pulumiType, name, inputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering OntapVolume resources.
+ */
+export interface OntapVolumeState {
+    /**
+     * Amazon Resource Name of the volune.
+     */
+    arn?: pulumi.Input<string>;
+    /**
+     * Describes the file system for the volume, e.g. `fs-12345679`
+     */
+    fileSystemId?: pulumi.Input<string>;
+    /**
+     * Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+     */
+    flexcacheEndpointType?: pulumi.Input<string>;
+    /**
+     * Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junctionPath must have a leading forward slash, such as `/vol3`
+     */
+    junctionPath?: pulumi.Input<string>;
+    /**
+     * Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+     */
+    ontapVolumeType?: pulumi.Input<string>;
+    /**
+     * Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+     */
+    securityStyle?: pulumi.Input<string>;
+    /**
+     * Specifies the size of the volume, in megabytes (MB), that you are creating.
+     */
+    sizeInMegabytes?: pulumi.Input<number>;
+    /**
+     * Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+     */
+    storageEfficiencyEnabled?: pulumi.Input<boolean>;
+    /**
+     * Specifies the storage virtual machine in which to create the volume.
+     */
+    storageVirtualMachineId?: pulumi.Input<string>;
+    /**
+     * A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+     */
+    tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
+    /**
+     * A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+     */
+    tagsAll?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
+    tieringPolicy?: pulumi.Input<inputs.fsx.OntapVolumeTieringPolicy>;
+    /**
+     * The Volume's UUID (universally unique identifier).
+     */
+    uuid?: pulumi.Input<string>;
+    /**
+     * The type of volume, currently the only valid value is `ONTAP`.
+     */
+    volumeType?: pulumi.Input<string>;
+}
+
+/**
+ * The set of arguments for constructing a OntapVolume resource.
+ */
+export interface OntapVolumeArgs {
+    /**
+     * Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junctionPath must have a leading forward slash, such as `/vol3`
+     */
+    junctionPath: pulumi.Input<string>;
+    /**
+     * Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+     */
+    securityStyle?: pulumi.Input<string>;
+    /**
+     * Specifies the size of the volume, in megabytes (MB), that you are creating.
+     */
+    sizeInMegabytes: pulumi.Input<number>;
+    /**
+     * Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+     */
+    storageEfficiencyEnabled: pulumi.Input<boolean>;
+    /**
+     * Specifies the storage virtual machine in which to create the volume.
+     */
+    storageVirtualMachineId: pulumi.Input<string>;
+    /**
+     * A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+     */
+    tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
+    /**
+     * A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+     */
+    tagsAll?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
+    tieringPolicy?: pulumi.Input<inputs.fsx.OntapVolumeTieringPolicy>;
+    /**
+     * The type of volume, currently the only valid value is `ONTAP`.
+     */
+    volumeType?: pulumi.Input<string>;
+}
diff --git a/sdk/nodejs/imagebuilder/getImageRecipes.ts b/sdk/nodejs/imagebuilder/getImageRecipes.ts
new file mode 100644
index 00000000000..20b61e8a010
--- /dev/null
+++ b/sdk/nodejs/imagebuilder/getImageRecipes.ts
@@ -0,0 +1,91 @@
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import { input as inputs, output as outputs, enums } from "../types";
+import * as utilities from "../utilities";
+
+/**
+ * Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = pulumi.output(aws.imagebuilder.getImageRecipes({
+ *     filters: [{
+ *         name: "platform",
+ *         values: ["Linux"],
+ *     }],
+ *     owner: "Self",
+ * }));
+ * ```
+ */
+export function getImageRecipes(args?: GetImageRecipesArgs, opts?: pulumi.InvokeOptions): Promise<GetImageRecipesResult> {
+    args = args || {};
+    if (!opts) {
+        opts = {}
+    }
+
+    if (!opts.version) {
+        opts.version = utilities.getVersion();
+    }
+    return pulumi.runtime.invoke("aws:imagebuilder/getImageRecipes:getImageRecipes", {
+        "filters": args.filters,
+        "owner": args.owner,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getImageRecipes.
+ */
+export interface GetImageRecipesArgs {
+    /**
+     * Configuration block(s) for filtering. Detailed below.
+     */
+    filters?: inputs.imagebuilder.GetImageRecipesFilter[];
+    /**
+     * The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+     */
+    owner?: string;
+}
+
+/**
+ * A collection of values returned by getImageRecipes.
+ */
+export interface GetImageRecipesResult {
+    /**
+     * Set of ARNs of the matched Image Builder Image Recipes.
+     */
+    readonly arns: string[];
+    readonly filters?: outputs.imagebuilder.GetImageRecipesFilter[];
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    /**
+     * Set of names of the matched Image Builder Image Recipes.
+     */
+    readonly names: string[];
+    readonly owner?: string;
+}
+
+export function getImageRecipesOutput(args?: GetImageRecipesOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetImageRecipesResult> {
+    return pulumi.output(args).apply(a => getImageRecipes(a, opts))
+}
+
+/**
+ * A collection of arguments for invoking getImageRecipes.
+ */
+export interface GetImageRecipesOutputArgs {
+    /**
+     * Configuration block(s) for filtering. Detailed below.
+     */
+    filters?: pulumi.Input<pulumi.Input<inputs.imagebuilder.GetImageRecipesFilterArgs>[]>;
+    /**
+     * The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+     */
+    owner?: pulumi.Input<string>;
+}
diff --git a/sdk/nodejs/imagebuilder/index.ts b/sdk/nodejs/imagebuilder/index.ts
index 1caf92d2467..d0b627c8dc2 100644
--- a/sdk/nodejs/imagebuilder/index.ts
+++ b/sdk/nodejs/imagebuilder/index.ts
@@ -12,6 +12,7 @@ export * from "./getDistributionConfiguration";
 export * from "./getImage";
 export * from "./getImagePipeline";
 export * from "./getImageRecipe";
+export * from "./getImageRecipes";
 export * from "./getInfrastructureConfiguration";
 export * from "./image";
 export * from "./imagePipeline";
diff --git a/sdk/nodejs/index.ts b/sdk/nodejs/index.ts
index b77caab92f7..e62ce4187c9 100644
--- a/sdk/nodejs/index.ts
+++ b/sdk/nodejs/index.ts
@@ -33,6 +33,7 @@ export * from "./types/enums";
 
 // Export sub-modules:
 import * as accessanalyzer from "./accessanalyzer";
+import * as account from "./account";
 import * as acm from "./acm";
 import * as acmpca from "./acmpca";
 import * as alb from "./alb";
@@ -182,6 +183,7 @@ import * as xray from "./xray";
 
 export {
     accessanalyzer,
+    account,
     acm,
     acmpca,
     alb,
diff --git a/sdk/nodejs/lambda/getFunction.ts b/sdk/nodejs/lambda/getFunction.ts
index 971c4a7396a..4c0e2ca7c7e 100644
--- a/sdk/nodejs/lambda/getFunction.ts
+++ b/sdk/nodejs/lambda/getFunction.ts
@@ -92,6 +92,10 @@ export interface GetFunctionResult {
      * The provider-assigned unique ID for this managed resource.
      */
     readonly id: string;
+    /**
+     * The URI of the container image.
+     */
+    readonly imageUri: string;
     /**
      * The ARN to be used for invoking Lambda Function from API Gateway.
      */
diff --git a/sdk/nodejs/lb/getLoadBalancer.ts b/sdk/nodejs/lb/getLoadBalancer.ts
index c4094add51f..16140787b3a 100644
--- a/sdk/nodejs/lb/getLoadBalancer.ts
+++ b/sdk/nodejs/lb/getLoadBalancer.ts
@@ -71,10 +71,12 @@ export interface GetLoadBalancerResult {
     readonly arn: string;
     readonly arnSuffix: string;
     readonly customerOwnedIpv4Pool: string;
+    readonly desyncMitigationMode: string;
     readonly dnsName: string;
     readonly dropInvalidHeaderFields: boolean;
     readonly enableDeletionProtection: boolean;
     readonly enableHttp2: boolean;
+    readonly enableWafFailOpen: boolean;
     /**
      * The provider-assigned unique ID for this managed resource.
      */
diff --git a/sdk/nodejs/lb/loadBalancer.ts b/sdk/nodejs/lb/loadBalancer.ts
index 9e0c8d6e9ca..db2f68a3697 100644
--- a/sdk/nodejs/lb/loadBalancer.ts
+++ b/sdk/nodejs/lb/loadBalancer.ts
@@ -142,6 +142,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     public readonly customerOwnedIpv4Pool!: pulumi.Output<string | undefined>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    public readonly desyncMitigationMode!: pulumi.Output<string | undefined>;
     /**
      * The DNS name of the load balancer.
      */
@@ -164,6 +168,10 @@ export class LoadBalancer extends pulumi.CustomResource {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     public readonly enableHttp2!: pulumi.Output<boolean | undefined>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    public readonly enableWafFailOpen!: pulumi.Output<boolean | undefined>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -205,7 +213,7 @@ export class LoadBalancer extends pulumi.CustomResource {
      */
     public readonly subnets!: pulumi.Output<string[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     public readonly tags!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
@@ -236,11 +244,13 @@ export class LoadBalancer extends pulumi.CustomResource {
             inputs["arn"] = state ? state.arn : undefined;
             inputs["arnSuffix"] = state ? state.arnSuffix : undefined;
             inputs["customerOwnedIpv4Pool"] = state ? state.customerOwnedIpv4Pool : undefined;
+            inputs["desyncMitigationMode"] = state ? state.desyncMitigationMode : undefined;
             inputs["dnsName"] = state ? state.dnsName : undefined;
             inputs["dropInvalidHeaderFields"] = state ? state.dropInvalidHeaderFields : undefined;
             inputs["enableCrossZoneLoadBalancing"] = state ? state.enableCrossZoneLoadBalancing : undefined;
             inputs["enableDeletionProtection"] = state ? state.enableDeletionProtection : undefined;
             inputs["enableHttp2"] = state ? state.enableHttp2 : undefined;
+            inputs["enableWafFailOpen"] = state ? state.enableWafFailOpen : undefined;
             inputs["idleTimeout"] = state ? state.idleTimeout : undefined;
             inputs["internal"] = state ? state.internal : undefined;
             inputs["ipAddressType"] = state ? state.ipAddressType : undefined;
@@ -258,10 +268,12 @@ export class LoadBalancer extends pulumi.CustomResource {
             const args = argsOrState as LoadBalancerArgs | undefined;
             inputs["accessLogs"] = args ? args.accessLogs : undefined;
             inputs["customerOwnedIpv4Pool"] = args ? args.customerOwnedIpv4Pool : undefined;
+            inputs["desyncMitigationMode"] = args ? args.desyncMitigationMode : undefined;
             inputs["dropInvalidHeaderFields"] = args ? args.dropInvalidHeaderFields : undefined;
             inputs["enableCrossZoneLoadBalancing"] = args ? args.enableCrossZoneLoadBalancing : undefined;
             inputs["enableDeletionProtection"] = args ? args.enableDeletionProtection : undefined;
             inputs["enableHttp2"] = args ? args.enableHttp2 : undefined;
+            inputs["enableWafFailOpen"] = args ? args.enableWafFailOpen : undefined;
             inputs["idleTimeout"] = args ? args.idleTimeout : undefined;
             inputs["internal"] = args ? args.internal : undefined;
             inputs["ipAddressType"] = args ? args.ipAddressType : undefined;
@@ -308,6 +320,10 @@ export interface LoadBalancerState {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     customerOwnedIpv4Pool?: pulumi.Input<string>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * The DNS name of the load balancer.
      */
@@ -330,6 +346,10 @@ export interface LoadBalancerState {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     enableHttp2?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    enableWafFailOpen?: pulumi.Input<boolean>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -371,7 +391,7 @@ export interface LoadBalancerState {
      */
     subnets?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
@@ -398,6 +418,10 @@ export interface LoadBalancerArgs {
      * The ID of the customer owned ipv4 pool to use for this load balancer.
      */
     customerOwnedIpv4Pool?: pulumi.Input<string>;
+    /**
+     * Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+     */
+    desyncMitigationMode?: pulumi.Input<string>;
     /**
      * Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
      */
@@ -416,6 +440,10 @@ export interface LoadBalancerArgs {
      * Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
      */
     enableHttp2?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+     */
+    enableWafFailOpen?: pulumi.Input<boolean>;
     /**
      * The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
      */
@@ -457,7 +485,7 @@ export interface LoadBalancerArgs {
      */
     subnets?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * A map of tags to assign to the resource. .If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+     * A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      */
     tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
 }
diff --git a/sdk/nodejs/quicksight/user.ts b/sdk/nodejs/quicksight/user.ts
index f5beb181b7d..f1745367d91 100644
--- a/sdk/nodejs/quicksight/user.ts
+++ b/sdk/nodejs/quicksight/user.ts
@@ -78,11 +78,11 @@ export class User extends pulumi.CustomResource {
      */
     public readonly namespace!: pulumi.Output<string | undefined>;
     /**
-     * The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+     * The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
      */
     public readonly sessionName!: pulumi.Output<string | undefined>;
     /**
-     * The Amazon QuickSight user name that you want to create for the user you are registering.
+     * The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `QUICKSIGHT`.
      */
     public readonly userName!: pulumi.Output<string | undefined>;
     /**
@@ -169,11 +169,11 @@ export interface UserState {
      */
     namespace?: pulumi.Input<string>;
     /**
-     * The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+     * The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
      */
     sessionName?: pulumi.Input<string>;
     /**
-     * The Amazon QuickSight user name that you want to create for the user you are registering.
+     * The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `QUICKSIGHT`.
      */
     userName?: pulumi.Input<string>;
     /**
@@ -207,11 +207,11 @@ export interface UserArgs {
      */
     namespace?: pulumi.Input<string>;
     /**
-     * The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+     * The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
      */
     sessionName?: pulumi.Input<string>;
     /**
-     * The Amazon QuickSight user name that you want to create for the user you are registering.
+     * The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `QUICKSIGHT`.
      */
     userName?: pulumi.Input<string>;
     /**
diff --git a/sdk/nodejs/tsconfig.json b/sdk/nodejs/tsconfig.json
index e7181a060d2..5c82e6859ed 100644
--- a/sdk/nodejs/tsconfig.json
+++ b/sdk/nodejs/tsconfig.json
@@ -15,6 +15,8 @@
     "files": [
         "accessanalyzer/analyzer.ts",
         "accessanalyzer/index.ts",
+        "account/alternativeContact.ts",
+        "account/index.ts",
         "acm/certificate.ts",
         "acm/certificateValidation.ts",
         "acm/getCertificate.ts",
@@ -132,9 +134,12 @@
         "apprunner/service.ts",
         "appstream/directoryConfig.ts",
         "appstream/fleet.ts",
+        "appstream/fleetStackAssociation.ts",
         "appstream/imageBuilder.ts",
         "appstream/index.ts",
         "appstream/stack.ts",
+        "appstream/user.ts",
+        "appstream/userStackAssociation.ts",
         "appsync/apiKey.ts",
         "appsync/dataSource.ts",
         "appsync/function.ts",
@@ -434,6 +439,7 @@
         "ec2/getInstanceType.ts",
         "ec2/getInstanceTypeOffering.ts",
         "ec2/getInstanceTypeOfferings.ts",
+        "ec2/getInstanceTypes.ts",
         "ec2/getInstances.ts",
         "ec2/getInternetGateway.ts",
         "ec2/getKeyPair.ts",
@@ -672,6 +678,8 @@
         "fsx/index.ts",
         "fsx/lustreFileSystem.ts",
         "fsx/ontapFileSystem.ts",
+        "fsx/ontapStorageVirtualMachine.ts",
+        "fsx/ontapVolume.ts",
         "fsx/windowsFileSystem.ts",
         "gamelift/alias.ts",
         "gamelift/build.ts",
@@ -784,6 +792,7 @@
         "imagebuilder/getImage.ts",
         "imagebuilder/getImagePipeline.ts",
         "imagebuilder/getImageRecipe.ts",
+        "imagebuilder/getImageRecipes.ts",
         "imagebuilder/getInfrastructureConfiguration.ts",
         "imagebuilder/image.ts",
         "imagebuilder/imagePipeline.ts",
diff --git a/sdk/nodejs/types/input.ts b/sdk/nodejs/types/input.ts
index 6127b8d385e..dd093dfae02 100644
--- a/sdk/nodejs/types/input.ts
+++ b/sdk/nodejs/types/input.ts
@@ -169,6 +169,7 @@ export interface ProviderDefaultTags {
 
 export interface ProviderEndpoint {
     accessanalyzer?: pulumi.Input<string>;
+    account?: pulumi.Input<string>;
     acm?: pulumi.Input<string>;
     acmpca?: pulumi.Input<string>;
     alexaforbusiness?: pulumi.Input<string>;
@@ -4318,7 +4319,7 @@ export namespace apprunner {
         /**
          * The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
          */
-        instanceRoleArn: pulumi.Input<string>;
+        instanceRoleArn?: pulumi.Input<string>;
         /**
          * The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
          */
@@ -4753,6 +4754,10 @@ export namespace athena {
          * Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
          */
         enforceWorkgroupConfiguration?: pulumi.Input<boolean>;
+        /**
+         * Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+         */
+        engineVersion?: pulumi.Input<inputs.athena.WorkgroupConfigurationEngineVersion>;
         /**
          * Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
          */
@@ -4767,6 +4772,17 @@ export namespace athena {
         resultConfiguration?: pulumi.Input<inputs.athena.WorkgroupConfigurationResultConfiguration>;
     }
 
+    export interface WorkgroupConfigurationEngineVersion {
+        /**
+         * The engine version on which the query runs. If `selectedEngineVersion` is set to `AUTO`, the effective engine version is chosen by Athena.
+         */
+        effectiveEngineVersion?: pulumi.Input<string>;
+        /**
+         * The requested engine version. Defaults to `AUTO`.
+         */
+        selectedEngineVersion?: pulumi.Input<string>;
+    }
+
     export interface WorkgroupConfigurationResultConfiguration {
         /**
          * Configuration block with encryption settings. Documented below.
@@ -5833,17 +5849,35 @@ export namespace cfg {
         resourceTypes?: pulumi.Input<pulumi.Input<string>[]>;
     }
 
+    export interface RemediationConfigurationExecutionControls {
+        /**
+         * Configuration block for SSM controls. See below.
+         */
+        ssmControls?: pulumi.Input<inputs.cfg.RemediationConfigurationExecutionControlsSsmControls>;
+    }
+
+    export interface RemediationConfigurationExecutionControlsSsmControls {
+        /**
+         * Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+         */
+        concurrentExecutionRatePercentage?: pulumi.Input<number>;
+        /**
+         * Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+         */
+        errorPercentage?: pulumi.Input<number>;
+    }
+
     export interface RemediationConfigurationParameter {
         /**
-         * The name of the attribute.
+         * Name of the attribute.
          */
         name: pulumi.Input<string>;
         /**
-         * The value is dynamic and changes at run-time.
+         * Value is dynamic and changes at run-time.
          */
         resourceValue?: pulumi.Input<string>;
         /**
-         * The value is static and does not change at run-time.
+         * Value is static and does not change at run-time.
          */
         staticValue?: pulumi.Input<string>;
     }
@@ -7055,7 +7089,11 @@ export namespace cloudtrail {
          */
         dataResources?: pulumi.Input<pulumi.Input<inputs.cloudtrail.TrailEventSelectorDataResource>[]>;
         /**
-         * Whether to include management events for your trail.
+         * A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `includeManagementEvents` must be set to`true` to allow this.
+         */
+        excludeManagementEventSources?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Whether to include management events for your trail. Defaults to `true`.
          */
         includeManagementEvents?: pulumi.Input<boolean>;
         /**
@@ -9138,19 +9176,23 @@ export namespace dlm {
 
     export interface LifecyclePolicyPolicyDetailsSchedule {
         /**
-         * Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+         * Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
          */
         copyTags?: pulumi.Input<boolean>;
         /**
          * See the `createRule` block. Max of 1 per schedule.
          */
         createRule: pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleCreateRule>;
+        /**
+         * See the `crossRegionCopyRule` block. Max of 3 per schedule.
+         */
+        crossRegionCopyRules?: pulumi.Input<pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule>[]>;
         /**
          * A name for the schedule.
          */
         name: pulumi.Input<string>;
         /**
-         * See the `retainRule` block. Max of 1 per schedule.
+         * The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
          */
         retainRule: pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleRetainRule>;
         /**
@@ -9161,11 +9203,11 @@ export namespace dlm {
 
     export interface LifecyclePolicyPolicyDetailsScheduleCreateRule {
         /**
-         * How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
          */
         interval: pulumi.Input<number>;
         /**
-         * The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
          */
         intervalUnit?: pulumi.Input<string>;
         /**
@@ -9174,6 +9216,55 @@ export namespace dlm {
         times?: pulumi.Input<string>;
     }
 
+    export interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule {
+        /**
+         * The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+         */
+        cmkArn?: pulumi.Input<string>;
+        /**
+         * Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+         */
+        copyTags?: pulumi.Input<boolean>;
+        /**
+         * The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecateRule` block.
+         */
+        deprecateRule?: pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule>;
+        /**
+         * To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+         */
+        encrypted: pulumi.Input<boolean>;
+        /**
+         * The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
+         */
+        retainRule?: pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule>;
+        /**
+         * The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+         */
+        target: pulumi.Input<string>;
+    }
+
+    export interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule {
+        /**
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+         */
+        interval: pulumi.Input<number>;
+        /**
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+         */
+        intervalUnit: pulumi.Input<string>;
+    }
+
+    export interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule {
+        /**
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+         */
+        interval: pulumi.Input<number>;
+        /**
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+         */
+        intervalUnit: pulumi.Input<string>;
+    }
+
     export interface LifecyclePolicyPolicyDetailsScheduleRetainRule {
         /**
          * How many snapshots to keep. Must be an integer between 1 and 1000.
@@ -10183,26 +10274,13 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetAmiIdsFilterArgs {
-        name: pulumi.Input<string>;
-        values: pulumi.Input<pulumi.Input<string>[]>;
-    }
-
     export interface GetAmiIdsFilter {
         name: string;
         values: string[];
     }
 
-    export interface GetCoipPoolFilterArgs {
-        /**
-         * The name of the field to filter by, as defined by
-         * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCoipPools.html).
-         */
+    export interface GetAmiIdsFilterArgs {
         name: pulumi.Input<string>;
-        /**
-         * Set of values that are accepted for the given field.
-         * A COIP Pool will be selected if any one of the given values matches.
-         */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
@@ -10219,7 +10297,7 @@ export namespace ec2 {
         values: string[];
     }
 
-    export interface GetCoipPoolsFilterArgs {
+    export interface GetCoipPoolFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCoipPools.html).
@@ -10245,6 +10323,19 @@ export namespace ec2 {
         values: string[];
     }
 
+    export interface GetCoipPoolsFilterArgs {
+        /**
+         * The name of the field to filter by, as defined by
+         * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCoipPools.html).
+         */
+        name: pulumi.Input<string>;
+        /**
+         * Set of values that are accepted for the given field.
+         * A COIP Pool will be selected if any one of the given values matches.
+         */
+        values: pulumi.Input<pulumi.Input<string>[]>;
+    }
+
     export interface GetCustomerGatewayFilter {
         name: string;
         values: string[];
@@ -10287,24 +10378,14 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetInstanceFilter {
-        name: string;
-        values: string[];
-    }
-
     export interface GetInstanceFilterArgs {
         name: pulumi.Input<string>;
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetInstanceTypeFpga {
-        count?: number;
-        manufacturer?: string;
-        /**
-         * Size of the instance memory, in MiB.
-         */
-        memorySize?: number;
-        name?: string;
+    export interface GetInstanceFilter {
+        name: string;
+        values: string[];
     }
 
     export interface GetInstanceTypeFpgaArgs {
@@ -10317,7 +10398,7 @@ export namespace ec2 {
         name?: pulumi.Input<string>;
     }
 
-    export interface GetInstanceTypeGpus {
+    export interface GetInstanceTypeFpga {
         count?: number;
         manufacturer?: string;
         /**
@@ -10337,10 +10418,14 @@ export namespace ec2 {
         name?: pulumi.Input<string>;
     }
 
-    export interface GetInstanceTypeInferenceAcceleratorArgs {
-        count?: pulumi.Input<number>;
-        manufacturer?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
+    export interface GetInstanceTypeGpus {
+        count?: number;
+        manufacturer?: string;
+        /**
+         * Size of the instance memory, in MiB.
+         */
+        memorySize?: number;
+        name?: string;
     }
 
     export interface GetInstanceTypeInferenceAccelerator {
@@ -10349,10 +10434,10 @@ export namespace ec2 {
         name?: string;
     }
 
-    export interface GetInstanceTypeInstanceDisk {
-        count?: number;
-        size?: number;
-        type?: string;
+    export interface GetInstanceTypeInferenceAcceleratorArgs {
+        count?: pulumi.Input<number>;
+        manufacturer?: pulumi.Input<string>;
+        name?: pulumi.Input<string>;
     }
 
     export interface GetInstanceTypeInstanceDiskArgs {
@@ -10361,6 +10446,12 @@ export namespace ec2 {
         type?: pulumi.Input<string>;
     }
 
+    export interface GetInstanceTypeInstanceDisk {
+        count?: number;
+        size?: number;
+        type?: string;
+    }
+
     export interface GetInstanceTypeOfferingFilter {
         /**
          * Name of the filter. The `location` filter depends on the top-level `locationType` argument and if not specified, defaults to the current region.
@@ -10405,8 +10496,25 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetInstancesFilter {
+    export interface GetInstanceTypesFilterArgs {
+        /**
+         * Name of the filter.
+         */
+        name: pulumi.Input<string>;
+        /**
+         * List of one or more values for the filter.
+         */
+        values: pulumi.Input<pulumi.Input<string>[]>;
+    }
+
+    export interface GetInstanceTypesFilter {
+        /**
+         * Name of the filter.
+         */
         name: string;
+        /**
+         * List of one or more values for the filter.
+         */
         values: string[];
     }
 
@@ -10415,6 +10523,11 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
+    export interface GetInstancesFilter {
+        name: string;
+        values: string[];
+    }
+
     export interface GetInternetGatewayFilter {
         /**
          * The name of the field to filter by, as defined by
@@ -10463,26 +10576,26 @@ export namespace ec2 {
         values: string[];
     }
 
-    export interface GetLaunchTemplateFilterArgs {
+    export interface GetLaunchTemplateFilter {
         /**
          * The name of the filter field. Valid values can be found in the [EC2 DescribeLaunchTemplates API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplates.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
-    export interface GetLaunchTemplateFilter {
+    export interface GetLaunchTemplateFilterArgs {
         /**
          * The name of the filter field. Valid values can be found in the [EC2 DescribeLaunchTemplates API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplates.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
     export interface GetLocalGatewayFilter {
@@ -10537,30 +10650,30 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetLocalGatewayRouteTablesFilterArgs {
+    export interface GetLocalGatewayRouteTablesFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTables.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A Local Gateway Route Table will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
-    export interface GetLocalGatewayRouteTablesFilter {
+    export interface GetLocalGatewayRouteTablesFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTables.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A Local Gateway Route Table will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
     export interface GetLocalGatewayVirtualInterfaceFilterArgs {
@@ -10629,30 +10742,30 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetLocalGatewaysFilter {
+    export interface GetLocalGatewaysFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGateways.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A Local Gateway will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetLocalGatewaysFilterArgs {
+    export interface GetLocalGatewaysFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGateways.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A Local Gateway will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
     export interface GetManagedPrefixListFilter {
@@ -10677,30 +10790,30 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetNatGatewayFilterArgs {
+    export interface GetNatGatewayFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * An Nat Gateway will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
-    export interface GetNatGatewayFilter {
+    export interface GetNatGatewayFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * An Nat Gateway will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
     export interface GetNetworkAclsFilter {
@@ -10763,48 +10876,48 @@ export namespace ec2 {
         values: string[];
     }
 
-    export interface GetPrefixListFilterArgs {
+    export interface GetPrefixListFilter {
         /**
          * The name of the filter field. Valid values can be found in the [EC2 DescribePrefixLists API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrefixLists.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
-    export interface GetPrefixListFilter {
+    export interface GetPrefixListFilterArgs {
         /**
          * The name of the filter field. Valid values can be found in the [EC2 DescribePrefixLists API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrefixLists.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetRouteTableFilterArgs {
+    export interface GetRouteTableFilter {
         /**
          * Name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field. A Route Table will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
-    export interface GetRouteTableFilter {
+    export interface GetRouteTableFilterArgs {
         /**
          * Name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field. A Route Table will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
     export interface GetRouteTablesFilter {
@@ -10859,24 +10972,13 @@ export namespace ec2 {
         values: string[];
     }
 
-    export interface GetSecurityGroupsFilter {
-        name: string;
-        values: string[];
-    }
-
     export interface GetSecurityGroupsFilterArgs {
         name: pulumi.Input<string>;
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetSpotPriceFilter {
-        /**
-         * Name of the filter.
-         */
+    export interface GetSecurityGroupsFilter {
         name: string;
-        /**
-         * List of one or more values for the filter.
-         */
         values: string[];
     }
 
@@ -10891,13 +10993,13 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetSubnetFilter {
+    export interface GetSpotPriceFilter {
         /**
-         * The name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
+         * Name of the filter.
          */
         name: string;
         /**
-         * Set of values that are accepted for the given field. A subnet will be selected if any one of the given values matches.
+         * List of one or more values for the filter.
          */
         values: string[];
     }
@@ -10913,18 +11015,15 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetSubnetIdsFilterArgs {
+    export interface GetSubnetFilter {
         /**
-         * The name of the field to filter by, as defined by
-         * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
-         * For example, if matching against tag `Name`, use:
+         * The name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
-         * Set of values that are accepted for the given field.
-         * Subnet IDs will be selected if any one of the given values match.
+         * Set of values that are accepted for the given field. A subnet will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
     export interface GetSubnetIdsFilter {
@@ -10941,18 +11040,18 @@ export namespace ec2 {
         values: string[];
     }
 
-    export interface GetSubnetsFilter {
+    export interface GetSubnetIdsFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
          * For example, if matching against tag `Name`, use:
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * Subnet IDs will be selected if any one of the given values match.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
     export interface GetSubnetsFilterArgs {
@@ -10969,6 +11068,20 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
+    export interface GetSubnetsFilter {
+        /**
+         * The name of the field to filter by, as defined by
+         * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
+         * For example, if matching against tag `Name`, use:
+         */
+        name: string;
+        /**
+         * Set of values that are accepted for the given field.
+         * Subnet IDs will be selected if any one of the given values match.
+         */
+        values: string[];
+    }
+
     export interface GetTransitGatewayRouteTablesFilter {
         /**
          * The name of the field to filter by, as defined by
@@ -10995,26 +11108,26 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetVpcDhcpOptionsFilter {
+    export interface GetVpcDhcpOptionsFilterArgs {
         /**
          * The name of the field to filter.
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values for filtering.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetVpcDhcpOptionsFilterArgs {
+    export interface GetVpcDhcpOptionsFilter {
         /**
          * The name of the field to filter.
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values for filtering.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
     export interface GetVpcEndpointFilter {
@@ -11065,108 +11178,108 @@ export namespace ec2 {
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetVpcFilterArgs {
+    export interface GetVpcFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A VPC will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
-    export interface GetVpcFilter {
+    export interface GetVpcFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A VPC will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetVpcPeeringConnectionFilter {
+    export interface GetVpcPeeringConnectionFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A VPC Peering Connection will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetVpcPeeringConnectionFilterArgs {
+    export interface GetVpcPeeringConnectionFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A VPC Peering Connection will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
-    export interface GetVpcPeeringConnectionsFilterArgs {
+    export interface GetVpcPeeringConnectionsFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A VPC Peering Connection will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
-    export interface GetVpcPeeringConnectionsFilter {
+    export interface GetVpcPeeringConnectionsFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A VPC Peering Connection will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetVpcsFilter {
+    export interface GetVpcsFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A VPC will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
 
-    export interface GetVpcsFilterArgs {
+    export interface GetVpcsFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A VPC will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
 
     export interface GetVpnGatewayFilter {
@@ -12461,6 +12574,7 @@ export namespace ec2 {
         status?: pulumi.Input<string>;
         statusMessage?: pulumi.Input<string>;
     }
+
 }
 
 export namespace ec2clientvpn {
@@ -15384,6 +15498,109 @@ export namespace fsx {
         ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
     }
 
+    export interface OntapStorageVirtualMachineActiveDirectoryConfiguration {
+        /**
+         * The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+         */
+        netbiosName?: pulumi.Input<string>;
+        selfManagedActiveDirectoryConfiguration?: pulumi.Input<inputs.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration>;
+    }
+
+    export interface OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration {
+        /**
+         * A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+         */
+        dnsIps: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+         */
+        domainName: pulumi.Input<string>;
+        /**
+         * The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+         */
+        fileSystemAdministratorsGroup?: pulumi.Input<string>;
+        organizationalUnitDistinguidshedName?: pulumi.Input<string>;
+        /**
+         * The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+         */
+        password: pulumi.Input<string>;
+        /**
+         * The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+         */
+        username: pulumi.Input<string>;
+    }
+
+    export interface OntapStorageVirtualMachineEndpoint {
+        /**
+         * An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+         */
+        iscses?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpointIscse>[]>;
+        /**
+         * An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+         */
+        managements?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpointManagement>[]>;
+        /**
+         * An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+         */
+        nfs?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpointNf>[]>;
+        /**
+         * An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an activeDirectoryConfiguration has been set. See Endpoint.
+         */
+        smbs?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpointSmb>[]>;
+    }
+
+    export interface OntapStorageVirtualMachineEndpointIscse {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName?: pulumi.Input<string>;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+
+    export interface OntapStorageVirtualMachineEndpointManagement {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName?: pulumi.Input<string>;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+
+    export interface OntapStorageVirtualMachineEndpointNf {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName?: pulumi.Input<string>;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+
+    export interface OntapStorageVirtualMachineEndpointSmb {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName?: pulumi.Input<string>;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+
+    export interface OntapVolumeTieringPolicy {
+        coolingPeriod?: pulumi.Input<number>;
+        /**
+         * Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+         */
+        name?: pulumi.Input<string>;
+    }
+
     export interface WindowsFileSystemAuditLogConfiguration {
         /**
          * The Amazon Resource Name (ARN) for the destination of the audit logs. The destination can be any Amazon CloudWatch Logs log group ARN or Amazon Kinesis Data Firehose delivery stream ARN. Can be specified when `fileAccessAuditLogLevel` and `fileShareAccessAuditLogLevel` are not set to `DISABLED`. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. The name of the Amazon Kinesis Data Firehouse delivery stream must begin with the `aws-fsx` prefix. If you do not provide a destination in `auditLogDestionation`, Amazon FSx will create and use a log stream in the CloudWatch Logs /aws/fsx/windows log group.
@@ -16783,6 +17000,28 @@ export namespace imagebuilder {
         userIds?: pulumi.Input<pulumi.Input<string>[]>;
     }
 
+    export interface GetImageRecipesFilterArgs {
+        /**
+         * The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+         */
+        name: pulumi.Input<string>;
+        /**
+         * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+         */
+        values: pulumi.Input<pulumi.Input<string>[]>;
+    }
+
+    export interface GetImageRecipesFilter {
+        /**
+         * The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+         */
+        name: string;
+        /**
+         * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+         */
+        values: string[];
+    }
+
     export interface ImageImageTestsConfiguration {
         /**
          * Whether image tests are enabled. Defaults to `true`.
@@ -27334,6 +27573,10 @@ export namespace ssm {
          * The S3 bucket prefix. Results stored in the root if not configured.
          */
         s3KeyPrefix?: pulumi.Input<string>;
+        /**
+         * The S3 bucket region.
+         */
+        s3Region?: pulumi.Input<string>;
     }
 
     export interface AssociationTarget {
@@ -28504,6 +28747,21 @@ export namespace wafv2 {
         regexString: pulumi.Input<string>;
     }
 
+    export interface RuleGroupCustomResponseBody {
+        /**
+         * The payload of the custom response.
+         */
+        content: pulumi.Input<string>;
+        /**
+         * The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+         */
+        contentType: pulumi.Input<string>;
+        /**
+         * A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+         */
+        key: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRule {
         /**
          * The action that AWS WAF should take on a web request when it matches the rule's statement. Settings at the `aws.wafv2.WebAcl` level can override the rule action setting. See Action below for details.
@@ -28517,6 +28775,10 @@ export namespace wafv2 {
          * If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
          */
         priority: pulumi.Input<number>;
+        /**
+         * Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+         */
+        ruleLabels?: pulumi.Input<pulumi.Input<inputs.wafv2.RuleGroupRuleRuleLabel>[]>;
         /**
          * The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
          */
@@ -28558,7 +28820,7 @@ export namespace wafv2 {
 
     export interface RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -28575,6 +28837,10 @@ export namespace wafv2 {
     }
 
     export interface RuleGroupRuleActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: pulumi.Input<string>;
         /**
          * The HTTP status code to return to the client.
          */
@@ -28587,7 +28853,7 @@ export namespace wafv2 {
 
     export interface RuleGroupRuleActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -28612,7 +28878,7 @@ export namespace wafv2 {
 
     export interface RuleGroupRuleActionCountCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -28621,6 +28887,13 @@ export namespace wafv2 {
         value: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleRuleLabel {
+        /**
+         * The label string.
+         */
+        name: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatement {
         /**
          * A logical rule statement used to combine other rule statements with AND logic. See AND Statement below for details.
@@ -28638,6 +28911,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -28688,6 +28965,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -28734,6 +29015,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -28890,6 +29175,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -29368,6 +29664,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -29388,6 +29695,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -29544,6 +29855,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -29904,6 +30226,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -30060,6 +30386,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -30878,6 +31215,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -30902,6 +31250,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -30948,6 +31300,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -31104,6 +31460,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -31582,6 +31949,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -31602,6 +31980,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -31758,6 +32140,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -32118,6 +32511,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -32274,6 +32671,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -32978,6 +33386,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -33024,6 +33436,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -33180,6 +33596,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -33658,6 +34085,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -33678,6 +34116,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -33834,6 +34276,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -34194,6 +34647,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -34350,6 +34807,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -35400,6 +35868,21 @@ export namespace wafv2 {
         sampledRequestsEnabled: pulumi.Input<boolean>;
     }
 
+    export interface WebAclCustomResponseBody {
+        /**
+         * The payload of the custom response.
+         */
+        content: pulumi.Input<string>;
+        /**
+         * The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+         */
+        contentType: pulumi.Input<string>;
+        /**
+         * A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+         */
+        key: pulumi.Input<string>;
+    }
+
     export interface WebAclDefaultAction {
         /**
          * Specifies that AWS WAF should allow requests by default. See Allow below for details.
@@ -35427,7 +35910,7 @@ export namespace wafv2 {
 
     export interface WebAclDefaultActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -35444,6 +35927,10 @@ export namespace wafv2 {
     }
 
     export interface WebAclDefaultActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: pulumi.Input<string>;
         /**
          * The HTTP status code to return to the client.
          */
@@ -35456,7 +35943,7 @@ export namespace wafv2 {
 
     export interface WebAclDefaultActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -35601,6 +36088,10 @@ export namespace wafv2 {
          * If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
          */
         priority: pulumi.Input<number>;
+        /**
+         * Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+         */
+        ruleLabels?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleRuleLabel>[]>;
         /**
          * The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
          */
@@ -35642,7 +36133,7 @@ export namespace wafv2 {
 
     export interface WebAclRuleActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -35659,6 +36150,10 @@ export namespace wafv2 {
     }
 
     export interface WebAclRuleActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: pulumi.Input<string>;
         /**
          * The HTTP status code to return to the client.
          */
@@ -35671,7 +36166,7 @@ export namespace wafv2 {
 
     export interface WebAclRuleActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -35696,7 +36191,7 @@ export namespace wafv2 {
 
     export interface WebAclRuleActionCountCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -35722,6 +36217,13 @@ export namespace wafv2 {
     export interface WebAclRuleOverrideActionNone {
     }
 
+    export interface WebAclRuleRuleLabel {
+        /**
+         * The label string.
+         */
+        name: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatement {
         /**
          * A logical rule statement used to combine other rule statements with AND logic. See AND Statement below for details.
@@ -35739,6 +36241,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementLabelMatchStatement>;
         /**
          * A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
          */
@@ -35801,6 +36307,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -35851,6 +36361,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -35897,6 +36411,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -36053,6 +36571,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -36531,6 +37060,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -36551,6 +37091,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -36707,6 +37251,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -37067,6 +37622,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -37223,6 +37782,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -38041,6 +38611,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -38065,6 +38646,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -38111,6 +38696,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -38267,6 +38856,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -38745,6 +39345,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -38765,6 +39376,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -38921,6 +39536,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -39281,6 +39907,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -39437,6 +40067,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -40141,6 +40782,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -40187,6 +40832,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -40343,6 +40992,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -40821,6 +41481,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -40841,6 +41512,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -40997,6 +41672,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -41357,6 +42043,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -41513,6 +42203,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -42671,6 +43372,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatement {
         /**
          * The `rules` whose actions are set to `COUNT` by the web ACL, regardless of the action that is set on the rule. See Excluded Rule below for details.
@@ -42714,6 +43426,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -42764,6 +43480,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -42810,6 +43530,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -42966,6 +43690,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -43444,6 +44179,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -43464,6 +44210,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -43620,6 +44370,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -43980,6 +44741,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -44136,6 +44901,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -44954,6 +45730,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -44978,6 +45765,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -45024,6 +45815,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -45180,6 +45975,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -45658,6 +46464,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -45678,6 +46495,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -45834,6 +46655,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -46194,6 +47026,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -46350,6 +47186,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -47054,6 +47901,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -47100,6 +47951,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -47256,6 +48111,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -47734,6 +48600,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -47754,6 +48631,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -47910,6 +48791,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -48270,6 +49162,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -48426,6 +49322,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -49470,6 +50377,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -49520,6 +50431,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -49566,6 +50481,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -49722,6 +50641,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -50200,6 +51130,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -50220,6 +51161,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -50376,6 +51321,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -50736,6 +51692,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -50892,6 +51852,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -51710,6 +52681,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -51734,6 +52716,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -51780,6 +52766,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -51936,6 +52926,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -52414,6 +53415,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -52434,6 +53446,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -52590,6 +53606,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -52950,6 +53977,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -53106,6 +54137,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -53810,6 +54852,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -53856,6 +54902,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -54012,6 +55062,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -54490,6 +55551,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -54510,6 +55582,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -54666,6 +55742,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -55026,6 +56113,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -55182,6 +56273,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -56226,6 +57328,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -56276,6 +57382,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -56322,6 +57432,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -56478,6 +57592,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -56956,6 +58081,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -56976,6 +58112,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -57132,6 +58272,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -57492,6 +58643,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -57648,6 +58803,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -58466,6 +59632,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -58490,6 +59667,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -58536,6 +59717,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -58692,6 +59877,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -59170,6 +60366,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -59190,6 +60397,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -59346,6 +60557,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -59706,6 +60928,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -59862,6 +61088,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -60566,6 +61803,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -60612,6 +61853,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -60768,6 +62013,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -61246,6 +62502,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -61266,6 +62533,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -61422,6 +62693,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -61782,6 +63064,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -61938,6 +63224,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -63005,6 +64302,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -63055,6 +64356,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -63101,6 +64406,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -63257,6 +64566,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -63735,6 +65055,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -63755,6 +65086,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -63911,6 +65246,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -64271,6 +65617,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -64427,6 +65777,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -65245,6 +66606,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -65269,6 +66641,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -65315,6 +66691,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -65471,6 +66851,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -65949,6 +67340,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -65969,6 +67371,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -66125,6 +67531,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -66485,6 +67902,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -66641,6 +68062,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -67345,6 +68777,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -67391,6 +68827,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -67547,6 +68987,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -68025,6 +69476,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -68045,6 +69507,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -68201,6 +69667,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -68561,6 +70038,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -68717,6 +70198,17 @@ export namespace wafv2 {
         position: pulumi.Input<string>;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
diff --git a/sdk/nodejs/types/output.ts b/sdk/nodejs/types/output.ts
index 95537ae5915..99c50814847 100644
--- a/sdk/nodejs/types/output.ts
+++ b/sdk/nodejs/types/output.ts
@@ -4238,7 +4238,7 @@ export namespace apprunner {
         /**
          * The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
          */
-        instanceRoleArn: string;
+        instanceRoleArn?: string;
         /**
          * The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
          */
@@ -4676,6 +4676,10 @@ export namespace athena {
          * Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
          */
         enforceWorkgroupConfiguration?: boolean;
+        /**
+         * Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+         */
+        engineVersion?: outputs.athena.WorkgroupConfigurationEngineVersion;
         /**
          * Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
          */
@@ -4690,6 +4694,17 @@ export namespace athena {
         resultConfiguration?: outputs.athena.WorkgroupConfigurationResultConfiguration;
     }
 
+    export interface WorkgroupConfigurationEngineVersion {
+        /**
+         * The engine version on which the query runs. If `selectedEngineVersion` is set to `AUTO`, the effective engine version is chosen by Athena.
+         */
+        effectiveEngineVersion: string;
+        /**
+         * The requested engine version. Defaults to `AUTO`.
+         */
+        selectedEngineVersion?: string;
+    }
+
     export interface WorkgroupConfigurationResultConfiguration {
         /**
          * Configuration block with encryption settings. Documented below.
@@ -5768,17 +5783,35 @@ export namespace cfg {
         resourceTypes?: string[];
     }
 
+    export interface RemediationConfigurationExecutionControls {
+        /**
+         * Configuration block for SSM controls. See below.
+         */
+        ssmControls?: outputs.cfg.RemediationConfigurationExecutionControlsSsmControls;
+    }
+
+    export interface RemediationConfigurationExecutionControlsSsmControls {
+        /**
+         * Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+         */
+        concurrentExecutionRatePercentage?: number;
+        /**
+         * Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+         */
+        errorPercentage?: number;
+    }
+
     export interface RemediationConfigurationParameter {
         /**
-         * The name of the attribute.
+         * Name of the attribute.
          */
         name: string;
         /**
-         * The value is dynamic and changes at run-time.
+         * Value is dynamic and changes at run-time.
          */
         resourceValue?: string;
         /**
-         * The value is static and does not change at run-time.
+         * Value is static and does not change at run-time.
          */
         staticValue?: string;
     }
@@ -7284,7 +7317,11 @@ export namespace cloudtrail {
          */
         dataResources?: outputs.cloudtrail.TrailEventSelectorDataResource[];
         /**
-         * Whether to include management events for your trail.
+         * A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `includeManagementEvents` must be set to`true` to allow this.
+         */
+        excludeManagementEventSources?: string[];
+        /**
+         * Whether to include management events for your trail. Defaults to `true`.
          */
         includeManagementEvents?: boolean;
         /**
@@ -9191,6 +9228,7 @@ export namespace config {
 
     export interface Endpoints {
         accessanalyzer?: string;
+        account?: string;
         acm?: string;
         acmpca?: string;
         alexaforbusiness?: string;
@@ -9737,19 +9775,23 @@ export namespace dlm {
 
     export interface LifecyclePolicyPolicyDetailsSchedule {
         /**
-         * Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+         * Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
          */
         copyTags: boolean;
         /**
          * See the `createRule` block. Max of 1 per schedule.
          */
         createRule: outputs.dlm.LifecyclePolicyPolicyDetailsScheduleCreateRule;
+        /**
+         * See the `crossRegionCopyRule` block. Max of 3 per schedule.
+         */
+        crossRegionCopyRules?: outputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule[];
         /**
          * A name for the schedule.
          */
         name: string;
         /**
-         * See the `retainRule` block. Max of 1 per schedule.
+         * The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
          */
         retainRule: outputs.dlm.LifecyclePolicyPolicyDetailsScheduleRetainRule;
         /**
@@ -9760,11 +9802,11 @@ export namespace dlm {
 
     export interface LifecyclePolicyPolicyDetailsScheduleCreateRule {
         /**
-         * How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
          */
         interval: number;
         /**
-         * The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
          */
         intervalUnit?: string;
         /**
@@ -9773,6 +9815,55 @@ export namespace dlm {
         times: string;
     }
 
+    export interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule {
+        /**
+         * The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+         */
+        cmkArn?: string;
+        /**
+         * Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+         */
+        copyTags?: boolean;
+        /**
+         * The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecateRule` block.
+         */
+        deprecateRule?: outputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule;
+        /**
+         * To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+         */
+        encrypted: boolean;
+        /**
+         * The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
+         */
+        retainRule?: outputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule;
+        /**
+         * The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+         */
+        target: string;
+    }
+
+    export interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule {
+        /**
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+         */
+        interval: number;
+        /**
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+         */
+        intervalUnit: string;
+    }
+
+    export interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule {
+        /**
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+         */
+        interval: number;
+        /**
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+         */
+        intervalUnit: string;
+    }
+
     export interface LifecyclePolicyPolicyDetailsScheduleRetainRule {
         /**
          * How many snapshots to keep. Must be an integer between 1 and 1000.
@@ -11042,6 +11133,17 @@ export namespace ec2 {
         values: string[];
     }
 
+    export interface GetInstanceTypesFilter {
+        /**
+         * Name of the filter.
+         */
+        name: string;
+        /**
+         * List of one or more values for the filter.
+         */
+        values: string[];
+    }
+
     export interface GetInstancesFilter {
         name: string;
         values: string[];
@@ -13095,7 +13197,6 @@ export namespace ec2 {
         status: string;
         statusMessage: string;
     }
-
 }
 
 export namespace ec2clientvpn {
@@ -16462,6 +16563,109 @@ export namespace fsx {
         ipAddresses: string[];
     }
 
+    export interface OntapStorageVirtualMachineActiveDirectoryConfiguration {
+        /**
+         * The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+         */
+        netbiosName?: string;
+        selfManagedActiveDirectoryConfiguration?: outputs.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration;
+    }
+
+    export interface OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration {
+        /**
+         * A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+         */
+        dnsIps: string[];
+        /**
+         * The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+         */
+        domainName: string;
+        /**
+         * The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+         */
+        fileSystemAdministratorsGroup?: string;
+        organizationalUnitDistinguidshedName?: string;
+        /**
+         * The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+         */
+        password: string;
+        /**
+         * The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+         */
+        username: string;
+    }
+
+    export interface OntapStorageVirtualMachineEndpoint {
+        /**
+         * An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+         */
+        iscses: outputs.fsx.OntapStorageVirtualMachineEndpointIscse[];
+        /**
+         * An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+         */
+        managements: outputs.fsx.OntapStorageVirtualMachineEndpointManagement[];
+        /**
+         * An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+         */
+        nfs: outputs.fsx.OntapStorageVirtualMachineEndpointNf[];
+        /**
+         * An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an activeDirectoryConfiguration has been set. See Endpoint.
+         */
+        smbs: outputs.fsx.OntapStorageVirtualMachineEndpointSmb[];
+    }
+
+    export interface OntapStorageVirtualMachineEndpointIscse {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName: string;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses: string[];
+    }
+
+    export interface OntapStorageVirtualMachineEndpointManagement {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName: string;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses: string[];
+    }
+
+    export interface OntapStorageVirtualMachineEndpointNf {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName: string;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses: string[];
+    }
+
+    export interface OntapStorageVirtualMachineEndpointSmb {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName: string;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses: string[];
+    }
+
+    export interface OntapVolumeTieringPolicy {
+        coolingPeriod?: number;
+        /**
+         * Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+         */
+        name: string;
+    }
+
     export interface WindowsFileSystemAuditLogConfiguration {
         /**
          * The Amazon Resource Name (ARN) for the destination of the audit logs. The destination can be any Amazon CloudWatch Logs log group ARN or Amazon Kinesis Data Firehose delivery stream ARN. Can be specified when `fileAccessAuditLogLevel` and `fileShareAccessAuditLogLevel` are not set to `DISABLED`. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. The name of the Amazon Kinesis Data Firehouse delivery stream must begin with the `aws-fsx` prefix. If you do not provide a destination in `auditLogDestionation`, Amazon FSx will create and use a log stream in the CloudWatch Logs /aws/fsx/windows log group.
@@ -17962,6 +18166,17 @@ export namespace imagebuilder {
         componentArn: string;
     }
 
+    export interface GetImageRecipesFilter {
+        /**
+         * The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+         */
+        name: string;
+        /**
+         * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+         */
+        values: string[];
+    }
+
     export interface GetInfrastructureConfigurationLogging {
         /**
          * Nested list of S3 logs settings.
@@ -28954,6 +29169,10 @@ export namespace ssm {
          * The S3 bucket prefix. Results stored in the root if not configured.
          */
         s3KeyPrefix?: string;
+        /**
+         * The S3 bucket region.
+         */
+        s3Region?: string;
     }
 
     export interface AssociationTarget {
@@ -30138,6 +30357,21 @@ export namespace wafv2 {
         regexString: string;
     }
 
+    export interface RuleGroupCustomResponseBody {
+        /**
+         * The payload of the custom response.
+         */
+        content: string;
+        /**
+         * The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+         */
+        contentType: string;
+        /**
+         * A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+         */
+        key: string;
+    }
+
     export interface RuleGroupRule {
         /**
          * The action that AWS WAF should take on a web request when it matches the rule's statement. Settings at the `aws.wafv2.WebAcl` level can override the rule action setting. See Action below for details.
@@ -30151,6 +30385,10 @@ export namespace wafv2 {
          * If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
          */
         priority: number;
+        /**
+         * Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+         */
+        ruleLabels?: outputs.wafv2.RuleGroupRuleRuleLabel[];
         /**
          * The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
          */
@@ -30192,7 +30430,7 @@ export namespace wafv2 {
 
     export interface RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: string;
         /**
@@ -30209,6 +30447,10 @@ export namespace wafv2 {
     }
 
     export interface RuleGroupRuleActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: string;
         /**
          * The HTTP status code to return to the client.
          */
@@ -30221,7 +30463,7 @@ export namespace wafv2 {
 
     export interface RuleGroupRuleActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: string;
         /**
@@ -30246,7 +30488,7 @@ export namespace wafv2 {
 
     export interface RuleGroupRuleActionCountCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: string;
         /**
@@ -30255,6 +30497,13 @@ export namespace wafv2 {
         value: string;
     }
 
+    export interface RuleGroupRuleRuleLabel {
+        /**
+         * The label string.
+         */
+        name: string;
+    }
+
     export interface RuleGroupRuleStatement {
         /**
          * A logical rule statement used to combine other rule statements with AND logic. See AND Statement below for details.
@@ -30272,6 +30521,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -30322,6 +30575,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementAndStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -30368,6 +30625,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -30524,6 +30785,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -31002,6 +31274,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -31022,6 +31305,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -31178,6 +31465,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -31538,6 +31836,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -31694,6 +31996,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -32512,6 +32825,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -32536,6 +32860,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementNotStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -32582,6 +32910,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -32738,6 +33070,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -33216,6 +33559,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -33236,6 +33590,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -33392,6 +33750,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -33752,6 +34121,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -33908,6 +34281,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -34612,6 +34996,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementOrStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -34658,6 +35046,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -34814,6 +35206,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -35292,6 +35695,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -35312,6 +35726,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -35468,6 +35886,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -35828,6 +36257,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -35984,6 +36417,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -37034,6 +37478,21 @@ export namespace wafv2 {
         sampledRequestsEnabled: boolean;
     }
 
+    export interface WebAclCustomResponseBody {
+        /**
+         * The payload of the custom response.
+         */
+        content: string;
+        /**
+         * The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+         */
+        contentType: string;
+        /**
+         * A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+         */
+        key: string;
+    }
+
     export interface WebAclDefaultAction {
         /**
          * Specifies that AWS WAF should allow requests by default. See Allow below for details.
@@ -37061,7 +37520,7 @@ export namespace wafv2 {
 
     export interface WebAclDefaultActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: string;
         /**
@@ -37078,6 +37537,10 @@ export namespace wafv2 {
     }
 
     export interface WebAclDefaultActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: string;
         /**
          * The HTTP status code to return to the client.
          */
@@ -37090,7 +37553,7 @@ export namespace wafv2 {
 
     export interface WebAclDefaultActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: string;
         /**
@@ -37235,6 +37698,10 @@ export namespace wafv2 {
          * If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
          */
         priority: number;
+        /**
+         * Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+         */
+        ruleLabels?: outputs.wafv2.WebAclRuleRuleLabel[];
         /**
          * The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
          */
@@ -37276,7 +37743,7 @@ export namespace wafv2 {
 
     export interface WebAclRuleActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: string;
         /**
@@ -37293,6 +37760,10 @@ export namespace wafv2 {
     }
 
     export interface WebAclRuleActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: string;
         /**
          * The HTTP status code to return to the client.
          */
@@ -37305,7 +37776,7 @@ export namespace wafv2 {
 
     export interface WebAclRuleActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: string;
         /**
@@ -37330,7 +37801,7 @@ export namespace wafv2 {
 
     export interface WebAclRuleActionCountCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: string;
         /**
@@ -37356,6 +37827,13 @@ export namespace wafv2 {
     export interface WebAclRuleOverrideActionNone {
     }
 
+    export interface WebAclRuleRuleLabel {
+        /**
+         * The label string.
+         */
+        name: string;
+    }
+
     export interface WebAclRuleStatement {
         /**
          * A logical rule statement used to combine other rule statements with AND logic. See AND Statement below for details.
@@ -37373,6 +37851,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementLabelMatchStatement;
         /**
          * A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
          */
@@ -37435,6 +37917,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -37485,6 +37971,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -37531,6 +38021,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -37687,6 +38181,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -38165,6 +38670,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -38185,6 +38701,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -38341,6 +38861,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -38701,6 +39232,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -38857,6 +39392,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -39675,6 +40221,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -39699,6 +40256,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -39745,6 +40306,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -39901,6 +40466,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -40379,6 +40955,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -40399,6 +40986,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -40555,6 +41146,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -40915,6 +41517,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -41071,6 +41677,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -41775,6 +42392,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -41821,6 +42442,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -41977,6 +42602,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -42455,6 +43091,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -42475,6 +43122,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -42631,6 +43282,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -42991,6 +43653,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -43147,6 +43813,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -44305,6 +44982,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatement {
         /**
          * The `rules` whose actions are set to `COUNT` by the web ACL, regardless of the action that is set on the rule. See Excluded Rule below for details.
@@ -44348,6 +45036,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -44398,6 +45090,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -44444,6 +45140,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -44600,6 +45300,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -45078,6 +45789,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -45098,6 +45820,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -45254,6 +45980,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -45614,6 +46351,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -45770,6 +46511,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -46588,6 +47340,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -46612,6 +47375,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -46658,6 +47425,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -46814,6 +47585,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -47292,6 +48074,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -47312,6 +48105,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -47468,6 +48265,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -47828,6 +48636,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -47984,6 +48796,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -48688,6 +49511,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -48734,6 +49561,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -48890,6 +49721,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -49368,6 +50210,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -49388,6 +50241,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -49544,6 +50401,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -49904,6 +50772,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -50060,6 +50932,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -51104,6 +51987,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -51154,6 +52041,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -51200,6 +52091,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -51356,6 +52251,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -51834,6 +52740,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -51854,6 +52771,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -52010,6 +52931,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -52370,6 +53302,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -52526,6 +53462,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -53344,6 +54291,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -53368,6 +54326,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -53414,6 +54376,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -53570,6 +54536,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -54048,6 +55025,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -54068,6 +55056,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -54224,6 +55216,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -54584,6 +55587,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -54740,6 +55747,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -55444,6 +56462,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -55490,6 +56512,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -55646,6 +56672,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -56124,6 +57161,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -56144,6 +57192,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -56300,6 +57352,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -56660,6 +57723,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -56816,6 +57883,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -57860,6 +58938,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -57910,6 +58992,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -57956,6 +59042,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -58112,6 +59202,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -58590,6 +59691,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -58610,6 +59722,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -58766,6 +59882,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -59126,6 +60253,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -59282,6 +60413,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -60100,6 +61242,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -60124,6 +61277,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -60170,6 +61327,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -60326,6 +61487,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -60804,6 +61976,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -60824,6 +62007,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -60980,6 +62167,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -61340,6 +62538,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -61496,6 +62698,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -62200,6 +63413,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -62246,6 +63463,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -62402,6 +63623,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -62880,6 +64112,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -62900,6 +64143,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -63056,6 +64303,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -63416,6 +64674,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -63572,6 +64834,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -64639,6 +65912,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -64689,6 +65966,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -64735,6 +66016,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -64891,6 +66176,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -65369,6 +66665,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -65389,6 +66696,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -65545,6 +66856,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -65905,6 +67227,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -66061,6 +67387,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -66879,6 +68216,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -66903,6 +68251,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -66949,6 +68301,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -67105,6 +68461,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -67583,6 +68950,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -67603,6 +68981,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -67759,6 +69141,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -68119,6 +69512,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -68275,6 +69672,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -68979,6 +70387,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -69025,6 +70437,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -69181,6 +70597,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -69659,6 +71086,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -69679,6 +71117,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -69835,6 +71277,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -70195,6 +71648,10 @@ export namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: outputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -70351,6 +71808,17 @@ export namespace wafv2 {
         position: string;
     }
 
+    export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: string;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: string;
+    }
+
     export interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -71758,6 +73226,7 @@ export namespace wafv2 {
          */
         sampledRequestsEnabled: boolean;
     }
+
 }
 
 export namespace worklink {
diff --git a/sdk/nodejs/wafv2/ruleGroup.ts b/sdk/nodejs/wafv2/ruleGroup.ts
index 35d220bd382..9a0ccb21f80 100644
--- a/sdk/nodejs/wafv2/ruleGroup.ts
+++ b/sdk/nodejs/wafv2/ruleGroup.ts
@@ -287,13 +287,17 @@ export class RuleGroup extends pulumi.CustomResource {
      * The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
      */
     public readonly capacity!: pulumi.Output<number>;
+    /**
+     * Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+     */
+    public readonly customResponseBodies!: pulumi.Output<outputs.wafv2.RuleGroupCustomResponseBody[] | undefined>;
     /**
      * A friendly description of the rule group.
      */
     public readonly description!: pulumi.Output<string | undefined>;
     public /*out*/ readonly lockToken!: pulumi.Output<string>;
     /**
-     * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+     * The label string.
      */
     public readonly name!: pulumi.Output<string>;
     /**
@@ -332,6 +336,7 @@ export class RuleGroup extends pulumi.CustomResource {
             const state = argsOrState as RuleGroupState | undefined;
             inputs["arn"] = state ? state.arn : undefined;
             inputs["capacity"] = state ? state.capacity : undefined;
+            inputs["customResponseBodies"] = state ? state.customResponseBodies : undefined;
             inputs["description"] = state ? state.description : undefined;
             inputs["lockToken"] = state ? state.lockToken : undefined;
             inputs["name"] = state ? state.name : undefined;
@@ -352,6 +357,7 @@ export class RuleGroup extends pulumi.CustomResource {
                 throw new Error("Missing required property 'visibilityConfig'");
             }
             inputs["capacity"] = args ? args.capacity : undefined;
+            inputs["customResponseBodies"] = args ? args.customResponseBodies : undefined;
             inputs["description"] = args ? args.description : undefined;
             inputs["name"] = args ? args.name : undefined;
             inputs["rules"] = args ? args.rules : undefined;
@@ -381,13 +387,17 @@ export interface RuleGroupState {
      * The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
      */
     capacity?: pulumi.Input<number>;
+    /**
+     * Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+     */
+    customResponseBodies?: pulumi.Input<pulumi.Input<inputs.wafv2.RuleGroupCustomResponseBody>[]>;
     /**
      * A friendly description of the rule group.
      */
     description?: pulumi.Input<string>;
     lockToken?: pulumi.Input<string>;
     /**
-     * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+     * The label string.
      */
     name?: pulumi.Input<string>;
     /**
@@ -420,12 +430,16 @@ export interface RuleGroupArgs {
      * The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
      */
     capacity: pulumi.Input<number>;
+    /**
+     * Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+     */
+    customResponseBodies?: pulumi.Input<pulumi.Input<inputs.wafv2.RuleGroupCustomResponseBody>[]>;
     /**
      * A friendly description of the rule group.
      */
     description?: pulumi.Input<string>;
     /**
-     * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+     * The label string.
      */
     name?: pulumi.Input<string>;
     /**
diff --git a/sdk/nodejs/wafv2/webAcl.ts b/sdk/nodejs/wafv2/webAcl.ts
index e4d56fb23cf..573f6d1d2f3 100644
--- a/sdk/nodejs/wafv2/webAcl.ts
+++ b/sdk/nodejs/wafv2/webAcl.ts
@@ -69,6 +69,7 @@ import * as utilities from "../utilities";
  * });
  * ```
  * ### Rate Based
+ * Rate-limit US and NL-based clients to 10,000 requests for every 5 minutes.
  *
  * ```typescript
  * import * as pulumi from "@pulumi/pulumi";
@@ -76,12 +77,12 @@ import * as utilities from "../utilities";
  *
  * const example = new aws.wafv2.WebAcl("example", {
  *     defaultAction: {
- *         block: {},
+ *         allow: {},
  *     },
- *     description: "Example of a rate based statement.",
+ *     description: "Example of a Cloudfront rate based statement.",
  *     rules: [{
  *         action: {
- *             count: {},
+ *             block: {},
  *         },
  *         name: "rule-1",
  *         priority: 1,
@@ -105,7 +106,7 @@ import * as utilities from "../utilities";
  *             sampledRequestsEnabled: false,
  *         },
  *     }],
- *     scope: "REGIONAL",
+ *     scope: "CLOUDFRONT",
  *     tags: {
  *         Tag1: "Value1",
  *         Tag2: "Value2",
@@ -271,6 +272,10 @@ export class WebAcl extends pulumi.CustomResource {
      * The web ACL capacity units (WCUs) currently being used by this web ACL.
      */
     public /*out*/ readonly capacity!: pulumi.Output<number>;
+    /**
+     * Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+     */
+    public readonly customResponseBodies!: pulumi.Output<outputs.wafv2.WebAclCustomResponseBody[] | undefined>;
     /**
      * The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
      */
@@ -281,7 +286,7 @@ export class WebAcl extends pulumi.CustomResource {
     public readonly description!: pulumi.Output<string | undefined>;
     public /*out*/ readonly lockToken!: pulumi.Output<string>;
     /**
-     * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+     * The label string.
      */
     public readonly name!: pulumi.Output<string>;
     /**
@@ -320,6 +325,7 @@ export class WebAcl extends pulumi.CustomResource {
             const state = argsOrState as WebAclState | undefined;
             inputs["arn"] = state ? state.arn : undefined;
             inputs["capacity"] = state ? state.capacity : undefined;
+            inputs["customResponseBodies"] = state ? state.customResponseBodies : undefined;
             inputs["defaultAction"] = state ? state.defaultAction : undefined;
             inputs["description"] = state ? state.description : undefined;
             inputs["lockToken"] = state ? state.lockToken : undefined;
@@ -340,6 +346,7 @@ export class WebAcl extends pulumi.CustomResource {
             if ((!args || args.visibilityConfig === undefined) && !opts.urn) {
                 throw new Error("Missing required property 'visibilityConfig'");
             }
+            inputs["customResponseBodies"] = args ? args.customResponseBodies : undefined;
             inputs["defaultAction"] = args ? args.defaultAction : undefined;
             inputs["description"] = args ? args.description : undefined;
             inputs["name"] = args ? args.name : undefined;
@@ -371,6 +378,10 @@ export interface WebAclState {
      * The web ACL capacity units (WCUs) currently being used by this web ACL.
      */
     capacity?: pulumi.Input<number>;
+    /**
+     * Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+     */
+    customResponseBodies?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclCustomResponseBody>[]>;
     /**
      * The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
      */
@@ -381,7 +392,7 @@ export interface WebAclState {
     description?: pulumi.Input<string>;
     lockToken?: pulumi.Input<string>;
     /**
-     * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+     * The label string.
      */
     name?: pulumi.Input<string>;
     /**
@@ -410,6 +421,10 @@ export interface WebAclState {
  * The set of arguments for constructing a WebAcl resource.
  */
 export interface WebAclArgs {
+    /**
+     * Defines custom response bodies that can be referenced by `customResponse` actions. See Custom Response Body below for details.
+     */
+    customResponseBodies?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclCustomResponseBody>[]>;
     /**
      * The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
      */
@@ -419,7 +434,7 @@ export interface WebAclArgs {
      */
     description?: pulumi.Input<string>;
     /**
-     * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+     * The label string.
      */
     name?: pulumi.Input<string>;
     /**
diff --git a/sdk/python/pulumi_aws/__init__.py b/sdk/python/pulumi_aws/__init__.py
index 8d548bc4020..64a58e865f7 100644
--- a/sdk/python/pulumi_aws/__init__.py
+++ b/sdk/python/pulumi_aws/__init__.py
@@ -30,6 +30,8 @@
 if typing.TYPE_CHECKING:
     import pulumi_aws.accessanalyzer as __accessanalyzer
     accessanalyzer = __accessanalyzer
+    import pulumi_aws.account as __account
+    account = __account
     import pulumi_aws.acm as __acm
     acm = __acm
     import pulumi_aws.acmpca as __acmpca
@@ -320,6 +322,7 @@
     xray = __xray
 else:
     accessanalyzer = _utilities.lazy_import('pulumi_aws.accessanalyzer')
+    account = _utilities.lazy_import('pulumi_aws.account')
     acm = _utilities.lazy_import('pulumi_aws.acm')
     acmpca = _utilities.lazy_import('pulumi_aws.acmpca')
     alb = _utilities.lazy_import('pulumi_aws.alb')
@@ -476,6 +479,14 @@
    "aws:accessanalyzer/analyzer:Analyzer": "Analyzer"
   }
  },
+ {
+  "pkg": "aws",
+  "mod": "account/alternativeContact",
+  "fqn": "pulumi_aws.account",
+  "classes": {
+   "aws:account/alternativeContact:AlternativeContact": "AlternativeContact"
+  }
+ },
  {
   "pkg": "aws",
   "mod": "acm/certificate",
@@ -1140,6 +1151,14 @@
    "aws:appstream/fleet:Fleet": "Fleet"
   }
  },
+ {
+  "pkg": "aws",
+  "mod": "appstream/fleetStackAssociation",
+  "fqn": "pulumi_aws.appstream",
+  "classes": {
+   "aws:appstream/fleetStackAssociation:FleetStackAssociation": "FleetStackAssociation"
+  }
+ },
  {
   "pkg": "aws",
   "mod": "appstream/imageBuilder",
@@ -1156,6 +1175,22 @@
    "aws:appstream/stack:Stack": "Stack"
   }
  },
+ {
+  "pkg": "aws",
+  "mod": "appstream/user",
+  "fqn": "pulumi_aws.appstream",
+  "classes": {
+   "aws:appstream/user:User": "User"
+  }
+ },
+ {
+  "pkg": "aws",
+  "mod": "appstream/userStackAssociation",
+  "fqn": "pulumi_aws.appstream",
+  "classes": {
+   "aws:appstream/userStackAssociation:UserStackAssociation": "UserStackAssociation"
+  }
+ },
  {
   "pkg": "aws",
   "mod": "appsync/apiKey",
@@ -3804,6 +3839,22 @@
    "aws:fsx/ontapFileSystem:OntapFileSystem": "OntapFileSystem"
   }
  },
+ {
+  "pkg": "aws",
+  "mod": "fsx/ontapStorageVirtualMachine",
+  "fqn": "pulumi_aws.fsx",
+  "classes": {
+   "aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine": "OntapStorageVirtualMachine"
+  }
+ },
+ {
+  "pkg": "aws",
+  "mod": "fsx/ontapVolume",
+  "fqn": "pulumi_aws.fsx",
+  "classes": {
+   "aws:fsx/ontapVolume:OntapVolume": "OntapVolume"
+  }
+ },
  {
   "pkg": "aws",
   "mod": "fsx/windowsFileSystem",
diff --git a/sdk/python/pulumi_aws/_inputs.py b/sdk/python/pulumi_aws/_inputs.py
index cec3dfced6a..ffa0805938a 100644
--- a/sdk/python/pulumi_aws/_inputs.py
+++ b/sdk/python/pulumi_aws/_inputs.py
@@ -146,6 +146,7 @@ def tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
 class ProviderEndpointArgs:
     def __init__(__self__, *,
                  accessanalyzer: Optional[pulumi.Input[str]] = None,
+                 account: Optional[pulumi.Input[str]] = None,
                  acm: Optional[pulumi.Input[str]] = None,
                  acmpca: Optional[pulumi.Input[str]] = None,
                  alexaforbusiness: Optional[pulumi.Input[str]] = None,
@@ -446,6 +447,8 @@ def __init__(__self__, *,
                  xray: Optional[pulumi.Input[str]] = None):
         if accessanalyzer is not None:
             pulumi.set(__self__, "accessanalyzer", accessanalyzer)
+        if account is not None:
+            pulumi.set(__self__, "account", account)
         if acm is not None:
             pulumi.set(__self__, "acm", acm)
         if acmpca is not None:
@@ -1052,6 +1055,15 @@ def accessanalyzer(self) -> Optional[pulumi.Input[str]]:
     def accessanalyzer(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "accessanalyzer", value)
 
+    @property
+    @pulumi.getter
+    def account(self) -> Optional[pulumi.Input[str]]:
+        return pulumi.get(self, "account")
+
+    @account.setter
+    def account(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "account", value)
+
     @property
     @pulumi.getter
     def acm(self) -> Optional[pulumi.Input[str]]:
diff --git a/sdk/python/pulumi_aws/account/__init__.py b/sdk/python/pulumi_aws/account/__init__.py
new file mode 100644
index 00000000000..e3140315bf2
--- /dev/null
+++ b/sdk/python/pulumi_aws/account/__init__.py
@@ -0,0 +1,8 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+from .. import _utilities
+import typing
+# Export this package's modules as members:
+from .alternative_contact import *
diff --git a/sdk/python/pulumi_aws/account/alternative_contact.py b/sdk/python/pulumi_aws/account/alternative_contact.py
new file mode 100644
index 00000000000..56e2e75cc1b
--- /dev/null
+++ b/sdk/python/pulumi_aws/account/alternative_contact.py
@@ -0,0 +1,381 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from .. import _utilities
+
+__all__ = ['AlternativeContactArgs', 'AlternativeContact']
+
+@pulumi.input_type
+class AlternativeContactArgs:
+    def __init__(__self__, *,
+                 alternate_contact_type: pulumi.Input[str],
+                 email_address: pulumi.Input[str],
+                 phone_number: pulumi.Input[str],
+                 title: pulumi.Input[str],
+                 name: Optional[pulumi.Input[str]] = None):
+        """
+        The set of arguments for constructing a AlternativeContact resource.
+        :param pulumi.Input[str] alternate_contact_type: The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        :param pulumi.Input[str] email_address: An email address for the alternate contact.
+        :param pulumi.Input[str] phone_number: A phone number for the alternate contact.
+        :param pulumi.Input[str] title: A title for the alternate contact.
+        :param pulumi.Input[str] name: The name of the alternate contact.
+        """
+        pulumi.set(__self__, "alternate_contact_type", alternate_contact_type)
+        pulumi.set(__self__, "email_address", email_address)
+        pulumi.set(__self__, "phone_number", phone_number)
+        pulumi.set(__self__, "title", title)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter(name="alternateContactType")
+    def alternate_contact_type(self) -> pulumi.Input[str]:
+        """
+        The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        """
+        return pulumi.get(self, "alternate_contact_type")
+
+    @alternate_contact_type.setter
+    def alternate_contact_type(self, value: pulumi.Input[str]):
+        pulumi.set(self, "alternate_contact_type", value)
+
+    @property
+    @pulumi.getter(name="emailAddress")
+    def email_address(self) -> pulumi.Input[str]:
+        """
+        An email address for the alternate contact.
+        """
+        return pulumi.get(self, "email_address")
+
+    @email_address.setter
+    def email_address(self, value: pulumi.Input[str]):
+        pulumi.set(self, "email_address", value)
+
+    @property
+    @pulumi.getter(name="phoneNumber")
+    def phone_number(self) -> pulumi.Input[str]:
+        """
+        A phone number for the alternate contact.
+        """
+        return pulumi.get(self, "phone_number")
+
+    @phone_number.setter
+    def phone_number(self, value: pulumi.Input[str]):
+        pulumi.set(self, "phone_number", value)
+
+    @property
+    @pulumi.getter
+    def title(self) -> pulumi.Input[str]:
+        """
+        A title for the alternate contact.
+        """
+        return pulumi.get(self, "title")
+
+    @title.setter
+    def title(self, value: pulumi.Input[str]):
+        pulumi.set(self, "title", value)
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The name of the alternate contact.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "name", value)
+
+
+@pulumi.input_type
+class _AlternativeContactState:
+    def __init__(__self__, *,
+                 alternate_contact_type: Optional[pulumi.Input[str]] = None,
+                 email_address: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 phone_number: Optional[pulumi.Input[str]] = None,
+                 title: Optional[pulumi.Input[str]] = None):
+        """
+        Input properties used for looking up and filtering AlternativeContact resources.
+        :param pulumi.Input[str] alternate_contact_type: The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        :param pulumi.Input[str] email_address: An email address for the alternate contact.
+        :param pulumi.Input[str] name: The name of the alternate contact.
+        :param pulumi.Input[str] phone_number: A phone number for the alternate contact.
+        :param pulumi.Input[str] title: A title for the alternate contact.
+        """
+        if alternate_contact_type is not None:
+            pulumi.set(__self__, "alternate_contact_type", alternate_contact_type)
+        if email_address is not None:
+            pulumi.set(__self__, "email_address", email_address)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+        if phone_number is not None:
+            pulumi.set(__self__, "phone_number", phone_number)
+        if title is not None:
+            pulumi.set(__self__, "title", title)
+
+    @property
+    @pulumi.getter(name="alternateContactType")
+    def alternate_contact_type(self) -> Optional[pulumi.Input[str]]:
+        """
+        The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        """
+        return pulumi.get(self, "alternate_contact_type")
+
+    @alternate_contact_type.setter
+    def alternate_contact_type(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "alternate_contact_type", value)
+
+    @property
+    @pulumi.getter(name="emailAddress")
+    def email_address(self) -> Optional[pulumi.Input[str]]:
+        """
+        An email address for the alternate contact.
+        """
+        return pulumi.get(self, "email_address")
+
+    @email_address.setter
+    def email_address(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "email_address", value)
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The name of the alternate contact.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "name", value)
+
+    @property
+    @pulumi.getter(name="phoneNumber")
+    def phone_number(self) -> Optional[pulumi.Input[str]]:
+        """
+        A phone number for the alternate contact.
+        """
+        return pulumi.get(self, "phone_number")
+
+    @phone_number.setter
+    def phone_number(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "phone_number", value)
+
+    @property
+    @pulumi.getter
+    def title(self) -> Optional[pulumi.Input[str]]:
+        """
+        A title for the alternate contact.
+        """
+        return pulumi.get(self, "title")
+
+    @title.setter
+    def title(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "title", value)
+
+
+class AlternativeContact(pulumi.CustomResource):
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 alternate_contact_type: Optional[pulumi.Input[str]] = None,
+                 email_address: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 phone_number: Optional[pulumi.Input[str]] = None,
+                 title: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        """
+        Manages the specified alternate contact attached to an AWS Account.
+
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        operations = aws.account.AlternativeContact("operations",
+            alternate_contact_type="OPERATIONS",
+            email_address="test@example.com",
+            phone_number="+1234567890",
+            title="Example")
+        ```
+
+        ## Import
+
+        The current Alternate Contact can be imported using the `alternate_contact_type`, e.g.,
+
+        ```sh
+         $ pulumi import aws:account/alternativeContact:AlternativeContact operations OPERATIONS
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] alternate_contact_type: The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        :param pulumi.Input[str] email_address: An email address for the alternate contact.
+        :param pulumi.Input[str] name: The name of the alternate contact.
+        :param pulumi.Input[str] phone_number: A phone number for the alternate contact.
+        :param pulumi.Input[str] title: A title for the alternate contact.
+        """
+        ...
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 args: AlternativeContactArgs,
+                 opts: Optional[pulumi.ResourceOptions] = None):
+        """
+        Manages the specified alternate contact attached to an AWS Account.
+
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        operations = aws.account.AlternativeContact("operations",
+            alternate_contact_type="OPERATIONS",
+            email_address="test@example.com",
+            phone_number="+1234567890",
+            title="Example")
+        ```
+
+        ## Import
+
+        The current Alternate Contact can be imported using the `alternate_contact_type`, e.g.,
+
+        ```sh
+         $ pulumi import aws:account/alternativeContact:AlternativeContact operations OPERATIONS
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param AlternativeContactArgs args: The arguments to use to populate this resource's properties.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        """
+        ...
+    def __init__(__self__, resource_name: str, *args, **kwargs):
+        resource_args, opts = _utilities.get_resource_args_opts(AlternativeContactArgs, pulumi.ResourceOptions, *args, **kwargs)
+        if resource_args is not None:
+            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
+        else:
+            __self__._internal_init(resource_name, *args, **kwargs)
+
+    def _internal_init(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 alternate_contact_type: Optional[pulumi.Input[str]] = None,
+                 email_address: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 phone_number: Optional[pulumi.Input[str]] = None,
+                 title: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        if opts is None:
+            opts = pulumi.ResourceOptions()
+        if not isinstance(opts, pulumi.ResourceOptions):
+            raise TypeError('Expected resource options to be a ResourceOptions instance')
+        if opts.version is None:
+            opts.version = _utilities.get_version()
+        if opts.id is None:
+            if __props__ is not None:
+                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
+            __props__ = AlternativeContactArgs.__new__(AlternativeContactArgs)
+
+            if alternate_contact_type is None and not opts.urn:
+                raise TypeError("Missing required property 'alternate_contact_type'")
+            __props__.__dict__["alternate_contact_type"] = alternate_contact_type
+            if email_address is None and not opts.urn:
+                raise TypeError("Missing required property 'email_address'")
+            __props__.__dict__["email_address"] = email_address
+            __props__.__dict__["name"] = name
+            if phone_number is None and not opts.urn:
+                raise TypeError("Missing required property 'phone_number'")
+            __props__.__dict__["phone_number"] = phone_number
+            if title is None and not opts.urn:
+                raise TypeError("Missing required property 'title'")
+            __props__.__dict__["title"] = title
+        super(AlternativeContact, __self__).__init__(
+            'aws:account/alternativeContact:AlternativeContact',
+            resource_name,
+            __props__,
+            opts)
+
+    @staticmethod
+    def get(resource_name: str,
+            id: pulumi.Input[str],
+            opts: Optional[pulumi.ResourceOptions] = None,
+            alternate_contact_type: Optional[pulumi.Input[str]] = None,
+            email_address: Optional[pulumi.Input[str]] = None,
+            name: Optional[pulumi.Input[str]] = None,
+            phone_number: Optional[pulumi.Input[str]] = None,
+            title: Optional[pulumi.Input[str]] = None) -> 'AlternativeContact':
+        """
+        Get an existing AlternativeContact resource's state with the given name, id, and optional extra
+        properties used to qualify the lookup.
+
+        :param str resource_name: The unique name of the resulting resource.
+        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] alternate_contact_type: The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        :param pulumi.Input[str] email_address: An email address for the alternate contact.
+        :param pulumi.Input[str] name: The name of the alternate contact.
+        :param pulumi.Input[str] phone_number: A phone number for the alternate contact.
+        :param pulumi.Input[str] title: A title for the alternate contact.
+        """
+        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
+
+        __props__ = _AlternativeContactState.__new__(_AlternativeContactState)
+
+        __props__.__dict__["alternate_contact_type"] = alternate_contact_type
+        __props__.__dict__["email_address"] = email_address
+        __props__.__dict__["name"] = name
+        __props__.__dict__["phone_number"] = phone_number
+        __props__.__dict__["title"] = title
+        return AlternativeContact(resource_name, opts=opts, __props__=__props__)
+
+    @property
+    @pulumi.getter(name="alternateContactType")
+    def alternate_contact_type(self) -> pulumi.Output[str]:
+        """
+        The type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+        """
+        return pulumi.get(self, "alternate_contact_type")
+
+    @property
+    @pulumi.getter(name="emailAddress")
+    def email_address(self) -> pulumi.Output[str]:
+        """
+        An email address for the alternate contact.
+        """
+        return pulumi.get(self, "email_address")
+
+    @property
+    @pulumi.getter
+    def name(self) -> pulumi.Output[str]:
+        """
+        The name of the alternate contact.
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter(name="phoneNumber")
+    def phone_number(self) -> pulumi.Output[str]:
+        """
+        A phone number for the alternate contact.
+        """
+        return pulumi.get(self, "phone_number")
+
+    @property
+    @pulumi.getter
+    def title(self) -> pulumi.Output[str]:
+        """
+        A title for the alternate contact.
+        """
+        return pulumi.get(self, "title")
+
diff --git a/sdk/python/pulumi_aws/alb/get_load_balancer.py b/sdk/python/pulumi_aws/alb/get_load_balancer.py
index f9d317bd91b..a95bd7e1c38 100644
--- a/sdk/python/pulumi_aws/alb/get_load_balancer.py
+++ b/sdk/python/pulumi_aws/alb/get_load_balancer.py
@@ -21,7 +21,7 @@ class GetLoadBalancerResult:
     """
     A collection of values returned by getLoadBalancer.
     """
-    def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_owned_ipv4_pool=None, dns_name=None, drop_invalid_header_fields=None, enable_deletion_protection=None, enable_http2=None, id=None, idle_timeout=None, internal=None, ip_address_type=None, load_balancer_type=None, name=None, security_groups=None, subnet_mappings=None, subnets=None, tags=None, vpc_id=None, zone_id=None):
+    def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_owned_ipv4_pool=None, desync_mitigation_mode=None, dns_name=None, drop_invalid_header_fields=None, enable_deletion_protection=None, enable_http2=None, enable_waf_fail_open=None, id=None, idle_timeout=None, internal=None, ip_address_type=None, load_balancer_type=None, name=None, security_groups=None, subnet_mappings=None, subnets=None, tags=None, vpc_id=None, zone_id=None):
         if access_logs and not isinstance(access_logs, dict):
             raise TypeError("Expected argument 'access_logs' to be a dict")
         pulumi.set(__self__, "access_logs", access_logs)
@@ -34,6 +34,9 @@ def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_own
         if customer_owned_ipv4_pool and not isinstance(customer_owned_ipv4_pool, str):
             raise TypeError("Expected argument 'customer_owned_ipv4_pool' to be a str")
         pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode and not isinstance(desync_mitigation_mode, str):
+            raise TypeError("Expected argument 'desync_mitigation_mode' to be a str")
+        pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name and not isinstance(dns_name, str):
             raise TypeError("Expected argument 'dns_name' to be a str")
         pulumi.set(__self__, "dns_name", dns_name)
@@ -46,6 +49,9 @@ def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_own
         if enable_http2 and not isinstance(enable_http2, bool):
             raise TypeError("Expected argument 'enable_http2' to be a bool")
         pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open and not isinstance(enable_waf_fail_open, bool):
+            raise TypeError("Expected argument 'enable_waf_fail_open' to be a bool")
+        pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if id and not isinstance(id, str):
             raise TypeError("Expected argument 'id' to be a str")
         pulumi.set(__self__, "id", id)
@@ -103,6 +109,11 @@ def arn_suffix(self) -> str:
     def customer_owned_ipv4_pool(self) -> str:
         return pulumi.get(self, "customer_owned_ipv4_pool")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> str:
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> str:
@@ -123,6 +134,11 @@ def enable_deletion_protection(self) -> bool:
     def enable_http2(self) -> bool:
         return pulumi.get(self, "enable_http2")
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> bool:
+        return pulumi.get(self, "enable_waf_fail_open")
+
     @property
     @pulumi.getter
     def id(self) -> str:
@@ -197,10 +213,12 @@ def __await__(self):
             arn=self.arn,
             arn_suffix=self.arn_suffix,
             customer_owned_ipv4_pool=self.customer_owned_ipv4_pool,
+            desync_mitigation_mode=self.desync_mitigation_mode,
             dns_name=self.dns_name,
             drop_invalid_header_fields=self.drop_invalid_header_fields,
             enable_deletion_protection=self.enable_deletion_protection,
             enable_http2=self.enable_http2,
+            enable_waf_fail_open=self.enable_waf_fail_open,
             id=self.id,
             idle_timeout=self.idle_timeout,
             internal=self.internal,
@@ -265,10 +283,12 @@ def get_load_balancer(arn: Optional[str] = None,
         arn=__ret__.arn,
         arn_suffix=__ret__.arn_suffix,
         customer_owned_ipv4_pool=__ret__.customer_owned_ipv4_pool,
+        desync_mitigation_mode=__ret__.desync_mitigation_mode,
         dns_name=__ret__.dns_name,
         drop_invalid_header_fields=__ret__.drop_invalid_header_fields,
         enable_deletion_protection=__ret__.enable_deletion_protection,
         enable_http2=__ret__.enable_http2,
+        enable_waf_fail_open=__ret__.enable_waf_fail_open,
         id=__ret__.id,
         idle_timeout=__ret__.idle_timeout,
         internal=__ret__.internal,
diff --git a/sdk/python/pulumi_aws/alb/load_balancer.py b/sdk/python/pulumi_aws/alb/load_balancer.py
index af07583b54a..757eb61e9bc 100644
--- a/sdk/python/pulumi_aws/alb/load_balancer.py
+++ b/sdk/python/pulumi_aws/alb/load_balancer.py
@@ -17,10 +17,12 @@ class LoadBalancerArgs:
     def __init__(__self__, *,
                  access_logs: Optional[pulumi.Input['LoadBalancerAccessLogsArgs']] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -35,12 +37,14 @@ def __init__(__self__, *,
         The set of arguments for constructing a LoadBalancer resource.
         :param pulumi.Input['LoadBalancerAccessLogsArgs'] access_logs: An Access Logs block. Access Logs documented below.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
                This is a `network` load balancer feature. Defaults to `false`.
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -54,12 +58,14 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         if access_logs is not None:
             pulumi.set(__self__, "access_logs", access_logs)
         if customer_owned_ipv4_pool is not None:
             pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if drop_invalid_header_fields is not None:
             pulumi.set(__self__, "drop_invalid_header_fields", drop_invalid_header_fields)
         if enable_cross_zone_load_balancing is not None:
@@ -68,6 +74,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "enable_deletion_protection", enable_deletion_protection)
         if enable_http2 is not None:
             pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open is not None:
+            pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if idle_timeout is not None:
             pulumi.set(__self__, "idle_timeout", idle_timeout)
         if internal is not None:
@@ -113,6 +121,18 @@ def customer_owned_ipv4_pool(self) -> Optional[pulumi.Input[str]]:
     def customer_owned_ipv4_pool(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "customer_owned_ipv4_pool", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dropInvalidHeaderFields")
     def drop_invalid_header_fields(self) -> Optional[pulumi.Input[bool]]:
@@ -163,6 +183,18 @@ def enable_http2(self) -> Optional[pulumi.Input[bool]]:
     def enable_http2(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enable_http2", value)
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
+    @enable_waf_fail_open.setter
+    def enable_waf_fail_open(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enable_waf_fail_open", value)
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> Optional[pulumi.Input[int]]:
@@ -279,7 +311,7 @@ def subnets(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -295,11 +327,13 @@ def __init__(__self__, *,
                  arn: Optional[pulumi.Input[str]] = None,
                  arn_suffix: Optional[pulumi.Input[str]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  dns_name: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -319,6 +353,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] arn: The ARN of the load balancer (matches `id`).
         :param pulumi.Input[str] arn_suffix: The ARN suffix for use with CloudWatch Metrics.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the load balancer.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
@@ -326,6 +361,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -339,7 +375,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
         :param pulumi.Input[str] zone_id: The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
                * `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
@@ -352,6 +388,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "arn_suffix", arn_suffix)
         if customer_owned_ipv4_pool is not None:
             pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name is not None:
             pulumi.set(__self__, "dns_name", dns_name)
         if drop_invalid_header_fields is not None:
@@ -362,6 +400,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "enable_deletion_protection", enable_deletion_protection)
         if enable_http2 is not None:
             pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open is not None:
+            pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if idle_timeout is not None:
             pulumi.set(__self__, "idle_timeout", idle_timeout)
         if internal is not None:
@@ -437,6 +477,18 @@ def customer_owned_ipv4_pool(self) -> Optional[pulumi.Input[str]]:
     def customer_owned_ipv4_pool(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "customer_owned_ipv4_pool", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> Optional[pulumi.Input[str]]:
@@ -499,6 +551,18 @@ def enable_http2(self) -> Optional[pulumi.Input[bool]]:
     def enable_http2(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enable_http2", value)
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
+    @enable_waf_fail_open.setter
+    def enable_waf_fail_open(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enable_waf_fail_open", value)
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> Optional[pulumi.Input[int]]:
@@ -615,7 +679,7 @@ def subnets(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -665,10 +729,12 @@ def __init__(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_logs: Optional[pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -773,12 +839,14 @@ def __init__(__self__,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']] access_logs: An Access Logs block. Access Logs documented below.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
                This is a `network` load balancer feature. Defaults to `false`.
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -792,7 +860,7 @@ def __init__(__self__,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         ...
     @overload
@@ -906,10 +974,12 @@ def _internal_init(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_logs: Optional[pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -934,10 +1004,12 @@ def _internal_init(__self__,
 
             __props__.__dict__["access_logs"] = access_logs
             __props__.__dict__["customer_owned_ipv4_pool"] = customer_owned_ipv4_pool
+            __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
             __props__.__dict__["drop_invalid_header_fields"] = drop_invalid_header_fields
             __props__.__dict__["enable_cross_zone_load_balancing"] = enable_cross_zone_load_balancing
             __props__.__dict__["enable_deletion_protection"] = enable_deletion_protection
             __props__.__dict__["enable_http2"] = enable_http2
+            __props__.__dict__["enable_waf_fail_open"] = enable_waf_fail_open
             __props__.__dict__["idle_timeout"] = idle_timeout
             __props__.__dict__["internal"] = internal
             __props__.__dict__["ip_address_type"] = ip_address_type
@@ -970,11 +1042,13 @@ def get(resource_name: str,
             arn: Optional[pulumi.Input[str]] = None,
             arn_suffix: Optional[pulumi.Input[str]] = None,
             customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+            desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
             dns_name: Optional[pulumi.Input[str]] = None,
             drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
             enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
             enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
             enable_http2: Optional[pulumi.Input[bool]] = None,
+            enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
             idle_timeout: Optional[pulumi.Input[int]] = None,
             internal: Optional[pulumi.Input[bool]] = None,
             ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -999,6 +1073,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] arn: The ARN of the load balancer (matches `id`).
         :param pulumi.Input[str] arn_suffix: The ARN suffix for use with CloudWatch Metrics.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the load balancer.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
@@ -1006,6 +1081,7 @@ def get(resource_name: str,
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -1019,7 +1095,7 @@ def get(resource_name: str,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
         :param pulumi.Input[str] zone_id: The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
                * `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
@@ -1032,11 +1108,13 @@ def get(resource_name: str,
         __props__.__dict__["arn"] = arn
         __props__.__dict__["arn_suffix"] = arn_suffix
         __props__.__dict__["customer_owned_ipv4_pool"] = customer_owned_ipv4_pool
+        __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
         __props__.__dict__["dns_name"] = dns_name
         __props__.__dict__["drop_invalid_header_fields"] = drop_invalid_header_fields
         __props__.__dict__["enable_cross_zone_load_balancing"] = enable_cross_zone_load_balancing
         __props__.__dict__["enable_deletion_protection"] = enable_deletion_protection
         __props__.__dict__["enable_http2"] = enable_http2
+        __props__.__dict__["enable_waf_fail_open"] = enable_waf_fail_open
         __props__.__dict__["idle_timeout"] = idle_timeout
         __props__.__dict__["internal"] = internal
         __props__.__dict__["ip_address_type"] = ip_address_type
@@ -1084,6 +1162,14 @@ def customer_owned_ipv4_pool(self) -> pulumi.Output[Optional[str]]:
         """
         return pulumi.get(self, "customer_owned_ipv4_pool")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> pulumi.Output[Optional[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> pulumi.Output[str]:
@@ -1126,6 +1212,14 @@ def enable_http2(self) -> pulumi.Output[Optional[bool]]:
         """
         return pulumi.get(self, "enable_http2")
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> pulumi.Output[Optional[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> pulumi.Output[Optional[int]]:
@@ -1206,7 +1300,7 @@ def subnets(self) -> pulumi.Output[Sequence[str]]:
     @pulumi.getter
     def tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
diff --git a/sdk/python/pulumi_aws/applicationloadbalancing/get_load_balancer.py b/sdk/python/pulumi_aws/applicationloadbalancing/get_load_balancer.py
index d55952c7491..2f5a07e641b 100644
--- a/sdk/python/pulumi_aws/applicationloadbalancing/get_load_balancer.py
+++ b/sdk/python/pulumi_aws/applicationloadbalancing/get_load_balancer.py
@@ -23,7 +23,7 @@ class GetLoadBalancerResult:
     """
     A collection of values returned by getLoadBalancer.
     """
-    def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_owned_ipv4_pool=None, dns_name=None, drop_invalid_header_fields=None, enable_deletion_protection=None, enable_http2=None, id=None, idle_timeout=None, internal=None, ip_address_type=None, load_balancer_type=None, name=None, security_groups=None, subnet_mappings=None, subnets=None, tags=None, vpc_id=None, zone_id=None):
+    def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_owned_ipv4_pool=None, desync_mitigation_mode=None, dns_name=None, drop_invalid_header_fields=None, enable_deletion_protection=None, enable_http2=None, enable_waf_fail_open=None, id=None, idle_timeout=None, internal=None, ip_address_type=None, load_balancer_type=None, name=None, security_groups=None, subnet_mappings=None, subnets=None, tags=None, vpc_id=None, zone_id=None):
         if access_logs and not isinstance(access_logs, dict):
             raise TypeError("Expected argument 'access_logs' to be a dict")
         pulumi.set(__self__, "access_logs", access_logs)
@@ -36,6 +36,9 @@ def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_own
         if customer_owned_ipv4_pool and not isinstance(customer_owned_ipv4_pool, str):
             raise TypeError("Expected argument 'customer_owned_ipv4_pool' to be a str")
         pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode and not isinstance(desync_mitigation_mode, str):
+            raise TypeError("Expected argument 'desync_mitigation_mode' to be a str")
+        pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name and not isinstance(dns_name, str):
             raise TypeError("Expected argument 'dns_name' to be a str")
         pulumi.set(__self__, "dns_name", dns_name)
@@ -48,6 +51,9 @@ def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_own
         if enable_http2 and not isinstance(enable_http2, bool):
             raise TypeError("Expected argument 'enable_http2' to be a bool")
         pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open and not isinstance(enable_waf_fail_open, bool):
+            raise TypeError("Expected argument 'enable_waf_fail_open' to be a bool")
+        pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if id and not isinstance(id, str):
             raise TypeError("Expected argument 'id' to be a str")
         pulumi.set(__self__, "id", id)
@@ -105,6 +111,11 @@ def arn_suffix(self) -> str:
     def customer_owned_ipv4_pool(self) -> str:
         return pulumi.get(self, "customer_owned_ipv4_pool")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> str:
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> str:
@@ -125,6 +136,11 @@ def enable_deletion_protection(self) -> bool:
     def enable_http2(self) -> bool:
         return pulumi.get(self, "enable_http2")
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> bool:
+        return pulumi.get(self, "enable_waf_fail_open")
+
     @property
     @pulumi.getter
     def id(self) -> str:
@@ -199,10 +215,12 @@ def __await__(self):
             arn=self.arn,
             arn_suffix=self.arn_suffix,
             customer_owned_ipv4_pool=self.customer_owned_ipv4_pool,
+            desync_mitigation_mode=self.desync_mitigation_mode,
             dns_name=self.dns_name,
             drop_invalid_header_fields=self.drop_invalid_header_fields,
             enable_deletion_protection=self.enable_deletion_protection,
             enable_http2=self.enable_http2,
+            enable_waf_fail_open=self.enable_waf_fail_open,
             id=self.id,
             idle_timeout=self.idle_timeout,
             internal=self.internal,
@@ -268,10 +286,12 @@ def get_load_balancer(arn: Optional[str] = None,
         arn=__ret__.arn,
         arn_suffix=__ret__.arn_suffix,
         customer_owned_ipv4_pool=__ret__.customer_owned_ipv4_pool,
+        desync_mitigation_mode=__ret__.desync_mitigation_mode,
         dns_name=__ret__.dns_name,
         drop_invalid_header_fields=__ret__.drop_invalid_header_fields,
         enable_deletion_protection=__ret__.enable_deletion_protection,
         enable_http2=__ret__.enable_http2,
+        enable_waf_fail_open=__ret__.enable_waf_fail_open,
         id=__ret__.id,
         idle_timeout=__ret__.idle_timeout,
         internal=__ret__.internal,
diff --git a/sdk/python/pulumi_aws/applicationloadbalancing/load_balancer.py b/sdk/python/pulumi_aws/applicationloadbalancing/load_balancer.py
index 0f4366c6be8..77d82128920 100644
--- a/sdk/python/pulumi_aws/applicationloadbalancing/load_balancer.py
+++ b/sdk/python/pulumi_aws/applicationloadbalancing/load_balancer.py
@@ -17,10 +17,12 @@ class LoadBalancerArgs:
     def __init__(__self__, *,
                  access_logs: Optional[pulumi.Input['LoadBalancerAccessLogsArgs']] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -35,12 +37,14 @@ def __init__(__self__, *,
         The set of arguments for constructing a LoadBalancer resource.
         :param pulumi.Input['LoadBalancerAccessLogsArgs'] access_logs: An Access Logs block. Access Logs documented below.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
                This is a `network` load balancer feature. Defaults to `false`.
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -54,12 +58,14 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         if access_logs is not None:
             pulumi.set(__self__, "access_logs", access_logs)
         if customer_owned_ipv4_pool is not None:
             pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if drop_invalid_header_fields is not None:
             pulumi.set(__self__, "drop_invalid_header_fields", drop_invalid_header_fields)
         if enable_cross_zone_load_balancing is not None:
@@ -68,6 +74,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "enable_deletion_protection", enable_deletion_protection)
         if enable_http2 is not None:
             pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open is not None:
+            pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if idle_timeout is not None:
             pulumi.set(__self__, "idle_timeout", idle_timeout)
         if internal is not None:
@@ -113,6 +121,18 @@ def customer_owned_ipv4_pool(self) -> Optional[pulumi.Input[str]]:
     def customer_owned_ipv4_pool(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "customer_owned_ipv4_pool", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dropInvalidHeaderFields")
     def drop_invalid_header_fields(self) -> Optional[pulumi.Input[bool]]:
@@ -163,6 +183,18 @@ def enable_http2(self) -> Optional[pulumi.Input[bool]]:
     def enable_http2(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enable_http2", value)
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
+    @enable_waf_fail_open.setter
+    def enable_waf_fail_open(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enable_waf_fail_open", value)
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> Optional[pulumi.Input[int]]:
@@ -279,7 +311,7 @@ def subnets(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -295,11 +327,13 @@ def __init__(__self__, *,
                  arn: Optional[pulumi.Input[str]] = None,
                  arn_suffix: Optional[pulumi.Input[str]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  dns_name: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -319,6 +353,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] arn: The ARN of the load balancer (matches `id`).
         :param pulumi.Input[str] arn_suffix: The ARN suffix for use with CloudWatch Metrics.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the load balancer.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
@@ -326,6 +361,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -339,7 +375,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
         :param pulumi.Input[str] zone_id: The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
                * `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
@@ -352,6 +388,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "arn_suffix", arn_suffix)
         if customer_owned_ipv4_pool is not None:
             pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name is not None:
             pulumi.set(__self__, "dns_name", dns_name)
         if drop_invalid_header_fields is not None:
@@ -362,6 +400,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "enable_deletion_protection", enable_deletion_protection)
         if enable_http2 is not None:
             pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open is not None:
+            pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if idle_timeout is not None:
             pulumi.set(__self__, "idle_timeout", idle_timeout)
         if internal is not None:
@@ -437,6 +477,18 @@ def customer_owned_ipv4_pool(self) -> Optional[pulumi.Input[str]]:
     def customer_owned_ipv4_pool(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "customer_owned_ipv4_pool", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> Optional[pulumi.Input[str]]:
@@ -499,6 +551,18 @@ def enable_http2(self) -> Optional[pulumi.Input[bool]]:
     def enable_http2(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enable_http2", value)
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
+    @enable_waf_fail_open.setter
+    def enable_waf_fail_open(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enable_waf_fail_open", value)
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> Optional[pulumi.Input[int]]:
@@ -615,7 +679,7 @@ def subnets(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -670,10 +734,12 @@ def __init__(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_logs: Optional[pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -778,12 +844,14 @@ def __init__(__self__,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']] access_logs: An Access Logs block. Access Logs documented below.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
                This is a `network` load balancer feature. Defaults to `false`.
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -797,7 +865,7 @@ def __init__(__self__,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         ...
     @overload
@@ -911,10 +979,12 @@ def _internal_init(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_logs: Optional[pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -940,10 +1010,12 @@ def _internal_init(__self__,
 
             __props__.__dict__["access_logs"] = access_logs
             __props__.__dict__["customer_owned_ipv4_pool"] = customer_owned_ipv4_pool
+            __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
             __props__.__dict__["drop_invalid_header_fields"] = drop_invalid_header_fields
             __props__.__dict__["enable_cross_zone_load_balancing"] = enable_cross_zone_load_balancing
             __props__.__dict__["enable_deletion_protection"] = enable_deletion_protection
             __props__.__dict__["enable_http2"] = enable_http2
+            __props__.__dict__["enable_waf_fail_open"] = enable_waf_fail_open
             __props__.__dict__["idle_timeout"] = idle_timeout
             __props__.__dict__["internal"] = internal
             __props__.__dict__["ip_address_type"] = ip_address_type
@@ -974,11 +1046,13 @@ def get(resource_name: str,
             arn: Optional[pulumi.Input[str]] = None,
             arn_suffix: Optional[pulumi.Input[str]] = None,
             customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+            desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
             dns_name: Optional[pulumi.Input[str]] = None,
             drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
             enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
             enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
             enable_http2: Optional[pulumi.Input[bool]] = None,
+            enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
             idle_timeout: Optional[pulumi.Input[int]] = None,
             internal: Optional[pulumi.Input[bool]] = None,
             ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -1003,6 +1077,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] arn: The ARN of the load balancer (matches `id`).
         :param pulumi.Input[str] arn_suffix: The ARN suffix for use with CloudWatch Metrics.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the load balancer.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
@@ -1010,6 +1085,7 @@ def get(resource_name: str,
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -1023,7 +1099,7 @@ def get(resource_name: str,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
         :param pulumi.Input[str] zone_id: The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
                * `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
@@ -1036,11 +1112,13 @@ def get(resource_name: str,
         __props__.__dict__["arn"] = arn
         __props__.__dict__["arn_suffix"] = arn_suffix
         __props__.__dict__["customer_owned_ipv4_pool"] = customer_owned_ipv4_pool
+        __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
         __props__.__dict__["dns_name"] = dns_name
         __props__.__dict__["drop_invalid_header_fields"] = drop_invalid_header_fields
         __props__.__dict__["enable_cross_zone_load_balancing"] = enable_cross_zone_load_balancing
         __props__.__dict__["enable_deletion_protection"] = enable_deletion_protection
         __props__.__dict__["enable_http2"] = enable_http2
+        __props__.__dict__["enable_waf_fail_open"] = enable_waf_fail_open
         __props__.__dict__["idle_timeout"] = idle_timeout
         __props__.__dict__["internal"] = internal
         __props__.__dict__["ip_address_type"] = ip_address_type
@@ -1088,6 +1166,14 @@ def customer_owned_ipv4_pool(self) -> pulumi.Output[Optional[str]]:
         """
         return pulumi.get(self, "customer_owned_ipv4_pool")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> pulumi.Output[Optional[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> pulumi.Output[str]:
@@ -1130,6 +1216,14 @@ def enable_http2(self) -> pulumi.Output[Optional[bool]]:
         """
         return pulumi.get(self, "enable_http2")
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> pulumi.Output[Optional[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> pulumi.Output[Optional[int]]:
@@ -1210,7 +1304,7 @@ def subnets(self) -> pulumi.Output[Sequence[str]]:
     @pulumi.getter
     def tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
diff --git a/sdk/python/pulumi_aws/apprunner/_inputs.py b/sdk/python/pulumi_aws/apprunner/_inputs.py
index 6b3c8964f69..cd4aff6c9b7 100644
--- a/sdk/python/pulumi_aws/apprunner/_inputs.py
+++ b/sdk/python/pulumi_aws/apprunner/_inputs.py
@@ -222,32 +222,21 @@ def unhealthy_threshold(self, value: Optional[pulumi.Input[int]]):
 @pulumi.input_type
 class ServiceInstanceConfigurationArgs:
     def __init__(__self__, *,
-                 instance_role_arn: pulumi.Input[str],
                  cpu: Optional[pulumi.Input[str]] = None,
+                 instance_role_arn: Optional[pulumi.Input[str]] = None,
                  memory: Optional[pulumi.Input[str]] = None):
         """
-        :param pulumi.Input[str] instance_role_arn: The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
         :param pulumi.Input[str] cpu: The number of CPU units reserved for each instance of your App Runner service represented as a String. Defaults to `1024`. Valid values: `1024|2048|(1|2) vCPU`.
+        :param pulumi.Input[str] instance_role_arn: The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
         :param pulumi.Input[str] memory: The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
         """
-        pulumi.set(__self__, "instance_role_arn", instance_role_arn)
         if cpu is not None:
             pulumi.set(__self__, "cpu", cpu)
+        if instance_role_arn is not None:
+            pulumi.set(__self__, "instance_role_arn", instance_role_arn)
         if memory is not None:
             pulumi.set(__self__, "memory", memory)
 
-    @property
-    @pulumi.getter(name="instanceRoleArn")
-    def instance_role_arn(self) -> pulumi.Input[str]:
-        """
-        The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
-        """
-        return pulumi.get(self, "instance_role_arn")
-
-    @instance_role_arn.setter
-    def instance_role_arn(self, value: pulumi.Input[str]):
-        pulumi.set(self, "instance_role_arn", value)
-
     @property
     @pulumi.getter
     def cpu(self) -> Optional[pulumi.Input[str]]:
@@ -260,6 +249,18 @@ def cpu(self) -> Optional[pulumi.Input[str]]:
     def cpu(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "cpu", value)
 
+    @property
+    @pulumi.getter(name="instanceRoleArn")
+    def instance_role_arn(self) -> Optional[pulumi.Input[str]]:
+        """
+        The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
+        """
+        return pulumi.get(self, "instance_role_arn")
+
+    @instance_role_arn.setter
+    def instance_role_arn(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "instance_role_arn", value)
+
     @property
     @pulumi.getter
     def memory(self) -> Optional[pulumi.Input[str]]:
diff --git a/sdk/python/pulumi_aws/apprunner/outputs.py b/sdk/python/pulumi_aws/apprunner/outputs.py
index 2d83de00837..931b83ce2ae 100644
--- a/sdk/python/pulumi_aws/apprunner/outputs.py
+++ b/sdk/python/pulumi_aws/apprunner/outputs.py
@@ -232,28 +232,21 @@ def get(self, key: str, default = None) -> Any:
         return super().get(key, default)
 
     def __init__(__self__, *,
-                 instance_role_arn: str,
                  cpu: Optional[str] = None,
+                 instance_role_arn: Optional[str] = None,
                  memory: Optional[str] = None):
         """
-        :param str instance_role_arn: The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
         :param str cpu: The number of CPU units reserved for each instance of your App Runner service represented as a String. Defaults to `1024`. Valid values: `1024|2048|(1|2) vCPU`.
+        :param str instance_role_arn: The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
         :param str memory: The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
         """
-        pulumi.set(__self__, "instance_role_arn", instance_role_arn)
         if cpu is not None:
             pulumi.set(__self__, "cpu", cpu)
+        if instance_role_arn is not None:
+            pulumi.set(__self__, "instance_role_arn", instance_role_arn)
         if memory is not None:
             pulumi.set(__self__, "memory", memory)
 
-    @property
-    @pulumi.getter(name="instanceRoleArn")
-    def instance_role_arn(self) -> str:
-        """
-        The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
-        """
-        return pulumi.get(self, "instance_role_arn")
-
     @property
     @pulumi.getter
     def cpu(self) -> Optional[str]:
@@ -262,6 +255,14 @@ def cpu(self) -> Optional[str]:
         """
         return pulumi.get(self, "cpu")
 
+    @property
+    @pulumi.getter(name="instanceRoleArn")
+    def instance_role_arn(self) -> Optional[str]:
+        """
+        The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
+        """
+        return pulumi.get(self, "instance_role_arn")
+
     @property
     @pulumi.getter
     def memory(self) -> Optional[str]:
diff --git a/sdk/python/pulumi_aws/appstream/__init__.py b/sdk/python/pulumi_aws/appstream/__init__.py
index 224da5886b9..bf4e931afbd 100644
--- a/sdk/python/pulumi_aws/appstream/__init__.py
+++ b/sdk/python/pulumi_aws/appstream/__init__.py
@@ -7,7 +7,10 @@
 # Export this package's modules as members:
 from .directory_config import *
 from .fleet import *
+from .fleet_stack_association import *
 from .image_builder import *
 from .stack import *
+from .user import *
+from .user_stack_association import *
 from ._inputs import *
 from . import outputs
diff --git a/sdk/python/pulumi_aws/appstream/fleet_stack_association.py b/sdk/python/pulumi_aws/appstream/fleet_stack_association.py
new file mode 100644
index 00000000000..0cd63c6c6b3
--- /dev/null
+++ b/sdk/python/pulumi_aws/appstream/fleet_stack_association.py
@@ -0,0 +1,248 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from .. import _utilities
+
+__all__ = ['FleetStackAssociationArgs', 'FleetStackAssociation']
+
+@pulumi.input_type
+class FleetStackAssociationArgs:
+    def __init__(__self__, *,
+                 fleet_name: pulumi.Input[str],
+                 stack_name: pulumi.Input[str]):
+        """
+        The set of arguments for constructing a FleetStackAssociation resource.
+        :param pulumi.Input[str] fleet_name: Name of the fleet.
+        :param pulumi.Input[str] stack_name: Name of the stack.
+        """
+        pulumi.set(__self__, "fleet_name", fleet_name)
+        pulumi.set(__self__, "stack_name", stack_name)
+
+    @property
+    @pulumi.getter(name="fleetName")
+    def fleet_name(self) -> pulumi.Input[str]:
+        """
+        Name of the fleet.
+        """
+        return pulumi.get(self, "fleet_name")
+
+    @fleet_name.setter
+    def fleet_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "fleet_name", value)
+
+    @property
+    @pulumi.getter(name="stackName")
+    def stack_name(self) -> pulumi.Input[str]:
+        """
+        Name of the stack.
+        """
+        return pulumi.get(self, "stack_name")
+
+    @stack_name.setter
+    def stack_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "stack_name", value)
+
+
+@pulumi.input_type
+class _FleetStackAssociationState:
+    def __init__(__self__, *,
+                 fleet_name: Optional[pulumi.Input[str]] = None,
+                 stack_name: Optional[pulumi.Input[str]] = None):
+        """
+        Input properties used for looking up and filtering FleetStackAssociation resources.
+        :param pulumi.Input[str] fleet_name: Name of the fleet.
+        :param pulumi.Input[str] stack_name: Name of the stack.
+        """
+        if fleet_name is not None:
+            pulumi.set(__self__, "fleet_name", fleet_name)
+        if stack_name is not None:
+            pulumi.set(__self__, "stack_name", stack_name)
+
+    @property
+    @pulumi.getter(name="fleetName")
+    def fleet_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Name of the fleet.
+        """
+        return pulumi.get(self, "fleet_name")
+
+    @fleet_name.setter
+    def fleet_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "fleet_name", value)
+
+    @property
+    @pulumi.getter(name="stackName")
+    def stack_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Name of the stack.
+        """
+        return pulumi.get(self, "stack_name")
+
+    @stack_name.setter
+    def stack_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "stack_name", value)
+
+
+class FleetStackAssociation(pulumi.CustomResource):
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 fleet_name: Optional[pulumi.Input[str]] = None,
+                 stack_name: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        """
+        Manages an AppStream Fleet Stack association.
+
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        example_fleet = aws.appstream.Fleet("exampleFleet",
+            image_name="Amazon-AppStream2-Sample-Image-02-04-2019",
+            instance_type="stream.standard.small",
+            compute_capacity=aws.appstream.FleetComputeCapacityArgs(
+                desired_instances=1,
+            ))
+        example_stack = aws.appstream.Stack("exampleStack")
+        example_fleet_stack_association = aws.appstream.FleetStackAssociation("exampleFleetStackAssociation",
+            fleet_name=example_fleet.name,
+            stack_name=example_stack.name)
+        ```
+
+        ## Import
+
+        AppStream Stack Fleet Association can be imported by using the `fleet_name` and `stack_name` separated by a slash (`/`), e.g.,
+
+        ```sh
+         $ pulumi import aws:appstream/fleetStackAssociation:FleetStackAssociation example fleetName/stackName
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] fleet_name: Name of the fleet.
+        :param pulumi.Input[str] stack_name: Name of the stack.
+        """
+        ...
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 args: FleetStackAssociationArgs,
+                 opts: Optional[pulumi.ResourceOptions] = None):
+        """
+        Manages an AppStream Fleet Stack association.
+
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        example_fleet = aws.appstream.Fleet("exampleFleet",
+            image_name="Amazon-AppStream2-Sample-Image-02-04-2019",
+            instance_type="stream.standard.small",
+            compute_capacity=aws.appstream.FleetComputeCapacityArgs(
+                desired_instances=1,
+            ))
+        example_stack = aws.appstream.Stack("exampleStack")
+        example_fleet_stack_association = aws.appstream.FleetStackAssociation("exampleFleetStackAssociation",
+            fleet_name=example_fleet.name,
+            stack_name=example_stack.name)
+        ```
+
+        ## Import
+
+        AppStream Stack Fleet Association can be imported by using the `fleet_name` and `stack_name` separated by a slash (`/`), e.g.,
+
+        ```sh
+         $ pulumi import aws:appstream/fleetStackAssociation:FleetStackAssociation example fleetName/stackName
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param FleetStackAssociationArgs args: The arguments to use to populate this resource's properties.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        """
+        ...
+    def __init__(__self__, resource_name: str, *args, **kwargs):
+        resource_args, opts = _utilities.get_resource_args_opts(FleetStackAssociationArgs, pulumi.ResourceOptions, *args, **kwargs)
+        if resource_args is not None:
+            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
+        else:
+            __self__._internal_init(resource_name, *args, **kwargs)
+
+    def _internal_init(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 fleet_name: Optional[pulumi.Input[str]] = None,
+                 stack_name: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        if opts is None:
+            opts = pulumi.ResourceOptions()
+        if not isinstance(opts, pulumi.ResourceOptions):
+            raise TypeError('Expected resource options to be a ResourceOptions instance')
+        if opts.version is None:
+            opts.version = _utilities.get_version()
+        if opts.id is None:
+            if __props__ is not None:
+                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
+            __props__ = FleetStackAssociationArgs.__new__(FleetStackAssociationArgs)
+
+            if fleet_name is None and not opts.urn:
+                raise TypeError("Missing required property 'fleet_name'")
+            __props__.__dict__["fleet_name"] = fleet_name
+            if stack_name is None and not opts.urn:
+                raise TypeError("Missing required property 'stack_name'")
+            __props__.__dict__["stack_name"] = stack_name
+        super(FleetStackAssociation, __self__).__init__(
+            'aws:appstream/fleetStackAssociation:FleetStackAssociation',
+            resource_name,
+            __props__,
+            opts)
+
+    @staticmethod
+    def get(resource_name: str,
+            id: pulumi.Input[str],
+            opts: Optional[pulumi.ResourceOptions] = None,
+            fleet_name: Optional[pulumi.Input[str]] = None,
+            stack_name: Optional[pulumi.Input[str]] = None) -> 'FleetStackAssociation':
+        """
+        Get an existing FleetStackAssociation resource's state with the given name, id, and optional extra
+        properties used to qualify the lookup.
+
+        :param str resource_name: The unique name of the resulting resource.
+        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] fleet_name: Name of the fleet.
+        :param pulumi.Input[str] stack_name: Name of the stack.
+        """
+        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
+
+        __props__ = _FleetStackAssociationState.__new__(_FleetStackAssociationState)
+
+        __props__.__dict__["fleet_name"] = fleet_name
+        __props__.__dict__["stack_name"] = stack_name
+        return FleetStackAssociation(resource_name, opts=opts, __props__=__props__)
+
+    @property
+    @pulumi.getter(name="fleetName")
+    def fleet_name(self) -> pulumi.Output[str]:
+        """
+        Name of the fleet.
+        """
+        return pulumi.get(self, "fleet_name")
+
+    @property
+    @pulumi.getter(name="stackName")
+    def stack_name(self) -> pulumi.Output[str]:
+        """
+        Name of the stack.
+        """
+        return pulumi.get(self, "stack_name")
+
diff --git a/sdk/python/pulumi_aws/appstream/user.py b/sdk/python/pulumi_aws/appstream/user.py
new file mode 100644
index 00000000000..21f2d2ad360
--- /dev/null
+++ b/sdk/python/pulumi_aws/appstream/user.py
@@ -0,0 +1,482 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from .. import _utilities
+
+__all__ = ['UserArgs', 'User']
+
+@pulumi.input_type
+class UserArgs:
+    def __init__(__self__, *,
+                 authentication_type: pulumi.Input[str],
+                 user_name: pulumi.Input[str],
+                 enabled: Optional[pulumi.Input[bool]] = None,
+                 first_name: Optional[pulumi.Input[str]] = None,
+                 last_name: Optional[pulumi.Input[str]] = None,
+                 send_email_notification: Optional[pulumi.Input[bool]] = None):
+        """
+        The set of arguments for constructing a User resource.
+        :param pulumi.Input[str] authentication_type: Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        :param pulumi.Input[str] user_name: Email address of the user.
+        :param pulumi.Input[bool] enabled: Specifies whether the user in the user pool is enabled.
+        :param pulumi.Input[str] first_name: First name, or given name, of the user.
+        :param pulumi.Input[str] last_name: Last name, or surname, of the user.
+        :param pulumi.Input[bool] send_email_notification: Send an email notification.
+        """
+        pulumi.set(__self__, "authentication_type", authentication_type)
+        pulumi.set(__self__, "user_name", user_name)
+        if enabled is not None:
+            pulumi.set(__self__, "enabled", enabled)
+        if first_name is not None:
+            pulumi.set(__self__, "first_name", first_name)
+        if last_name is not None:
+            pulumi.set(__self__, "last_name", last_name)
+        if send_email_notification is not None:
+            pulumi.set(__self__, "send_email_notification", send_email_notification)
+
+    @property
+    @pulumi.getter(name="authenticationType")
+    def authentication_type(self) -> pulumi.Input[str]:
+        """
+        Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        """
+        return pulumi.get(self, "authentication_type")
+
+    @authentication_type.setter
+    def authentication_type(self, value: pulumi.Input[str]):
+        pulumi.set(self, "authentication_type", value)
+
+    @property
+    @pulumi.getter(name="userName")
+    def user_name(self) -> pulumi.Input[str]:
+        """
+        Email address of the user.
+        """
+        return pulumi.get(self, "user_name")
+
+    @user_name.setter
+    def user_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "user_name", value)
+
+    @property
+    @pulumi.getter
+    def enabled(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Specifies whether the user in the user pool is enabled.
+        """
+        return pulumi.get(self, "enabled")
+
+    @enabled.setter
+    def enabled(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enabled", value)
+
+    @property
+    @pulumi.getter(name="firstName")
+    def first_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        First name, or given name, of the user.
+        """
+        return pulumi.get(self, "first_name")
+
+    @first_name.setter
+    def first_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "first_name", value)
+
+    @property
+    @pulumi.getter(name="lastName")
+    def last_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Last name, or surname, of the user.
+        """
+        return pulumi.get(self, "last_name")
+
+    @last_name.setter
+    def last_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "last_name", value)
+
+    @property
+    @pulumi.getter(name="sendEmailNotification")
+    def send_email_notification(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Send an email notification.
+        """
+        return pulumi.get(self, "send_email_notification")
+
+    @send_email_notification.setter
+    def send_email_notification(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "send_email_notification", value)
+
+
+@pulumi.input_type
+class _UserState:
+    def __init__(__self__, *,
+                 arn: Optional[pulumi.Input[str]] = None,
+                 authentication_type: Optional[pulumi.Input[str]] = None,
+                 created_time: Optional[pulumi.Input[str]] = None,
+                 enabled: Optional[pulumi.Input[bool]] = None,
+                 first_name: Optional[pulumi.Input[str]] = None,
+                 last_name: Optional[pulumi.Input[str]] = None,
+                 send_email_notification: Optional[pulumi.Input[bool]] = None,
+                 user_name: Optional[pulumi.Input[str]] = None):
+        """
+        Input properties used for looking up and filtering User resources.
+        :param pulumi.Input[str] arn: ARN of the appstream user.
+        :param pulumi.Input[str] authentication_type: Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        :param pulumi.Input[str] created_time: Date and time, in UTC and extended RFC 3339 format, when the user was created.
+        :param pulumi.Input[bool] enabled: Specifies whether the user in the user pool is enabled.
+        :param pulumi.Input[str] first_name: First name, or given name, of the user.
+        :param pulumi.Input[str] last_name: Last name, or surname, of the user.
+        :param pulumi.Input[bool] send_email_notification: Send an email notification.
+        :param pulumi.Input[str] user_name: Email address of the user.
+        """
+        if arn is not None:
+            pulumi.set(__self__, "arn", arn)
+        if authentication_type is not None:
+            pulumi.set(__self__, "authentication_type", authentication_type)
+        if created_time is not None:
+            pulumi.set(__self__, "created_time", created_time)
+        if enabled is not None:
+            pulumi.set(__self__, "enabled", enabled)
+        if first_name is not None:
+            pulumi.set(__self__, "first_name", first_name)
+        if last_name is not None:
+            pulumi.set(__self__, "last_name", last_name)
+        if send_email_notification is not None:
+            pulumi.set(__self__, "send_email_notification", send_email_notification)
+        if user_name is not None:
+            pulumi.set(__self__, "user_name", user_name)
+
+    @property
+    @pulumi.getter
+    def arn(self) -> Optional[pulumi.Input[str]]:
+        """
+        ARN of the appstream user.
+        """
+        return pulumi.get(self, "arn")
+
+    @arn.setter
+    def arn(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "arn", value)
+
+    @property
+    @pulumi.getter(name="authenticationType")
+    def authentication_type(self) -> Optional[pulumi.Input[str]]:
+        """
+        Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        """
+        return pulumi.get(self, "authentication_type")
+
+    @authentication_type.setter
+    def authentication_type(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "authentication_type", value)
+
+    @property
+    @pulumi.getter(name="createdTime")
+    def created_time(self) -> Optional[pulumi.Input[str]]:
+        """
+        Date and time, in UTC and extended RFC 3339 format, when the user was created.
+        """
+        return pulumi.get(self, "created_time")
+
+    @created_time.setter
+    def created_time(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "created_time", value)
+
+    @property
+    @pulumi.getter
+    def enabled(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Specifies whether the user in the user pool is enabled.
+        """
+        return pulumi.get(self, "enabled")
+
+    @enabled.setter
+    def enabled(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enabled", value)
+
+    @property
+    @pulumi.getter(name="firstName")
+    def first_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        First name, or given name, of the user.
+        """
+        return pulumi.get(self, "first_name")
+
+    @first_name.setter
+    def first_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "first_name", value)
+
+    @property
+    @pulumi.getter(name="lastName")
+    def last_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Last name, or surname, of the user.
+        """
+        return pulumi.get(self, "last_name")
+
+    @last_name.setter
+    def last_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "last_name", value)
+
+    @property
+    @pulumi.getter(name="sendEmailNotification")
+    def send_email_notification(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Send an email notification.
+        """
+        return pulumi.get(self, "send_email_notification")
+
+    @send_email_notification.setter
+    def send_email_notification(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "send_email_notification", value)
+
+    @property
+    @pulumi.getter(name="userName")
+    def user_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Email address of the user.
+        """
+        return pulumi.get(self, "user_name")
+
+    @user_name.setter
+    def user_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "user_name", value)
+
+
+class User(pulumi.CustomResource):
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 authentication_type: Optional[pulumi.Input[str]] = None,
+                 enabled: Optional[pulumi.Input[bool]] = None,
+                 first_name: Optional[pulumi.Input[str]] = None,
+                 last_name: Optional[pulumi.Input[str]] = None,
+                 send_email_notification: Optional[pulumi.Input[bool]] = None,
+                 user_name: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        """
+        Provides an AppStream user.
+
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        example = aws.appstream.User("example",
+            authentication_type="USERPOOL",
+            first_name="FIRST NAME",
+            last_name="LAST NAME",
+            user_name="EMAIL ADDRESS")
+        ```
+
+        ## Import
+
+        `aws_appstream_user` can be imported using the `user_name` and `authentication_type` separated by a slash (`/`), e.g.,
+
+        ```sh
+         $ pulumi import aws:appstream/user:User example UserName/AuthenticationType
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] authentication_type: Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        :param pulumi.Input[bool] enabled: Specifies whether the user in the user pool is enabled.
+        :param pulumi.Input[str] first_name: First name, or given name, of the user.
+        :param pulumi.Input[str] last_name: Last name, or surname, of the user.
+        :param pulumi.Input[bool] send_email_notification: Send an email notification.
+        :param pulumi.Input[str] user_name: Email address of the user.
+        """
+        ...
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 args: UserArgs,
+                 opts: Optional[pulumi.ResourceOptions] = None):
+        """
+        Provides an AppStream user.
+
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        example = aws.appstream.User("example",
+            authentication_type="USERPOOL",
+            first_name="FIRST NAME",
+            last_name="LAST NAME",
+            user_name="EMAIL ADDRESS")
+        ```
+
+        ## Import
+
+        `aws_appstream_user` can be imported using the `user_name` and `authentication_type` separated by a slash (`/`), e.g.,
+
+        ```sh
+         $ pulumi import aws:appstream/user:User example UserName/AuthenticationType
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param UserArgs args: The arguments to use to populate this resource's properties.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        """
+        ...
+    def __init__(__self__, resource_name: str, *args, **kwargs):
+        resource_args, opts = _utilities.get_resource_args_opts(UserArgs, pulumi.ResourceOptions, *args, **kwargs)
+        if resource_args is not None:
+            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
+        else:
+            __self__._internal_init(resource_name, *args, **kwargs)
+
+    def _internal_init(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 authentication_type: Optional[pulumi.Input[str]] = None,
+                 enabled: Optional[pulumi.Input[bool]] = None,
+                 first_name: Optional[pulumi.Input[str]] = None,
+                 last_name: Optional[pulumi.Input[str]] = None,
+                 send_email_notification: Optional[pulumi.Input[bool]] = None,
+                 user_name: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        if opts is None:
+            opts = pulumi.ResourceOptions()
+        if not isinstance(opts, pulumi.ResourceOptions):
+            raise TypeError('Expected resource options to be a ResourceOptions instance')
+        if opts.version is None:
+            opts.version = _utilities.get_version()
+        if opts.id is None:
+            if __props__ is not None:
+                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
+            __props__ = UserArgs.__new__(UserArgs)
+
+            if authentication_type is None and not opts.urn:
+                raise TypeError("Missing required property 'authentication_type'")
+            __props__.__dict__["authentication_type"] = authentication_type
+            __props__.__dict__["enabled"] = enabled
+            __props__.__dict__["first_name"] = first_name
+            __props__.__dict__["last_name"] = last_name
+            __props__.__dict__["send_email_notification"] = send_email_notification
+            if user_name is None and not opts.urn:
+                raise TypeError("Missing required property 'user_name'")
+            __props__.__dict__["user_name"] = user_name
+            __props__.__dict__["arn"] = None
+            __props__.__dict__["created_time"] = None
+        super(User, __self__).__init__(
+            'aws:appstream/user:User',
+            resource_name,
+            __props__,
+            opts)
+
+    @staticmethod
+    def get(resource_name: str,
+            id: pulumi.Input[str],
+            opts: Optional[pulumi.ResourceOptions] = None,
+            arn: Optional[pulumi.Input[str]] = None,
+            authentication_type: Optional[pulumi.Input[str]] = None,
+            created_time: Optional[pulumi.Input[str]] = None,
+            enabled: Optional[pulumi.Input[bool]] = None,
+            first_name: Optional[pulumi.Input[str]] = None,
+            last_name: Optional[pulumi.Input[str]] = None,
+            send_email_notification: Optional[pulumi.Input[bool]] = None,
+            user_name: Optional[pulumi.Input[str]] = None) -> 'User':
+        """
+        Get an existing User resource's state with the given name, id, and optional extra
+        properties used to qualify the lookup.
+
+        :param str resource_name: The unique name of the resulting resource.
+        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] arn: ARN of the appstream user.
+        :param pulumi.Input[str] authentication_type: Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        :param pulumi.Input[str] created_time: Date and time, in UTC and extended RFC 3339 format, when the user was created.
+        :param pulumi.Input[bool] enabled: Specifies whether the user in the user pool is enabled.
+        :param pulumi.Input[str] first_name: First name, or given name, of the user.
+        :param pulumi.Input[str] last_name: Last name, or surname, of the user.
+        :param pulumi.Input[bool] send_email_notification: Send an email notification.
+        :param pulumi.Input[str] user_name: Email address of the user.
+        """
+        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
+
+        __props__ = _UserState.__new__(_UserState)
+
+        __props__.__dict__["arn"] = arn
+        __props__.__dict__["authentication_type"] = authentication_type
+        __props__.__dict__["created_time"] = created_time
+        __props__.__dict__["enabled"] = enabled
+        __props__.__dict__["first_name"] = first_name
+        __props__.__dict__["last_name"] = last_name
+        __props__.__dict__["send_email_notification"] = send_email_notification
+        __props__.__dict__["user_name"] = user_name
+        return User(resource_name, opts=opts, __props__=__props__)
+
+    @property
+    @pulumi.getter
+    def arn(self) -> pulumi.Output[str]:
+        """
+        ARN of the appstream user.
+        """
+        return pulumi.get(self, "arn")
+
+    @property
+    @pulumi.getter(name="authenticationType")
+    def authentication_type(self) -> pulumi.Output[str]:
+        """
+        Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+        """
+        return pulumi.get(self, "authentication_type")
+
+    @property
+    @pulumi.getter(name="createdTime")
+    def created_time(self) -> pulumi.Output[str]:
+        """
+        Date and time, in UTC and extended RFC 3339 format, when the user was created.
+        """
+        return pulumi.get(self, "created_time")
+
+    @property
+    @pulumi.getter
+    def enabled(self) -> pulumi.Output[Optional[bool]]:
+        """
+        Specifies whether the user in the user pool is enabled.
+        """
+        return pulumi.get(self, "enabled")
+
+    @property
+    @pulumi.getter(name="firstName")
+    def first_name(self) -> pulumi.Output[Optional[str]]:
+        """
+        First name, or given name, of the user.
+        """
+        return pulumi.get(self, "first_name")
+
+    @property
+    @pulumi.getter(name="lastName")
+    def last_name(self) -> pulumi.Output[Optional[str]]:
+        """
+        Last name, or surname, of the user.
+        """
+        return pulumi.get(self, "last_name")
+
+    @property
+    @pulumi.getter(name="sendEmailNotification")
+    def send_email_notification(self) -> pulumi.Output[Optional[bool]]:
+        """
+        Send an email notification.
+        """
+        return pulumi.get(self, "send_email_notification")
+
+    @property
+    @pulumi.getter(name="userName")
+    def user_name(self) -> pulumi.Output[str]:
+        """
+        Email address of the user.
+        """
+        return pulumi.get(self, "user_name")
+
diff --git a/sdk/python/pulumi_aws/appstream/user_stack_association.py b/sdk/python/pulumi_aws/appstream/user_stack_association.py
new file mode 100644
index 00000000000..58883202b03
--- /dev/null
+++ b/sdk/python/pulumi_aws/appstream/user_stack_association.py
@@ -0,0 +1,339 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from .. import _utilities
+
+__all__ = ['UserStackAssociationArgs', 'UserStackAssociation']
+
+@pulumi.input_type
+class UserStackAssociationArgs:
+    def __init__(__self__, *,
+                 authentication_type: pulumi.Input[str],
+                 stack_name: pulumi.Input[str],
+                 user_name: pulumi.Input[str],
+                 send_email_notification: Optional[pulumi.Input[bool]] = None):
+        """
+        The set of arguments for constructing a UserStackAssociation resource.
+        :param pulumi.Input[str] authentication_type: Authentication type for the user.
+        :param pulumi.Input[str] stack_name: Name of the stack that is associated with the user.
+        :param pulumi.Input[str] user_name: Email address of the user who is associated with the stack.
+        :param pulumi.Input[bool] send_email_notification: Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        """
+        pulumi.set(__self__, "authentication_type", authentication_type)
+        pulumi.set(__self__, "stack_name", stack_name)
+        pulumi.set(__self__, "user_name", user_name)
+        if send_email_notification is not None:
+            pulumi.set(__self__, "send_email_notification", send_email_notification)
+
+    @property
+    @pulumi.getter(name="authenticationType")
+    def authentication_type(self) -> pulumi.Input[str]:
+        """
+        Authentication type for the user.
+        """
+        return pulumi.get(self, "authentication_type")
+
+    @authentication_type.setter
+    def authentication_type(self, value: pulumi.Input[str]):
+        pulumi.set(self, "authentication_type", value)
+
+    @property
+    @pulumi.getter(name="stackName")
+    def stack_name(self) -> pulumi.Input[str]:
+        """
+        Name of the stack that is associated with the user.
+        """
+        return pulumi.get(self, "stack_name")
+
+    @stack_name.setter
+    def stack_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "stack_name", value)
+
+    @property
+    @pulumi.getter(name="userName")
+    def user_name(self) -> pulumi.Input[str]:
+        """
+        Email address of the user who is associated with the stack.
+        """
+        return pulumi.get(self, "user_name")
+
+    @user_name.setter
+    def user_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "user_name", value)
+
+    @property
+    @pulumi.getter(name="sendEmailNotification")
+    def send_email_notification(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        """
+        return pulumi.get(self, "send_email_notification")
+
+    @send_email_notification.setter
+    def send_email_notification(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "send_email_notification", value)
+
+
+@pulumi.input_type
+class _UserStackAssociationState:
+    def __init__(__self__, *,
+                 authentication_type: Optional[pulumi.Input[str]] = None,
+                 send_email_notification: Optional[pulumi.Input[bool]] = None,
+                 stack_name: Optional[pulumi.Input[str]] = None,
+                 user_name: Optional[pulumi.Input[str]] = None):
+        """
+        Input properties used for looking up and filtering UserStackAssociation resources.
+        :param pulumi.Input[str] authentication_type: Authentication type for the user.
+        :param pulumi.Input[bool] send_email_notification: Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        :param pulumi.Input[str] stack_name: Name of the stack that is associated with the user.
+        :param pulumi.Input[str] user_name: Email address of the user who is associated with the stack.
+        """
+        if authentication_type is not None:
+            pulumi.set(__self__, "authentication_type", authentication_type)
+        if send_email_notification is not None:
+            pulumi.set(__self__, "send_email_notification", send_email_notification)
+        if stack_name is not None:
+            pulumi.set(__self__, "stack_name", stack_name)
+        if user_name is not None:
+            pulumi.set(__self__, "user_name", user_name)
+
+    @property
+    @pulumi.getter(name="authenticationType")
+    def authentication_type(self) -> Optional[pulumi.Input[str]]:
+        """
+        Authentication type for the user.
+        """
+        return pulumi.get(self, "authentication_type")
+
+    @authentication_type.setter
+    def authentication_type(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "authentication_type", value)
+
+    @property
+    @pulumi.getter(name="sendEmailNotification")
+    def send_email_notification(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        """
+        return pulumi.get(self, "send_email_notification")
+
+    @send_email_notification.setter
+    def send_email_notification(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "send_email_notification", value)
+
+    @property
+    @pulumi.getter(name="stackName")
+    def stack_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Name of the stack that is associated with the user.
+        """
+        return pulumi.get(self, "stack_name")
+
+    @stack_name.setter
+    def stack_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "stack_name", value)
+
+    @property
+    @pulumi.getter(name="userName")
+    def user_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Email address of the user who is associated with the stack.
+        """
+        return pulumi.get(self, "user_name")
+
+    @user_name.setter
+    def user_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "user_name", value)
+
+
+class UserStackAssociation(pulumi.CustomResource):
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 authentication_type: Optional[pulumi.Input[str]] = None,
+                 send_email_notification: Optional[pulumi.Input[bool]] = None,
+                 stack_name: Optional[pulumi.Input[str]] = None,
+                 user_name: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        """
+        Manages an AppStream User Stack association.
+
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test_stack = aws.appstream.Stack("testStack")
+        test_user = aws.appstream.User("testUser",
+            authentication_type="USERPOOL",
+            user_name="EMAIL")
+        test_user_stack_association = aws.appstream.UserStackAssociation("testUserStackAssociation",
+            authentication_type=test_user.authentication_type,
+            stack_name=test_stack.name,
+            user_name=test_user.user_name)
+        ```
+
+        ## Import
+
+        AppStream User Stack Association can be imported by using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`), e.g.,
+
+        ```sh
+         $ pulumi import aws:appstream/userStackAssociation:UserStackAssociation example userName/auhtenticationType/stackName
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] authentication_type: Authentication type for the user.
+        :param pulumi.Input[bool] send_email_notification: Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        :param pulumi.Input[str] stack_name: Name of the stack that is associated with the user.
+        :param pulumi.Input[str] user_name: Email address of the user who is associated with the stack.
+        """
+        ...
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 args: UserStackAssociationArgs,
+                 opts: Optional[pulumi.ResourceOptions] = None):
+        """
+        Manages an AppStream User Stack association.
+
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test_stack = aws.appstream.Stack("testStack")
+        test_user = aws.appstream.User("testUser",
+            authentication_type="USERPOOL",
+            user_name="EMAIL")
+        test_user_stack_association = aws.appstream.UserStackAssociation("testUserStackAssociation",
+            authentication_type=test_user.authentication_type,
+            stack_name=test_stack.name,
+            user_name=test_user.user_name)
+        ```
+
+        ## Import
+
+        AppStream User Stack Association can be imported by using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`), e.g.,
+
+        ```sh
+         $ pulumi import aws:appstream/userStackAssociation:UserStackAssociation example userName/auhtenticationType/stackName
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param UserStackAssociationArgs args: The arguments to use to populate this resource's properties.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        """
+        ...
+    def __init__(__self__, resource_name: str, *args, **kwargs):
+        resource_args, opts = _utilities.get_resource_args_opts(UserStackAssociationArgs, pulumi.ResourceOptions, *args, **kwargs)
+        if resource_args is not None:
+            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
+        else:
+            __self__._internal_init(resource_name, *args, **kwargs)
+
+    def _internal_init(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 authentication_type: Optional[pulumi.Input[str]] = None,
+                 send_email_notification: Optional[pulumi.Input[bool]] = None,
+                 stack_name: Optional[pulumi.Input[str]] = None,
+                 user_name: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        if opts is None:
+            opts = pulumi.ResourceOptions()
+        if not isinstance(opts, pulumi.ResourceOptions):
+            raise TypeError('Expected resource options to be a ResourceOptions instance')
+        if opts.version is None:
+            opts.version = _utilities.get_version()
+        if opts.id is None:
+            if __props__ is not None:
+                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
+            __props__ = UserStackAssociationArgs.__new__(UserStackAssociationArgs)
+
+            if authentication_type is None and not opts.urn:
+                raise TypeError("Missing required property 'authentication_type'")
+            __props__.__dict__["authentication_type"] = authentication_type
+            __props__.__dict__["send_email_notification"] = send_email_notification
+            if stack_name is None and not opts.urn:
+                raise TypeError("Missing required property 'stack_name'")
+            __props__.__dict__["stack_name"] = stack_name
+            if user_name is None and not opts.urn:
+                raise TypeError("Missing required property 'user_name'")
+            __props__.__dict__["user_name"] = user_name
+        super(UserStackAssociation, __self__).__init__(
+            'aws:appstream/userStackAssociation:UserStackAssociation',
+            resource_name,
+            __props__,
+            opts)
+
+    @staticmethod
+    def get(resource_name: str,
+            id: pulumi.Input[str],
+            opts: Optional[pulumi.ResourceOptions] = None,
+            authentication_type: Optional[pulumi.Input[str]] = None,
+            send_email_notification: Optional[pulumi.Input[bool]] = None,
+            stack_name: Optional[pulumi.Input[str]] = None,
+            user_name: Optional[pulumi.Input[str]] = None) -> 'UserStackAssociation':
+        """
+        Get an existing UserStackAssociation resource's state with the given name, id, and optional extra
+        properties used to qualify the lookup.
+
+        :param str resource_name: The unique name of the resulting resource.
+        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] authentication_type: Authentication type for the user.
+        :param pulumi.Input[bool] send_email_notification: Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        :param pulumi.Input[str] stack_name: Name of the stack that is associated with the user.
+        :param pulumi.Input[str] user_name: Email address of the user who is associated with the stack.
+        """
+        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
+
+        __props__ = _UserStackAssociationState.__new__(_UserStackAssociationState)
+
+        __props__.__dict__["authentication_type"] = authentication_type
+        __props__.__dict__["send_email_notification"] = send_email_notification
+        __props__.__dict__["stack_name"] = stack_name
+        __props__.__dict__["user_name"] = user_name
+        return UserStackAssociation(resource_name, opts=opts, __props__=__props__)
+
+    @property
+    @pulumi.getter(name="authenticationType")
+    def authentication_type(self) -> pulumi.Output[str]:
+        """
+        Authentication type for the user.
+        """
+        return pulumi.get(self, "authentication_type")
+
+    @property
+    @pulumi.getter(name="sendEmailNotification")
+    def send_email_notification(self) -> pulumi.Output[Optional[bool]]:
+        """
+        Specifies whether a welcome email is sent to a user after the user is created in the user pool.
+        """
+        return pulumi.get(self, "send_email_notification")
+
+    @property
+    @pulumi.getter(name="stackName")
+    def stack_name(self) -> pulumi.Output[str]:
+        """
+        Name of the stack that is associated with the user.
+        """
+        return pulumi.get(self, "stack_name")
+
+    @property
+    @pulumi.getter(name="userName")
+    def user_name(self) -> pulumi.Output[str]:
+        """
+        Email address of the user who is associated with the stack.
+        """
+        return pulumi.get(self, "user_name")
+
diff --git a/sdk/python/pulumi_aws/athena/_inputs.py b/sdk/python/pulumi_aws/athena/_inputs.py
index 272490cc4dd..966cd77348c 100644
--- a/sdk/python/pulumi_aws/athena/_inputs.py
+++ b/sdk/python/pulumi_aws/athena/_inputs.py
@@ -11,6 +11,7 @@
 __all__ = [
     'DatabaseEncryptionConfigurationArgs',
     'WorkgroupConfigurationArgs',
+    'WorkgroupConfigurationEngineVersionArgs',
     'WorkgroupConfigurationResultConfigurationArgs',
     'WorkgroupConfigurationResultConfigurationEncryptionConfigurationArgs',
 ]
@@ -58,12 +59,14 @@ class WorkgroupConfigurationArgs:
     def __init__(__self__, *,
                  bytes_scanned_cutoff_per_query: Optional[pulumi.Input[int]] = None,
                  enforce_workgroup_configuration: Optional[pulumi.Input[bool]] = None,
+                 engine_version: Optional[pulumi.Input['WorkgroupConfigurationEngineVersionArgs']] = None,
                  publish_cloudwatch_metrics_enabled: Optional[pulumi.Input[bool]] = None,
                  requester_pays_enabled: Optional[pulumi.Input[bool]] = None,
                  result_configuration: Optional[pulumi.Input['WorkgroupConfigurationResultConfigurationArgs']] = None):
         """
         :param pulumi.Input[int] bytes_scanned_cutoff_per_query: Integer for the upper data usage limit (cutoff) for the amount of bytes a single query in a workgroup is allowed to scan. Must be at least `10485760`.
         :param pulumi.Input[bool] enforce_workgroup_configuration: Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
+        :param pulumi.Input['WorkgroupConfigurationEngineVersionArgs'] engine_version: Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
         :param pulumi.Input[bool] publish_cloudwatch_metrics_enabled: Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
         :param pulumi.Input[bool] requester_pays_enabled: If set to true , allows members assigned to a workgroup to reference Amazon S3 Requester Pays buckets in queries. If set to false , workgroup members cannot query data from Requester Pays buckets, and queries that retrieve data from Requester Pays buckets cause an error. The default is false . For more information about Requester Pays buckets, see [Requester Pays Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html) in the Amazon Simple Storage Service Developer Guide.
         :param pulumi.Input['WorkgroupConfigurationResultConfigurationArgs'] result_configuration: Configuration block with result settings. Documented below.
@@ -72,6 +75,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "bytes_scanned_cutoff_per_query", bytes_scanned_cutoff_per_query)
         if enforce_workgroup_configuration is not None:
             pulumi.set(__self__, "enforce_workgroup_configuration", enforce_workgroup_configuration)
+        if engine_version is not None:
+            pulumi.set(__self__, "engine_version", engine_version)
         if publish_cloudwatch_metrics_enabled is not None:
             pulumi.set(__self__, "publish_cloudwatch_metrics_enabled", publish_cloudwatch_metrics_enabled)
         if requester_pays_enabled is not None:
@@ -103,6 +108,18 @@ def enforce_workgroup_configuration(self) -> Optional[pulumi.Input[bool]]:
     def enforce_workgroup_configuration(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enforce_workgroup_configuration", value)
 
+    @property
+    @pulumi.getter(name="engineVersion")
+    def engine_version(self) -> Optional[pulumi.Input['WorkgroupConfigurationEngineVersionArgs']]:
+        """
+        Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+        """
+        return pulumi.get(self, "engine_version")
+
+    @engine_version.setter
+    def engine_version(self, value: Optional[pulumi.Input['WorkgroupConfigurationEngineVersionArgs']]):
+        pulumi.set(self, "engine_version", value)
+
     @property
     @pulumi.getter(name="publishCloudwatchMetricsEnabled")
     def publish_cloudwatch_metrics_enabled(self) -> Optional[pulumi.Input[bool]]:
@@ -140,6 +157,45 @@ def result_configuration(self, value: Optional[pulumi.Input['WorkgroupConfigurat
         pulumi.set(self, "result_configuration", value)
 
 
+@pulumi.input_type
+class WorkgroupConfigurationEngineVersionArgs:
+    def __init__(__self__, *,
+                 effective_engine_version: Optional[pulumi.Input[str]] = None,
+                 selected_engine_version: Optional[pulumi.Input[str]] = None):
+        """
+        :param pulumi.Input[str] effective_engine_version: The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.
+        :param pulumi.Input[str] selected_engine_version: The requested engine version. Defaults to `AUTO`.
+        """
+        if effective_engine_version is not None:
+            pulumi.set(__self__, "effective_engine_version", effective_engine_version)
+        if selected_engine_version is not None:
+            pulumi.set(__self__, "selected_engine_version", selected_engine_version)
+
+    @property
+    @pulumi.getter(name="effectiveEngineVersion")
+    def effective_engine_version(self) -> Optional[pulumi.Input[str]]:
+        """
+        The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.
+        """
+        return pulumi.get(self, "effective_engine_version")
+
+    @effective_engine_version.setter
+    def effective_engine_version(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "effective_engine_version", value)
+
+    @property
+    @pulumi.getter(name="selectedEngineVersion")
+    def selected_engine_version(self) -> Optional[pulumi.Input[str]]:
+        """
+        The requested engine version. Defaults to `AUTO`.
+        """
+        return pulumi.get(self, "selected_engine_version")
+
+    @selected_engine_version.setter
+    def selected_engine_version(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "selected_engine_version", value)
+
+
 @pulumi.input_type
 class WorkgroupConfigurationResultConfigurationArgs:
     def __init__(__self__, *,
diff --git a/sdk/python/pulumi_aws/athena/outputs.py b/sdk/python/pulumi_aws/athena/outputs.py
index b83290f252d..6a16b292562 100644
--- a/sdk/python/pulumi_aws/athena/outputs.py
+++ b/sdk/python/pulumi_aws/athena/outputs.py
@@ -12,6 +12,7 @@
 __all__ = [
     'DatabaseEncryptionConfiguration',
     'WorkgroupConfiguration',
+    'WorkgroupConfigurationEngineVersion',
     'WorkgroupConfigurationResultConfiguration',
     'WorkgroupConfigurationResultConfigurationEncryptionConfiguration',
 ]
@@ -74,6 +75,8 @@ def __key_warning(key: str):
             suggest = "bytes_scanned_cutoff_per_query"
         elif key == "enforceWorkgroupConfiguration":
             suggest = "enforce_workgroup_configuration"
+        elif key == "engineVersion":
+            suggest = "engine_version"
         elif key == "publishCloudwatchMetricsEnabled":
             suggest = "publish_cloudwatch_metrics_enabled"
         elif key == "requesterPaysEnabled":
@@ -95,12 +98,14 @@ def get(self, key: str, default = None) -> Any:
     def __init__(__self__, *,
                  bytes_scanned_cutoff_per_query: Optional[int] = None,
                  enforce_workgroup_configuration: Optional[bool] = None,
+                 engine_version: Optional['outputs.WorkgroupConfigurationEngineVersion'] = None,
                  publish_cloudwatch_metrics_enabled: Optional[bool] = None,
                  requester_pays_enabled: Optional[bool] = None,
                  result_configuration: Optional['outputs.WorkgroupConfigurationResultConfiguration'] = None):
         """
         :param int bytes_scanned_cutoff_per_query: Integer for the upper data usage limit (cutoff) for the amount of bytes a single query in a workgroup is allowed to scan. Must be at least `10485760`.
         :param bool enforce_workgroup_configuration: Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
+        :param 'WorkgroupConfigurationEngineVersionArgs' engine_version: Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
         :param bool publish_cloudwatch_metrics_enabled: Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
         :param bool requester_pays_enabled: If set to true , allows members assigned to a workgroup to reference Amazon S3 Requester Pays buckets in queries. If set to false , workgroup members cannot query data from Requester Pays buckets, and queries that retrieve data from Requester Pays buckets cause an error. The default is false . For more information about Requester Pays buckets, see [Requester Pays Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html) in the Amazon Simple Storage Service Developer Guide.
         :param 'WorkgroupConfigurationResultConfigurationArgs' result_configuration: Configuration block with result settings. Documented below.
@@ -109,6 +114,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "bytes_scanned_cutoff_per_query", bytes_scanned_cutoff_per_query)
         if enforce_workgroup_configuration is not None:
             pulumi.set(__self__, "enforce_workgroup_configuration", enforce_workgroup_configuration)
+        if engine_version is not None:
+            pulumi.set(__self__, "engine_version", engine_version)
         if publish_cloudwatch_metrics_enabled is not None:
             pulumi.set(__self__, "publish_cloudwatch_metrics_enabled", publish_cloudwatch_metrics_enabled)
         if requester_pays_enabled is not None:
@@ -132,6 +139,14 @@ def enforce_workgroup_configuration(self) -> Optional[bool]:
         """
         return pulumi.get(self, "enforce_workgroup_configuration")
 
+    @property
+    @pulumi.getter(name="engineVersion")
+    def engine_version(self) -> Optional['outputs.WorkgroupConfigurationEngineVersion']:
+        """
+        Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+        """
+        return pulumi.get(self, "engine_version")
+
     @property
     @pulumi.getter(name="publishCloudwatchMetricsEnabled")
     def publish_cloudwatch_metrics_enabled(self) -> Optional[bool]:
@@ -157,6 +172,56 @@ def result_configuration(self) -> Optional['outputs.WorkgroupConfigurationResult
         return pulumi.get(self, "result_configuration")
 
 
+@pulumi.output_type
+class WorkgroupConfigurationEngineVersion(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "effectiveEngineVersion":
+            suggest = "effective_engine_version"
+        elif key == "selectedEngineVersion":
+            suggest = "selected_engine_version"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in WorkgroupConfigurationEngineVersion. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        WorkgroupConfigurationEngineVersion.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        WorkgroupConfigurationEngineVersion.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 effective_engine_version: Optional[str] = None,
+                 selected_engine_version: Optional[str] = None):
+        """
+        :param str effective_engine_version: The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.
+        :param str selected_engine_version: The requested engine version. Defaults to `AUTO`.
+        """
+        if effective_engine_version is not None:
+            pulumi.set(__self__, "effective_engine_version", effective_engine_version)
+        if selected_engine_version is not None:
+            pulumi.set(__self__, "selected_engine_version", selected_engine_version)
+
+    @property
+    @pulumi.getter(name="effectiveEngineVersion")
+    def effective_engine_version(self) -> Optional[str]:
+        """
+        The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.
+        """
+        return pulumi.get(self, "effective_engine_version")
+
+    @property
+    @pulumi.getter(name="selectedEngineVersion")
+    def selected_engine_version(self) -> Optional[str]:
+        """
+        The requested engine version. Defaults to `AUTO`.
+        """
+        return pulumi.get(self, "selected_engine_version")
+
+
 @pulumi.output_type
 class WorkgroupConfigurationResultConfiguration(dict):
     @staticmethod
diff --git a/sdk/python/pulumi_aws/cfg/_inputs.py b/sdk/python/pulumi_aws/cfg/_inputs.py
index f2a6dfbbf09..233546babe7 100644
--- a/sdk/python/pulumi_aws/cfg/_inputs.py
+++ b/sdk/python/pulumi_aws/cfg/_inputs.py
@@ -15,6 +15,8 @@
     'DeliveryChannelSnapshotDeliveryPropertiesArgs',
     'OrganizationConformancePackInputParameterArgs',
     'RecorderRecordingGroupArgs',
+    'RemediationConfigurationExecutionControlsArgs',
+    'RemediationConfigurationExecutionControlsSsmControlsArgs',
     'RemediationConfigurationParameterArgs',
     'RuleScopeArgs',
     'RuleSourceArgs',
@@ -281,6 +283,68 @@ def resource_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]
         pulumi.set(self, "resource_types", value)
 
 
+@pulumi.input_type
+class RemediationConfigurationExecutionControlsArgs:
+    def __init__(__self__, *,
+                 ssm_controls: Optional[pulumi.Input['RemediationConfigurationExecutionControlsSsmControlsArgs']] = None):
+        """
+        :param pulumi.Input['RemediationConfigurationExecutionControlsSsmControlsArgs'] ssm_controls: Configuration block for SSM controls. See below.
+        """
+        if ssm_controls is not None:
+            pulumi.set(__self__, "ssm_controls", ssm_controls)
+
+    @property
+    @pulumi.getter(name="ssmControls")
+    def ssm_controls(self) -> Optional[pulumi.Input['RemediationConfigurationExecutionControlsSsmControlsArgs']]:
+        """
+        Configuration block for SSM controls. See below.
+        """
+        return pulumi.get(self, "ssm_controls")
+
+    @ssm_controls.setter
+    def ssm_controls(self, value: Optional[pulumi.Input['RemediationConfigurationExecutionControlsSsmControlsArgs']]):
+        pulumi.set(self, "ssm_controls", value)
+
+
+@pulumi.input_type
+class RemediationConfigurationExecutionControlsSsmControlsArgs:
+    def __init__(__self__, *,
+                 concurrent_execution_rate_percentage: Optional[pulumi.Input[int]] = None,
+                 error_percentage: Optional[pulumi.Input[int]] = None):
+        """
+        :param pulumi.Input[int] concurrent_execution_rate_percentage: Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+        :param pulumi.Input[int] error_percentage: Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+        """
+        if concurrent_execution_rate_percentage is not None:
+            pulumi.set(__self__, "concurrent_execution_rate_percentage", concurrent_execution_rate_percentage)
+        if error_percentage is not None:
+            pulumi.set(__self__, "error_percentage", error_percentage)
+
+    @property
+    @pulumi.getter(name="concurrentExecutionRatePercentage")
+    def concurrent_execution_rate_percentage(self) -> Optional[pulumi.Input[int]]:
+        """
+        Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+        """
+        return pulumi.get(self, "concurrent_execution_rate_percentage")
+
+    @concurrent_execution_rate_percentage.setter
+    def concurrent_execution_rate_percentage(self, value: Optional[pulumi.Input[int]]):
+        pulumi.set(self, "concurrent_execution_rate_percentage", value)
+
+    @property
+    @pulumi.getter(name="errorPercentage")
+    def error_percentage(self) -> Optional[pulumi.Input[int]]:
+        """
+        Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+        """
+        return pulumi.get(self, "error_percentage")
+
+    @error_percentage.setter
+    def error_percentage(self, value: Optional[pulumi.Input[int]]):
+        pulumi.set(self, "error_percentage", value)
+
+
 @pulumi.input_type
 class RemediationConfigurationParameterArgs:
     def __init__(__self__, *,
@@ -288,9 +352,9 @@ def __init__(__self__, *,
                  resource_value: Optional[pulumi.Input[str]] = None,
                  static_value: Optional[pulumi.Input[str]] = None):
         """
-        :param pulumi.Input[str] name: The name of the attribute.
-        :param pulumi.Input[str] resource_value: The value is dynamic and changes at run-time.
-        :param pulumi.Input[str] static_value: The value is static and does not change at run-time.
+        :param pulumi.Input[str] name: Name of the attribute.
+        :param pulumi.Input[str] resource_value: Value is dynamic and changes at run-time.
+        :param pulumi.Input[str] static_value: Value is static and does not change at run-time.
         """
         pulumi.set(__self__, "name", name)
         if resource_value is not None:
@@ -302,7 +366,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the attribute.
+        Name of the attribute.
         """
         return pulumi.get(self, "name")
 
@@ -314,7 +378,7 @@ def name(self, value: pulumi.Input[str]):
     @pulumi.getter(name="resourceValue")
     def resource_value(self) -> Optional[pulumi.Input[str]]:
         """
-        The value is dynamic and changes at run-time.
+        Value is dynamic and changes at run-time.
         """
         return pulumi.get(self, "resource_value")
 
@@ -326,7 +390,7 @@ def resource_value(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="staticValue")
     def static_value(self) -> Optional[pulumi.Input[str]]:
         """
-        The value is static and does not change at run-time.
+        Value is static and does not change at run-time.
         """
         return pulumi.get(self, "static_value")
 
diff --git a/sdk/python/pulumi_aws/cfg/outputs.py b/sdk/python/pulumi_aws/cfg/outputs.py
index 9d851df2586..4ab262c63e6 100644
--- a/sdk/python/pulumi_aws/cfg/outputs.py
+++ b/sdk/python/pulumi_aws/cfg/outputs.py
@@ -16,6 +16,8 @@
     'DeliveryChannelSnapshotDeliveryProperties',
     'OrganizationConformancePackInputParameter',
     'RecorderRecordingGroup',
+    'RemediationConfigurationExecutionControls',
+    'RemediationConfigurationExecutionControlsSsmControls',
     'RemediationConfigurationParameter',
     'RuleScope',
     'RuleSource',
@@ -340,6 +342,92 @@ def resource_types(self) -> Optional[Sequence[str]]:
         return pulumi.get(self, "resource_types")
 
 
+@pulumi.output_type
+class RemediationConfigurationExecutionControls(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "ssmControls":
+            suggest = "ssm_controls"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in RemediationConfigurationExecutionControls. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        RemediationConfigurationExecutionControls.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        RemediationConfigurationExecutionControls.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 ssm_controls: Optional['outputs.RemediationConfigurationExecutionControlsSsmControls'] = None):
+        """
+        :param 'RemediationConfigurationExecutionControlsSsmControlsArgs' ssm_controls: Configuration block for SSM controls. See below.
+        """
+        if ssm_controls is not None:
+            pulumi.set(__self__, "ssm_controls", ssm_controls)
+
+    @property
+    @pulumi.getter(name="ssmControls")
+    def ssm_controls(self) -> Optional['outputs.RemediationConfigurationExecutionControlsSsmControls']:
+        """
+        Configuration block for SSM controls. See below.
+        """
+        return pulumi.get(self, "ssm_controls")
+
+
+@pulumi.output_type
+class RemediationConfigurationExecutionControlsSsmControls(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "concurrentExecutionRatePercentage":
+            suggest = "concurrent_execution_rate_percentage"
+        elif key == "errorPercentage":
+            suggest = "error_percentage"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in RemediationConfigurationExecutionControlsSsmControls. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        RemediationConfigurationExecutionControlsSsmControls.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        RemediationConfigurationExecutionControlsSsmControls.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 concurrent_execution_rate_percentage: Optional[int] = None,
+                 error_percentage: Optional[int] = None):
+        """
+        :param int concurrent_execution_rate_percentage: Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+        :param int error_percentage: Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+        """
+        if concurrent_execution_rate_percentage is not None:
+            pulumi.set(__self__, "concurrent_execution_rate_percentage", concurrent_execution_rate_percentage)
+        if error_percentage is not None:
+            pulumi.set(__self__, "error_percentage", error_percentage)
+
+    @property
+    @pulumi.getter(name="concurrentExecutionRatePercentage")
+    def concurrent_execution_rate_percentage(self) -> Optional[int]:
+        """
+        Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+        """
+        return pulumi.get(self, "concurrent_execution_rate_percentage")
+
+    @property
+    @pulumi.getter(name="errorPercentage")
+    def error_percentage(self) -> Optional[int]:
+        """
+        Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+        """
+        return pulumi.get(self, "error_percentage")
+
+
 @pulumi.output_type
 class RemediationConfigurationParameter(dict):
     @staticmethod
@@ -366,9 +454,9 @@ def __init__(__self__, *,
                  resource_value: Optional[str] = None,
                  static_value: Optional[str] = None):
         """
-        :param str name: The name of the attribute.
-        :param str resource_value: The value is dynamic and changes at run-time.
-        :param str static_value: The value is static and does not change at run-time.
+        :param str name: Name of the attribute.
+        :param str resource_value: Value is dynamic and changes at run-time.
+        :param str static_value: Value is static and does not change at run-time.
         """
         pulumi.set(__self__, "name", name)
         if resource_value is not None:
@@ -380,7 +468,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the attribute.
+        Name of the attribute.
         """
         return pulumi.get(self, "name")
 
@@ -388,7 +476,7 @@ def name(self) -> str:
     @pulumi.getter(name="resourceValue")
     def resource_value(self) -> Optional[str]:
         """
-        The value is dynamic and changes at run-time.
+        Value is dynamic and changes at run-time.
         """
         return pulumi.get(self, "resource_value")
 
@@ -396,7 +484,7 @@ def resource_value(self) -> Optional[str]:
     @pulumi.getter(name="staticValue")
     def static_value(self) -> Optional[str]:
         """
-        The value is static and does not change at run-time.
+        Value is static and does not change at run-time.
         """
         return pulumi.get(self, "static_value")
 
diff --git a/sdk/python/pulumi_aws/cfg/remediation_configuration.py b/sdk/python/pulumi_aws/cfg/remediation_configuration.py
index 00836879ade..18cfef410c8 100644
--- a/sdk/python/pulumi_aws/cfg/remediation_configuration.py
+++ b/sdk/python/pulumi_aws/cfg/remediation_configuration.py
@@ -18,26 +18,41 @@ def __init__(__self__, *,
                  config_rule_name: pulumi.Input[str],
                  target_id: pulumi.Input[str],
                  target_type: pulumi.Input[str],
+                 automatic: Optional[pulumi.Input[bool]] = None,
+                 execution_controls: Optional[pulumi.Input['RemediationConfigurationExecutionControlsArgs']] = None,
+                 maximum_automatic_attempts: Optional[pulumi.Input[int]] = None,
                  parameters: Optional[pulumi.Input[Sequence[pulumi.Input['RemediationConfigurationParameterArgs']]]] = None,
                  resource_type: Optional[pulumi.Input[str]] = None,
+                 retry_attempt_seconds: Optional[pulumi.Input[int]] = None,
                  target_version: Optional[pulumi.Input[str]] = None):
         """
         The set of arguments for constructing a RemediationConfiguration resource.
-        :param pulumi.Input[str] config_rule_name: The name of the AWS Config rule
-        :param pulumi.Input[str] target_id: Target ID is the name of the public document
-        :param pulumi.Input[str] target_type: The type of the target. Target executes remediation. For example, SSM document
-        :param pulumi.Input[Sequence[pulumi.Input['RemediationConfigurationParameterArgs']]] parameters: Can be specified multiple times for each
-               parameter. Each parameter block supports fields documented below.
-        :param pulumi.Input[str] resource_type: The type of a resource
+        :param pulumi.Input[str] config_rule_name: Name of the AWS Config rule.
+        :param pulumi.Input[str] target_id: Target ID is the name of the public document.
+        :param pulumi.Input[str] target_type: Type of the target. Target executes remediation. For example, SSM document.
+        :param pulumi.Input[bool] automatic: Remediation is triggered automatically if `true`.
+        :param pulumi.Input['RemediationConfigurationExecutionControlsArgs'] execution_controls: Configuration block for execution controls. See below.
+        :param pulumi.Input[int] maximum_automatic_attempts: Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        :param pulumi.Input[Sequence[pulumi.Input['RemediationConfigurationParameterArgs']]] parameters: Can be specified multiple times for each parameter. Each parameter block supports arguments below.
+        :param pulumi.Input[str] resource_type: Type of resource.
+        :param pulumi.Input[int] retry_attempt_seconds: Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
         :param pulumi.Input[str] target_version: Version of the target. For example, version of the SSM document
         """
         pulumi.set(__self__, "config_rule_name", config_rule_name)
         pulumi.set(__self__, "target_id", target_id)
         pulumi.set(__self__, "target_type", target_type)
+        if automatic is not None:
+            pulumi.set(__self__, "automatic", automatic)
+        if execution_controls is not None:
+            pulumi.set(__self__, "execution_controls", execution_controls)
+        if maximum_automatic_attempts is not None:
+            pulumi.set(__self__, "maximum_automatic_attempts", maximum_automatic_attempts)
         if parameters is not None:
             pulumi.set(__self__, "parameters", parameters)
         if resource_type is not None:
             pulumi.set(__self__, "resource_type", resource_type)
+        if retry_attempt_seconds is not None:
+            pulumi.set(__self__, "retry_attempt_seconds", retry_attempt_seconds)
         if target_version is not None:
             pulumi.set(__self__, "target_version", target_version)
 
@@ -45,7 +60,7 @@ def __init__(__self__, *,
     @pulumi.getter(name="configRuleName")
     def config_rule_name(self) -> pulumi.Input[str]:
         """
-        The name of the AWS Config rule
+        Name of the AWS Config rule.
         """
         return pulumi.get(self, "config_rule_name")
 
@@ -57,7 +72,7 @@ def config_rule_name(self, value: pulumi.Input[str]):
     @pulumi.getter(name="targetId")
     def target_id(self) -> pulumi.Input[str]:
         """
-        Target ID is the name of the public document
+        Target ID is the name of the public document.
         """
         return pulumi.get(self, "target_id")
 
@@ -69,7 +84,7 @@ def target_id(self, value: pulumi.Input[str]):
     @pulumi.getter(name="targetType")
     def target_type(self) -> pulumi.Input[str]:
         """
-        The type of the target. Target executes remediation. For example, SSM document
+        Type of the target. Target executes remediation. For example, SSM document.
         """
         return pulumi.get(self, "target_type")
 
@@ -77,12 +92,47 @@ def target_type(self) -> pulumi.Input[str]:
     def target_type(self, value: pulumi.Input[str]):
         pulumi.set(self, "target_type", value)
 
+    @property
+    @pulumi.getter
+    def automatic(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Remediation is triggered automatically if `true`.
+        """
+        return pulumi.get(self, "automatic")
+
+    @automatic.setter
+    def automatic(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "automatic", value)
+
+    @property
+    @pulumi.getter(name="executionControls")
+    def execution_controls(self) -> Optional[pulumi.Input['RemediationConfigurationExecutionControlsArgs']]:
+        """
+        Configuration block for execution controls. See below.
+        """
+        return pulumi.get(self, "execution_controls")
+
+    @execution_controls.setter
+    def execution_controls(self, value: Optional[pulumi.Input['RemediationConfigurationExecutionControlsArgs']]):
+        pulumi.set(self, "execution_controls", value)
+
+    @property
+    @pulumi.getter(name="maximumAutomaticAttempts")
+    def maximum_automatic_attempts(self) -> Optional[pulumi.Input[int]]:
+        """
+        Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        """
+        return pulumi.get(self, "maximum_automatic_attempts")
+
+    @maximum_automatic_attempts.setter
+    def maximum_automatic_attempts(self, value: Optional[pulumi.Input[int]]):
+        pulumi.set(self, "maximum_automatic_attempts", value)
+
     @property
     @pulumi.getter
     def parameters(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RemediationConfigurationParameterArgs']]]]:
         """
-        Can be specified multiple times for each
-        parameter. Each parameter block supports fields documented below.
+        Can be specified multiple times for each parameter. Each parameter block supports arguments below.
         """
         return pulumi.get(self, "parameters")
 
@@ -94,7 +144,7 @@ def parameters(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['Remedia
     @pulumi.getter(name="resourceType")
     def resource_type(self) -> Optional[pulumi.Input[str]]:
         """
-        The type of a resource
+        Type of resource.
         """
         return pulumi.get(self, "resource_type")
 
@@ -102,6 +152,18 @@ def resource_type(self) -> Optional[pulumi.Input[str]]:
     def resource_type(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "resource_type", value)
 
+    @property
+    @pulumi.getter(name="retryAttemptSeconds")
+    def retry_attempt_seconds(self) -> Optional[pulumi.Input[int]]:
+        """
+        Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        """
+        return pulumi.get(self, "retry_attempt_seconds")
+
+    @retry_attempt_seconds.setter
+    def retry_attempt_seconds(self, value: Optional[pulumi.Input[int]]):
+        pulumi.set(self, "retry_attempt_seconds", value)
+
     @property
     @pulumi.getter(name="targetVersion")
     def target_version(self) -> Optional[pulumi.Input[str]]:
@@ -119,31 +181,46 @@ def target_version(self, value: Optional[pulumi.Input[str]]):
 class _RemediationConfigurationState:
     def __init__(__self__, *,
                  arn: Optional[pulumi.Input[str]] = None,
+                 automatic: Optional[pulumi.Input[bool]] = None,
                  config_rule_name: Optional[pulumi.Input[str]] = None,
+                 execution_controls: Optional[pulumi.Input['RemediationConfigurationExecutionControlsArgs']] = None,
+                 maximum_automatic_attempts: Optional[pulumi.Input[int]] = None,
                  parameters: Optional[pulumi.Input[Sequence[pulumi.Input['RemediationConfigurationParameterArgs']]]] = None,
                  resource_type: Optional[pulumi.Input[str]] = None,
+                 retry_attempt_seconds: Optional[pulumi.Input[int]] = None,
                  target_id: Optional[pulumi.Input[str]] = None,
                  target_type: Optional[pulumi.Input[str]] = None,
                  target_version: Optional[pulumi.Input[str]] = None):
         """
         Input properties used for looking up and filtering RemediationConfiguration resources.
-        :param pulumi.Input[str] arn: Amazon Resource Name (ARN) of the Config Remediation Configuration.
-        :param pulumi.Input[str] config_rule_name: The name of the AWS Config rule
-        :param pulumi.Input[Sequence[pulumi.Input['RemediationConfigurationParameterArgs']]] parameters: Can be specified multiple times for each
-               parameter. Each parameter block supports fields documented below.
-        :param pulumi.Input[str] resource_type: The type of a resource
-        :param pulumi.Input[str] target_id: Target ID is the name of the public document
-        :param pulumi.Input[str] target_type: The type of the target. Target executes remediation. For example, SSM document
+        :param pulumi.Input[str] arn: ARN of the Config Remediation Configuration.
+        :param pulumi.Input[bool] automatic: Remediation is triggered automatically if `true`.
+        :param pulumi.Input[str] config_rule_name: Name of the AWS Config rule.
+        :param pulumi.Input['RemediationConfigurationExecutionControlsArgs'] execution_controls: Configuration block for execution controls. See below.
+        :param pulumi.Input[int] maximum_automatic_attempts: Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        :param pulumi.Input[Sequence[pulumi.Input['RemediationConfigurationParameterArgs']]] parameters: Can be specified multiple times for each parameter. Each parameter block supports arguments below.
+        :param pulumi.Input[str] resource_type: Type of resource.
+        :param pulumi.Input[int] retry_attempt_seconds: Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        :param pulumi.Input[str] target_id: Target ID is the name of the public document.
+        :param pulumi.Input[str] target_type: Type of the target. Target executes remediation. For example, SSM document.
         :param pulumi.Input[str] target_version: Version of the target. For example, version of the SSM document
         """
         if arn is not None:
             pulumi.set(__self__, "arn", arn)
+        if automatic is not None:
+            pulumi.set(__self__, "automatic", automatic)
         if config_rule_name is not None:
             pulumi.set(__self__, "config_rule_name", config_rule_name)
+        if execution_controls is not None:
+            pulumi.set(__self__, "execution_controls", execution_controls)
+        if maximum_automatic_attempts is not None:
+            pulumi.set(__self__, "maximum_automatic_attempts", maximum_automatic_attempts)
         if parameters is not None:
             pulumi.set(__self__, "parameters", parameters)
         if resource_type is not None:
             pulumi.set(__self__, "resource_type", resource_type)
+        if retry_attempt_seconds is not None:
+            pulumi.set(__self__, "retry_attempt_seconds", retry_attempt_seconds)
         if target_id is not None:
             pulumi.set(__self__, "target_id", target_id)
         if target_type is not None:
@@ -155,7 +232,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def arn(self) -> Optional[pulumi.Input[str]]:
         """
-        Amazon Resource Name (ARN) of the Config Remediation Configuration.
+        ARN of the Config Remediation Configuration.
         """
         return pulumi.get(self, "arn")
 
@@ -163,11 +240,23 @@ def arn(self) -> Optional[pulumi.Input[str]]:
     def arn(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "arn", value)
 
+    @property
+    @pulumi.getter
+    def automatic(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Remediation is triggered automatically if `true`.
+        """
+        return pulumi.get(self, "automatic")
+
+    @automatic.setter
+    def automatic(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "automatic", value)
+
     @property
     @pulumi.getter(name="configRuleName")
     def config_rule_name(self) -> Optional[pulumi.Input[str]]:
         """
-        The name of the AWS Config rule
+        Name of the AWS Config rule.
         """
         return pulumi.get(self, "config_rule_name")
 
@@ -175,12 +264,35 @@ def config_rule_name(self) -> Optional[pulumi.Input[str]]:
     def config_rule_name(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "config_rule_name", value)
 
+    @property
+    @pulumi.getter(name="executionControls")
+    def execution_controls(self) -> Optional[pulumi.Input['RemediationConfigurationExecutionControlsArgs']]:
+        """
+        Configuration block for execution controls. See below.
+        """
+        return pulumi.get(self, "execution_controls")
+
+    @execution_controls.setter
+    def execution_controls(self, value: Optional[pulumi.Input['RemediationConfigurationExecutionControlsArgs']]):
+        pulumi.set(self, "execution_controls", value)
+
+    @property
+    @pulumi.getter(name="maximumAutomaticAttempts")
+    def maximum_automatic_attempts(self) -> Optional[pulumi.Input[int]]:
+        """
+        Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        """
+        return pulumi.get(self, "maximum_automatic_attempts")
+
+    @maximum_automatic_attempts.setter
+    def maximum_automatic_attempts(self, value: Optional[pulumi.Input[int]]):
+        pulumi.set(self, "maximum_automatic_attempts", value)
+
     @property
     @pulumi.getter
     def parameters(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RemediationConfigurationParameterArgs']]]]:
         """
-        Can be specified multiple times for each
-        parameter. Each parameter block supports fields documented below.
+        Can be specified multiple times for each parameter. Each parameter block supports arguments below.
         """
         return pulumi.get(self, "parameters")
 
@@ -192,7 +304,7 @@ def parameters(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['Remedia
     @pulumi.getter(name="resourceType")
     def resource_type(self) -> Optional[pulumi.Input[str]]:
         """
-        The type of a resource
+        Type of resource.
         """
         return pulumi.get(self, "resource_type")
 
@@ -200,11 +312,23 @@ def resource_type(self) -> Optional[pulumi.Input[str]]:
     def resource_type(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "resource_type", value)
 
+    @property
+    @pulumi.getter(name="retryAttemptSeconds")
+    def retry_attempt_seconds(self) -> Optional[pulumi.Input[int]]:
+        """
+        Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        """
+        return pulumi.get(self, "retry_attempt_seconds")
+
+    @retry_attempt_seconds.setter
+    def retry_attempt_seconds(self, value: Optional[pulumi.Input[int]]):
+        pulumi.set(self, "retry_attempt_seconds", value)
+
     @property
     @pulumi.getter(name="targetId")
     def target_id(self) -> Optional[pulumi.Input[str]]:
         """
-        Target ID is the name of the public document
+        Target ID is the name of the public document.
         """
         return pulumi.get(self, "target_id")
 
@@ -216,7 +340,7 @@ def target_id(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="targetType")
     def target_type(self) -> Optional[pulumi.Input[str]]:
         """
-        The type of the target. Target executes remediation. For example, SSM document
+        Type of the target. Target executes remediation. For example, SSM document.
         """
         return pulumi.get(self, "target_type")
 
@@ -242,9 +366,13 @@ class RemediationConfiguration(pulumi.CustomResource):
     def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
+                 automatic: Optional[pulumi.Input[bool]] = None,
                  config_rule_name: Optional[pulumi.Input[str]] = None,
+                 execution_controls: Optional[pulumi.Input[pulumi.InputType['RemediationConfigurationExecutionControlsArgs']]] = None,
+                 maximum_automatic_attempts: Optional[pulumi.Input[int]] = None,
                  parameters: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RemediationConfigurationParameterArgs']]]]] = None,
                  resource_type: Optional[pulumi.Input[str]] = None,
+                 retry_attempt_seconds: Optional[pulumi.Input[int]] = None,
                  target_id: Optional[pulumi.Input[str]] = None,
                  target_type: Optional[pulumi.Input[str]] = None,
                  target_version: Optional[pulumi.Input[str]] = None,
@@ -285,7 +413,16 @@ def __init__(__self__,
                     name="SSEAlgorithm",
                     static_value="AES256",
                 ),
-            ])
+            ],
+            automatic=True,
+            maximum_automatic_attempts=10,
+            retry_attempt_seconds=600,
+            execution_controls=aws.cfg.RemediationConfigurationExecutionControlsArgs(
+                ssm_controls=aws.cfg.RemediationConfigurationExecutionControlsSsmControlsArgs(
+                    concurrent_execution_rate_percentage=25,
+                    error_percentage=20,
+                ),
+            ))
         ```
 
         ## Import
@@ -298,12 +435,15 @@ def __init__(__self__,
 
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[str] config_rule_name: The name of the AWS Config rule
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RemediationConfigurationParameterArgs']]]] parameters: Can be specified multiple times for each
-               parameter. Each parameter block supports fields documented below.
-        :param pulumi.Input[str] resource_type: The type of a resource
-        :param pulumi.Input[str] target_id: Target ID is the name of the public document
-        :param pulumi.Input[str] target_type: The type of the target. Target executes remediation. For example, SSM document
+        :param pulumi.Input[bool] automatic: Remediation is triggered automatically if `true`.
+        :param pulumi.Input[str] config_rule_name: Name of the AWS Config rule.
+        :param pulumi.Input[pulumi.InputType['RemediationConfigurationExecutionControlsArgs']] execution_controls: Configuration block for execution controls. See below.
+        :param pulumi.Input[int] maximum_automatic_attempts: Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RemediationConfigurationParameterArgs']]]] parameters: Can be specified multiple times for each parameter. Each parameter block supports arguments below.
+        :param pulumi.Input[str] resource_type: Type of resource.
+        :param pulumi.Input[int] retry_attempt_seconds: Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        :param pulumi.Input[str] target_id: Target ID is the name of the public document.
+        :param pulumi.Input[str] target_type: Type of the target. Target executes remediation. For example, SSM document.
         :param pulumi.Input[str] target_version: Version of the target. For example, version of the SSM document
         """
         ...
@@ -348,7 +488,16 @@ def __init__(__self__,
                     name="SSEAlgorithm",
                     static_value="AES256",
                 ),
-            ])
+            ],
+            automatic=True,
+            maximum_automatic_attempts=10,
+            retry_attempt_seconds=600,
+            execution_controls=aws.cfg.RemediationConfigurationExecutionControlsArgs(
+                ssm_controls=aws.cfg.RemediationConfigurationExecutionControlsSsmControlsArgs(
+                    concurrent_execution_rate_percentage=25,
+                    error_percentage=20,
+                ),
+            ))
         ```
 
         ## Import
@@ -374,9 +523,13 @@ def __init__(__self__, resource_name: str, *args, **kwargs):
     def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
+                 automatic: Optional[pulumi.Input[bool]] = None,
                  config_rule_name: Optional[pulumi.Input[str]] = None,
+                 execution_controls: Optional[pulumi.Input[pulumi.InputType['RemediationConfigurationExecutionControlsArgs']]] = None,
+                 maximum_automatic_attempts: Optional[pulumi.Input[int]] = None,
                  parameters: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RemediationConfigurationParameterArgs']]]]] = None,
                  resource_type: Optional[pulumi.Input[str]] = None,
+                 retry_attempt_seconds: Optional[pulumi.Input[int]] = None,
                  target_id: Optional[pulumi.Input[str]] = None,
                  target_type: Optional[pulumi.Input[str]] = None,
                  target_version: Optional[pulumi.Input[str]] = None,
@@ -392,11 +545,15 @@ def _internal_init(__self__,
                 raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
             __props__ = RemediationConfigurationArgs.__new__(RemediationConfigurationArgs)
 
+            __props__.__dict__["automatic"] = automatic
             if config_rule_name is None and not opts.urn:
                 raise TypeError("Missing required property 'config_rule_name'")
             __props__.__dict__["config_rule_name"] = config_rule_name
+            __props__.__dict__["execution_controls"] = execution_controls
+            __props__.__dict__["maximum_automatic_attempts"] = maximum_automatic_attempts
             __props__.__dict__["parameters"] = parameters
             __props__.__dict__["resource_type"] = resource_type
+            __props__.__dict__["retry_attempt_seconds"] = retry_attempt_seconds
             if target_id is None and not opts.urn:
                 raise TypeError("Missing required property 'target_id'")
             __props__.__dict__["target_id"] = target_id
@@ -416,9 +573,13 @@ def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
             arn: Optional[pulumi.Input[str]] = None,
+            automatic: Optional[pulumi.Input[bool]] = None,
             config_rule_name: Optional[pulumi.Input[str]] = None,
+            execution_controls: Optional[pulumi.Input[pulumi.InputType['RemediationConfigurationExecutionControlsArgs']]] = None,
+            maximum_automatic_attempts: Optional[pulumi.Input[int]] = None,
             parameters: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RemediationConfigurationParameterArgs']]]]] = None,
             resource_type: Optional[pulumi.Input[str]] = None,
+            retry_attempt_seconds: Optional[pulumi.Input[int]] = None,
             target_id: Optional[pulumi.Input[str]] = None,
             target_type: Optional[pulumi.Input[str]] = None,
             target_version: Optional[pulumi.Input[str]] = None) -> 'RemediationConfiguration':
@@ -429,13 +590,16 @@ def get(resource_name: str,
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[str] arn: Amazon Resource Name (ARN) of the Config Remediation Configuration.
-        :param pulumi.Input[str] config_rule_name: The name of the AWS Config rule
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RemediationConfigurationParameterArgs']]]] parameters: Can be specified multiple times for each
-               parameter. Each parameter block supports fields documented below.
-        :param pulumi.Input[str] resource_type: The type of a resource
-        :param pulumi.Input[str] target_id: Target ID is the name of the public document
-        :param pulumi.Input[str] target_type: The type of the target. Target executes remediation. For example, SSM document
+        :param pulumi.Input[str] arn: ARN of the Config Remediation Configuration.
+        :param pulumi.Input[bool] automatic: Remediation is triggered automatically if `true`.
+        :param pulumi.Input[str] config_rule_name: Name of the AWS Config rule.
+        :param pulumi.Input[pulumi.InputType['RemediationConfigurationExecutionControlsArgs']] execution_controls: Configuration block for execution controls. See below.
+        :param pulumi.Input[int] maximum_automatic_attempts: Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RemediationConfigurationParameterArgs']]]] parameters: Can be specified multiple times for each parameter. Each parameter block supports arguments below.
+        :param pulumi.Input[str] resource_type: Type of resource.
+        :param pulumi.Input[int] retry_attempt_seconds: Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        :param pulumi.Input[str] target_id: Target ID is the name of the public document.
+        :param pulumi.Input[str] target_type: Type of the target. Target executes remediation. For example, SSM document.
         :param pulumi.Input[str] target_version: Version of the target. For example, version of the SSM document
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
@@ -443,9 +607,13 @@ def get(resource_name: str,
         __props__ = _RemediationConfigurationState.__new__(_RemediationConfigurationState)
 
         __props__.__dict__["arn"] = arn
+        __props__.__dict__["automatic"] = automatic
         __props__.__dict__["config_rule_name"] = config_rule_name
+        __props__.__dict__["execution_controls"] = execution_controls
+        __props__.__dict__["maximum_automatic_attempts"] = maximum_automatic_attempts
         __props__.__dict__["parameters"] = parameters
         __props__.__dict__["resource_type"] = resource_type
+        __props__.__dict__["retry_attempt_seconds"] = retry_attempt_seconds
         __props__.__dict__["target_id"] = target_id
         __props__.__dict__["target_type"] = target_type
         __props__.__dict__["target_version"] = target_version
@@ -455,24 +623,47 @@ def get(resource_name: str,
     @pulumi.getter
     def arn(self) -> pulumi.Output[str]:
         """
-        Amazon Resource Name (ARN) of the Config Remediation Configuration.
+        ARN of the Config Remediation Configuration.
         """
         return pulumi.get(self, "arn")
 
+    @property
+    @pulumi.getter
+    def automatic(self) -> pulumi.Output[Optional[bool]]:
+        """
+        Remediation is triggered automatically if `true`.
+        """
+        return pulumi.get(self, "automatic")
+
     @property
     @pulumi.getter(name="configRuleName")
     def config_rule_name(self) -> pulumi.Output[str]:
         """
-        The name of the AWS Config rule
+        Name of the AWS Config rule.
         """
         return pulumi.get(self, "config_rule_name")
 
+    @property
+    @pulumi.getter(name="executionControls")
+    def execution_controls(self) -> pulumi.Output[Optional['outputs.RemediationConfigurationExecutionControls']]:
+        """
+        Configuration block for execution controls. See below.
+        """
+        return pulumi.get(self, "execution_controls")
+
+    @property
+    @pulumi.getter(name="maximumAutomaticAttempts")
+    def maximum_automatic_attempts(self) -> pulumi.Output[Optional[int]]:
+        """
+        Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+        """
+        return pulumi.get(self, "maximum_automatic_attempts")
+
     @property
     @pulumi.getter
     def parameters(self) -> pulumi.Output[Optional[Sequence['outputs.RemediationConfigurationParameter']]]:
         """
-        Can be specified multiple times for each
-        parameter. Each parameter block supports fields documented below.
+        Can be specified multiple times for each parameter. Each parameter block supports arguments below.
         """
         return pulumi.get(self, "parameters")
 
@@ -480,15 +671,23 @@ def parameters(self) -> pulumi.Output[Optional[Sequence['outputs.RemediationConf
     @pulumi.getter(name="resourceType")
     def resource_type(self) -> pulumi.Output[Optional[str]]:
         """
-        The type of a resource
+        Type of resource.
         """
         return pulumi.get(self, "resource_type")
 
+    @property
+    @pulumi.getter(name="retryAttemptSeconds")
+    def retry_attempt_seconds(self) -> pulumi.Output[Optional[int]]:
+        """
+        Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+        """
+        return pulumi.get(self, "retry_attempt_seconds")
+
     @property
     @pulumi.getter(name="targetId")
     def target_id(self) -> pulumi.Output[str]:
         """
-        Target ID is the name of the public document
+        Target ID is the name of the public document.
         """
         return pulumi.get(self, "target_id")
 
@@ -496,7 +695,7 @@ def target_id(self) -> pulumi.Output[str]:
     @pulumi.getter(name="targetType")
     def target_type(self) -> pulumi.Output[str]:
         """
-        The type of the target. Target executes remediation. For example, SSM document
+        Type of the target. Target executes remediation. For example, SSM document.
         """
         return pulumi.get(self, "target_type")
 
diff --git a/sdk/python/pulumi_aws/cloudtrail/_inputs.py b/sdk/python/pulumi_aws/cloudtrail/_inputs.py
index 7a9efc5f2b3..4354c59b8e8 100644
--- a/sdk/python/pulumi_aws/cloudtrail/_inputs.py
+++ b/sdk/python/pulumi_aws/cloudtrail/_inputs.py
@@ -176,15 +176,19 @@ def starts_withs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]
 class TrailEventSelectorArgs:
     def __init__(__self__, *,
                  data_resources: Optional[pulumi.Input[Sequence[pulumi.Input['TrailEventSelectorDataResourceArgs']]]] = None,
+                 exclude_management_event_sources: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  include_management_events: Optional[pulumi.Input[bool]] = None,
                  read_write_type: Optional[pulumi.Input[str]] = None):
         """
         :param pulumi.Input[Sequence[pulumi.Input['TrailEventSelectorDataResourceArgs']]] data_resources: Configuration block for data events. See details below.
-        :param pulumi.Input[bool] include_management_events: Whether to include management events for your trail.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] exclude_management_event_sources: A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.
+        :param pulumi.Input[bool] include_management_events: Whether to include management events for your trail. Defaults to `true`.
         :param pulumi.Input[str] read_write_type: Type of events to log. Valid values are `ReadOnly`, `WriteOnly`, `All`. Default value is `All`.
         """
         if data_resources is not None:
             pulumi.set(__self__, "data_resources", data_resources)
+        if exclude_management_event_sources is not None:
+            pulumi.set(__self__, "exclude_management_event_sources", exclude_management_event_sources)
         if include_management_events is not None:
             pulumi.set(__self__, "include_management_events", include_management_events)
         if read_write_type is not None:
@@ -202,11 +206,23 @@ def data_resources(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['TrailEv
     def data_resources(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['TrailEventSelectorDataResourceArgs']]]]):
         pulumi.set(self, "data_resources", value)
 
+    @property
+    @pulumi.getter(name="excludeManagementEventSources")
+    def exclude_management_event_sources(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+        """
+        A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.
+        """
+        return pulumi.get(self, "exclude_management_event_sources")
+
+    @exclude_management_event_sources.setter
+    def exclude_management_event_sources(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+        pulumi.set(self, "exclude_management_event_sources", value)
+
     @property
     @pulumi.getter(name="includeManagementEvents")
     def include_management_events(self) -> Optional[pulumi.Input[bool]]:
         """
-        Whether to include management events for your trail.
+        Whether to include management events for your trail. Defaults to `true`.
         """
         return pulumi.get(self, "include_management_events")
 
diff --git a/sdk/python/pulumi_aws/cloudtrail/outputs.py b/sdk/python/pulumi_aws/cloudtrail/outputs.py
index bc47a6b7f3a..3f2d3ba1ce0 100644
--- a/sdk/python/pulumi_aws/cloudtrail/outputs.py
+++ b/sdk/python/pulumi_aws/cloudtrail/outputs.py
@@ -186,6 +186,8 @@ def __key_warning(key: str):
         suggest = None
         if key == "dataResources":
             suggest = "data_resources"
+        elif key == "excludeManagementEventSources":
+            suggest = "exclude_management_event_sources"
         elif key == "includeManagementEvents":
             suggest = "include_management_events"
         elif key == "readWriteType":
@@ -204,15 +206,19 @@ def get(self, key: str, default = None) -> Any:
 
     def __init__(__self__, *,
                  data_resources: Optional[Sequence['outputs.TrailEventSelectorDataResource']] = None,
+                 exclude_management_event_sources: Optional[Sequence[str]] = None,
                  include_management_events: Optional[bool] = None,
                  read_write_type: Optional[str] = None):
         """
         :param Sequence['TrailEventSelectorDataResourceArgs'] data_resources: Configuration block for data events. See details below.
-        :param bool include_management_events: Whether to include management events for your trail.
+        :param Sequence[str] exclude_management_event_sources: A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.
+        :param bool include_management_events: Whether to include management events for your trail. Defaults to `true`.
         :param str read_write_type: Type of events to log. Valid values are `ReadOnly`, `WriteOnly`, `All`. Default value is `All`.
         """
         if data_resources is not None:
             pulumi.set(__self__, "data_resources", data_resources)
+        if exclude_management_event_sources is not None:
+            pulumi.set(__self__, "exclude_management_event_sources", exclude_management_event_sources)
         if include_management_events is not None:
             pulumi.set(__self__, "include_management_events", include_management_events)
         if read_write_type is not None:
@@ -226,11 +232,19 @@ def data_resources(self) -> Optional[Sequence['outputs.TrailEventSelectorDataRes
         """
         return pulumi.get(self, "data_resources")
 
+    @property
+    @pulumi.getter(name="excludeManagementEventSources")
+    def exclude_management_event_sources(self) -> Optional[Sequence[str]]:
+        """
+        A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.
+        """
+        return pulumi.get(self, "exclude_management_event_sources")
+
     @property
     @pulumi.getter(name="includeManagementEvents")
     def include_management_events(self) -> Optional[bool]:
         """
-        Whether to include management events for your trail.
+        Whether to include management events for your trail. Defaults to `true`.
         """
         return pulumi.get(self, "include_management_events")
 
diff --git a/sdk/python/pulumi_aws/config/outputs.py b/sdk/python/pulumi_aws/config/outputs.py
index ca977f7c4da..279516b2f92 100644
--- a/sdk/python/pulumi_aws/config/outputs.py
+++ b/sdk/python/pulumi_aws/config/outputs.py
@@ -101,6 +101,7 @@ def tags(self) -> Optional[Mapping[str, str]]:
 class Endpoints(dict):
     def __init__(__self__, *,
                  accessanalyzer: Optional[str] = None,
+                 account: Optional[str] = None,
                  acm: Optional[str] = None,
                  acmpca: Optional[str] = None,
                  alexaforbusiness: Optional[str] = None,
@@ -401,6 +402,8 @@ def __init__(__self__, *,
                  xray: Optional[str] = None):
         if accessanalyzer is not None:
             pulumi.set(__self__, "accessanalyzer", accessanalyzer)
+        if account is not None:
+            pulumi.set(__self__, "account", account)
         if acm is not None:
             pulumi.set(__self__, "acm", acm)
         if acmpca is not None:
@@ -1003,6 +1006,11 @@ def __init__(__self__, *,
     def accessanalyzer(self) -> Optional[str]:
         return pulumi.get(self, "accessanalyzer")
 
+    @property
+    @pulumi.getter
+    def account(self) -> Optional[str]:
+        return pulumi.get(self, "account")
+
     @property
     @pulumi.getter
     def acm(self) -> Optional[str]:
diff --git a/sdk/python/pulumi_aws/dlm/_inputs.py b/sdk/python/pulumi_aws/dlm/_inputs.py
index ff902b5781e..d8e1f60de9f 100644
--- a/sdk/python/pulumi_aws/dlm/_inputs.py
+++ b/sdk/python/pulumi_aws/dlm/_inputs.py
@@ -12,6 +12,9 @@
     'LifecyclePolicyPolicyDetailsArgs',
     'LifecyclePolicyPolicyDetailsScheduleArgs',
     'LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs',
+    'LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs',
+    'LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs',
+    'LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs',
     'LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs',
 ]
 
@@ -74,12 +77,14 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  retain_rule: pulumi.Input['LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs'],
                  copy_tags: Optional[pulumi.Input[bool]] = None,
+                 cross_region_copy_rules: Optional[pulumi.Input[Sequence[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs']]]] = None,
                  tags_to_add: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None):
         """
         :param pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs'] create_rule: See the `create_rule` block. Max of 1 per schedule.
         :param pulumi.Input[str] name: A name for the schedule.
-        :param pulumi.Input['LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs'] retain_rule: See the `retain_rule` block. Max of 1 per schedule.
-        :param pulumi.Input[bool] copy_tags: Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+        :param pulumi.Input['LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs'] retain_rule: The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        :param pulumi.Input[bool] copy_tags: Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        :param pulumi.Input[Sequence[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs']]] cross_region_copy_rules: See the `cross_region_copy_rule` block. Max of 3 per schedule.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_to_add: A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
         """
         pulumi.set(__self__, "create_rule", create_rule)
@@ -87,6 +92,8 @@ def __init__(__self__, *,
         pulumi.set(__self__, "retain_rule", retain_rule)
         if copy_tags is not None:
             pulumi.set(__self__, "copy_tags", copy_tags)
+        if cross_region_copy_rules is not None:
+            pulumi.set(__self__, "cross_region_copy_rules", cross_region_copy_rules)
         if tags_to_add is not None:
             pulumi.set(__self__, "tags_to_add", tags_to_add)
 
@@ -118,7 +125,7 @@ def name(self, value: pulumi.Input[str]):
     @pulumi.getter(name="retainRule")
     def retain_rule(self) -> pulumi.Input['LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs']:
         """
-        See the `retain_rule` block. Max of 1 per schedule.
+        The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
         """
         return pulumi.get(self, "retain_rule")
 
@@ -130,7 +137,7 @@ def retain_rule(self, value: pulumi.Input['LifecyclePolicyPolicyDetailsScheduleR
     @pulumi.getter(name="copyTags")
     def copy_tags(self) -> Optional[pulumi.Input[bool]]:
         """
-        Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+        Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
         """
         return pulumi.get(self, "copy_tags")
 
@@ -138,6 +145,18 @@ def copy_tags(self) -> Optional[pulumi.Input[bool]]:
     def copy_tags(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "copy_tags", value)
 
+    @property
+    @pulumi.getter(name="crossRegionCopyRules")
+    def cross_region_copy_rules(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs']]]]:
+        """
+        See the `cross_region_copy_rule` block. Max of 3 per schedule.
+        """
+        return pulumi.get(self, "cross_region_copy_rules")
+
+    @cross_region_copy_rules.setter
+    def cross_region_copy_rules(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs']]]]):
+        pulumi.set(self, "cross_region_copy_rules", value)
+
     @property
     @pulumi.getter(name="tagsToAdd")
     def tags_to_add(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
@@ -158,8 +177,8 @@ def __init__(__self__, *,
                  interval_unit: Optional[pulumi.Input[str]] = None,
                  times: Optional[pulumi.Input[str]] = None):
         """
-        :param pulumi.Input[int] interval: How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
-        :param pulumi.Input[str] interval_unit: The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+        :param pulumi.Input[int] interval: The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        :param pulumi.Input[str] interval_unit: The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
         :param pulumi.Input[str] times: A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1.
         """
         pulumi.set(__self__, "interval", interval)
@@ -172,7 +191,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def interval(self) -> pulumi.Input[int]:
         """
-        How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+        The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
         """
         return pulumi.get(self, "interval")
 
@@ -184,7 +203,7 @@ def interval(self, value: pulumi.Input[int]):
     @pulumi.getter(name="intervalUnit")
     def interval_unit(self) -> Optional[pulumi.Input[str]]:
         """
-        The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+        The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
         """
         return pulumi.get(self, "interval_unit")
 
@@ -205,6 +224,181 @@ def times(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "times", value)
 
 
+@pulumi.input_type
+class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs:
+    def __init__(__self__, *,
+                 encrypted: pulumi.Input[bool],
+                 target: pulumi.Input[str],
+                 cmk_arn: Optional[pulumi.Input[str]] = None,
+                 copy_tags: Optional[pulumi.Input[bool]] = None,
+                 deprecate_rule: Optional[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs']] = None,
+                 retain_rule: Optional[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs']] = None):
+        """
+        :param pulumi.Input[bool] encrypted: To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+        :param pulumi.Input[str] target: The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+        :param pulumi.Input[str] cmk_arn: The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+        :param pulumi.Input[bool] copy_tags: Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        :param pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs'] deprecate_rule: The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecate_rule` block.
+        :param pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs'] retain_rule: The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        """
+        pulumi.set(__self__, "encrypted", encrypted)
+        pulumi.set(__self__, "target", target)
+        if cmk_arn is not None:
+            pulumi.set(__self__, "cmk_arn", cmk_arn)
+        if copy_tags is not None:
+            pulumi.set(__self__, "copy_tags", copy_tags)
+        if deprecate_rule is not None:
+            pulumi.set(__self__, "deprecate_rule", deprecate_rule)
+        if retain_rule is not None:
+            pulumi.set(__self__, "retain_rule", retain_rule)
+
+    @property
+    @pulumi.getter
+    def encrypted(self) -> pulumi.Input[bool]:
+        """
+        To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+        """
+        return pulumi.get(self, "encrypted")
+
+    @encrypted.setter
+    def encrypted(self, value: pulumi.Input[bool]):
+        pulumi.set(self, "encrypted", value)
+
+    @property
+    @pulumi.getter
+    def target(self) -> pulumi.Input[str]:
+        """
+        The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+        """
+        return pulumi.get(self, "target")
+
+    @target.setter
+    def target(self, value: pulumi.Input[str]):
+        pulumi.set(self, "target", value)
+
+    @property
+    @pulumi.getter(name="cmkArn")
+    def cmk_arn(self) -> Optional[pulumi.Input[str]]:
+        """
+        The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+        """
+        return pulumi.get(self, "cmk_arn")
+
+    @cmk_arn.setter
+    def cmk_arn(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "cmk_arn", value)
+
+    @property
+    @pulumi.getter(name="copyTags")
+    def copy_tags(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        """
+        return pulumi.get(self, "copy_tags")
+
+    @copy_tags.setter
+    def copy_tags(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "copy_tags", value)
+
+    @property
+    @pulumi.getter(name="deprecateRule")
+    def deprecate_rule(self) -> Optional[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs']]:
+        """
+        The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecate_rule` block.
+        """
+        return pulumi.get(self, "deprecate_rule")
+
+    @deprecate_rule.setter
+    def deprecate_rule(self, value: Optional[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs']]):
+        pulumi.set(self, "deprecate_rule", value)
+
+    @property
+    @pulumi.getter(name="retainRule")
+    def retain_rule(self) -> Optional[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs']]:
+        """
+        The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        """
+        return pulumi.get(self, "retain_rule")
+
+    @retain_rule.setter
+    def retain_rule(self, value: Optional[pulumi.Input['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs']]):
+        pulumi.set(self, "retain_rule", value)
+
+
+@pulumi.input_type
+class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs:
+    def __init__(__self__, *,
+                 interval: pulumi.Input[int],
+                 interval_unit: pulumi.Input[str]):
+        """
+        :param pulumi.Input[int] interval: The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        :param pulumi.Input[str] interval_unit: The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        """
+        pulumi.set(__self__, "interval", interval)
+        pulumi.set(__self__, "interval_unit", interval_unit)
+
+    @property
+    @pulumi.getter
+    def interval(self) -> pulumi.Input[int]:
+        """
+        The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        """
+        return pulumi.get(self, "interval")
+
+    @interval.setter
+    def interval(self, value: pulumi.Input[int]):
+        pulumi.set(self, "interval", value)
+
+    @property
+    @pulumi.getter(name="intervalUnit")
+    def interval_unit(self) -> pulumi.Input[str]:
+        """
+        The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        """
+        return pulumi.get(self, "interval_unit")
+
+    @interval_unit.setter
+    def interval_unit(self, value: pulumi.Input[str]):
+        pulumi.set(self, "interval_unit", value)
+
+
+@pulumi.input_type
+class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs:
+    def __init__(__self__, *,
+                 interval: pulumi.Input[int],
+                 interval_unit: pulumi.Input[str]):
+        """
+        :param pulumi.Input[int] interval: The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        :param pulumi.Input[str] interval_unit: The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        """
+        pulumi.set(__self__, "interval", interval)
+        pulumi.set(__self__, "interval_unit", interval_unit)
+
+    @property
+    @pulumi.getter
+    def interval(self) -> pulumi.Input[int]:
+        """
+        The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        """
+        return pulumi.get(self, "interval")
+
+    @interval.setter
+    def interval(self, value: pulumi.Input[int]):
+        pulumi.set(self, "interval", value)
+
+    @property
+    @pulumi.getter(name="intervalUnit")
+    def interval_unit(self) -> pulumi.Input[str]:
+        """
+        The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        """
+        return pulumi.get(self, "interval_unit")
+
+    @interval_unit.setter
+    def interval_unit(self, value: pulumi.Input[str]):
+        pulumi.set(self, "interval_unit", value)
+
+
 @pulumi.input_type
 class LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs:
     def __init__(__self__, *,
diff --git a/sdk/python/pulumi_aws/dlm/lifecycle_policy.py b/sdk/python/pulumi_aws/dlm/lifecycle_policy.py
index a5b55b625f9..166b7bede40 100644
--- a/sdk/python/pulumi_aws/dlm/lifecycle_policy.py
+++ b/sdk/python/pulumi_aws/dlm/lifecycle_policy.py
@@ -232,6 +232,7 @@ def __init__(__self__,
         Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
 
         ## Example Usage
+        ### Basic
 
         ```python
         import pulumi
@@ -304,10 +305,72 @@ def __init__(__self__,
                 },
             ))
         ```
+        ### Example Cross-Region Snapshot Copy Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        # ...other configuration...
+        dlm_cross_region_copy_cmk = aws.kms.Key("dlmCrossRegionCopyCmk",
+            description="Example Alternate Region KMS Key",
+            policy=\"\"\"{
+          "Version": "2012-10-17",
+          "Id": "dlm-cross-region-copy-cmk",
+          "Statement": [
+            {
+              "Sid": "Enable IAM User Permissions",
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": "*"
+              },
+              "Action": "kms:*",
+              "Resource": "*"
+            }
+          ]
+        }
+        \"\"\",
+            opts=pulumi.ResourceOptions(provider=aws["alternate"]))
+        example = aws.dlm.LifecyclePolicy("example",
+            description="example DLM lifecycle policy",
+            execution_role_arn=aws_iam_role["dlm_lifecycle_role"]["arn"],
+            state="ENABLED",
+            policy_details=aws.dlm.LifecyclePolicyPolicyDetailsArgs(
+                resource_types=["VOLUME"],
+                schedules=[aws.dlm.LifecyclePolicyPolicyDetailsScheduleArgs(
+                    name="2 weeks of daily snapshots",
+                    create_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs(
+                        interval=24,
+                        interval_unit="HOURS",
+                        times=["23:45"],
+                    ),
+                    retain_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs(
+                        count=14,
+                    ),
+                    tags_to_add={
+                        "SnapshotCreator": "DLM",
+                    },
+                    copy_tags=False,
+                    cross_region_copy_rules=[aws.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs(
+                        target="us-west-2",
+                        encrypted=True,
+                        cmk_arn=dlm_cross_region_copy_cmk.arn,
+                        copy_tags=True,
+                        retain_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs(
+                            interval=30,
+                            interval_unit="DAYS",
+                        ),
+                    )],
+                )],
+                target_tags={
+                    "Snapshot": "true",
+                },
+            ))
+        ```
 
         ## Import
 
-        DLM lifecyle policies can be imported by their policy ID
+        DLM lifecycle policies can be imported by their policy ID
 
         ```sh
          $ pulumi import aws:dlm/lifecyclePolicy:LifecyclePolicy example policy-abcdef12345678901
@@ -331,6 +394,7 @@ def __init__(__self__,
         Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
 
         ## Example Usage
+        ### Basic
 
         ```python
         import pulumi
@@ -403,10 +467,72 @@ def __init__(__self__,
                 },
             ))
         ```
+        ### Example Cross-Region Snapshot Copy Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        # ...other configuration...
+        dlm_cross_region_copy_cmk = aws.kms.Key("dlmCrossRegionCopyCmk",
+            description="Example Alternate Region KMS Key",
+            policy=\"\"\"{
+          "Version": "2012-10-17",
+          "Id": "dlm-cross-region-copy-cmk",
+          "Statement": [
+            {
+              "Sid": "Enable IAM User Permissions",
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": "*"
+              },
+              "Action": "kms:*",
+              "Resource": "*"
+            }
+          ]
+        }
+        \"\"\",
+            opts=pulumi.ResourceOptions(provider=aws["alternate"]))
+        example = aws.dlm.LifecyclePolicy("example",
+            description="example DLM lifecycle policy",
+            execution_role_arn=aws_iam_role["dlm_lifecycle_role"]["arn"],
+            state="ENABLED",
+            policy_details=aws.dlm.LifecyclePolicyPolicyDetailsArgs(
+                resource_types=["VOLUME"],
+                schedules=[aws.dlm.LifecyclePolicyPolicyDetailsScheduleArgs(
+                    name="2 weeks of daily snapshots",
+                    create_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs(
+                        interval=24,
+                        interval_unit="HOURS",
+                        times=["23:45"],
+                    ),
+                    retain_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs(
+                        count=14,
+                    ),
+                    tags_to_add={
+                        "SnapshotCreator": "DLM",
+                    },
+                    copy_tags=False,
+                    cross_region_copy_rules=[aws.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs(
+                        target="us-west-2",
+                        encrypted=True,
+                        cmk_arn=dlm_cross_region_copy_cmk.arn,
+                        copy_tags=True,
+                        retain_rule=aws.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs(
+                            interval=30,
+                            interval_unit="DAYS",
+                        ),
+                    )],
+                )],
+                target_tags={
+                    "Snapshot": "true",
+                },
+            ))
+        ```
 
         ## Import
 
-        DLM lifecyle policies can be imported by their policy ID
+        DLM lifecycle policies can be imported by their policy ID
 
         ```sh
          $ pulumi import aws:dlm/lifecyclePolicy:LifecyclePolicy example policy-abcdef12345678901
diff --git a/sdk/python/pulumi_aws/dlm/outputs.py b/sdk/python/pulumi_aws/dlm/outputs.py
index f002cdb0184..7d79f6af4c2 100644
--- a/sdk/python/pulumi_aws/dlm/outputs.py
+++ b/sdk/python/pulumi_aws/dlm/outputs.py
@@ -13,6 +13,9 @@
     'LifecyclePolicyPolicyDetails',
     'LifecyclePolicyPolicyDetailsSchedule',
     'LifecyclePolicyPolicyDetailsScheduleCreateRule',
+    'LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule',
+    'LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule',
+    'LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule',
     'LifecyclePolicyPolicyDetailsScheduleRetainRule',
 ]
 
@@ -86,6 +89,8 @@ def __key_warning(key: str):
             suggest = "retain_rule"
         elif key == "copyTags":
             suggest = "copy_tags"
+        elif key == "crossRegionCopyRules":
+            suggest = "cross_region_copy_rules"
         elif key == "tagsToAdd":
             suggest = "tags_to_add"
 
@@ -105,12 +110,14 @@ def __init__(__self__, *,
                  name: str,
                  retain_rule: 'outputs.LifecyclePolicyPolicyDetailsScheduleRetainRule',
                  copy_tags: Optional[bool] = None,
+                 cross_region_copy_rules: Optional[Sequence['outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule']] = None,
                  tags_to_add: Optional[Mapping[str, str]] = None):
         """
         :param 'LifecyclePolicyPolicyDetailsScheduleCreateRuleArgs' create_rule: See the `create_rule` block. Max of 1 per schedule.
         :param str name: A name for the schedule.
-        :param 'LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs' retain_rule: See the `retain_rule` block. Max of 1 per schedule.
-        :param bool copy_tags: Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+        :param 'LifecyclePolicyPolicyDetailsScheduleRetainRuleArgs' retain_rule: The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        :param bool copy_tags: Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        :param Sequence['LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleArgs'] cross_region_copy_rules: See the `cross_region_copy_rule` block. Max of 3 per schedule.
         :param Mapping[str, str] tags_to_add: A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
         """
         pulumi.set(__self__, "create_rule", create_rule)
@@ -118,6 +125,8 @@ def __init__(__self__, *,
         pulumi.set(__self__, "retain_rule", retain_rule)
         if copy_tags is not None:
             pulumi.set(__self__, "copy_tags", copy_tags)
+        if cross_region_copy_rules is not None:
+            pulumi.set(__self__, "cross_region_copy_rules", cross_region_copy_rules)
         if tags_to_add is not None:
             pulumi.set(__self__, "tags_to_add", tags_to_add)
 
@@ -141,7 +150,7 @@ def name(self) -> str:
     @pulumi.getter(name="retainRule")
     def retain_rule(self) -> 'outputs.LifecyclePolicyPolicyDetailsScheduleRetainRule':
         """
-        See the `retain_rule` block. Max of 1 per schedule.
+        The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
         """
         return pulumi.get(self, "retain_rule")
 
@@ -149,10 +158,18 @@ def retain_rule(self) -> 'outputs.LifecyclePolicyPolicyDetailsScheduleRetainRule
     @pulumi.getter(name="copyTags")
     def copy_tags(self) -> Optional[bool]:
         """
-        Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+        Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
         """
         return pulumi.get(self, "copy_tags")
 
+    @property
+    @pulumi.getter(name="crossRegionCopyRules")
+    def cross_region_copy_rules(self) -> Optional[Sequence['outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule']]:
+        """
+        See the `cross_region_copy_rule` block. Max of 3 per schedule.
+        """
+        return pulumi.get(self, "cross_region_copy_rules")
+
     @property
     @pulumi.getter(name="tagsToAdd")
     def tags_to_add(self) -> Optional[Mapping[str, str]]:
@@ -186,8 +203,8 @@ def __init__(__self__, *,
                  interval_unit: Optional[str] = None,
                  times: Optional[str] = None):
         """
-        :param int interval: How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
-        :param str interval_unit: The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+        :param int interval: The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        :param str interval_unit: The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
         :param str times: A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1.
         """
         pulumi.set(__self__, "interval", interval)
@@ -200,7 +217,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def interval(self) -> int:
         """
-        How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+        The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
         """
         return pulumi.get(self, "interval")
 
@@ -208,7 +225,7 @@ def interval(self) -> int:
     @pulumi.getter(name="intervalUnit")
     def interval_unit(self) -> Optional[str]:
         """
-        The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+        The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
         """
         return pulumi.get(self, "interval_unit")
 
@@ -221,6 +238,198 @@ def times(self) -> Optional[str]:
         return pulumi.get(self, "times")
 
 
+@pulumi.output_type
+class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "cmkArn":
+            suggest = "cmk_arn"
+        elif key == "copyTags":
+            suggest = "copy_tags"
+        elif key == "deprecateRule":
+            suggest = "deprecate_rule"
+        elif key == "retainRule":
+            suggest = "retain_rule"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 encrypted: bool,
+                 target: str,
+                 cmk_arn: Optional[str] = None,
+                 copy_tags: Optional[bool] = None,
+                 deprecate_rule: Optional['outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule'] = None,
+                 retain_rule: Optional['outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule'] = None):
+        """
+        :param bool encrypted: To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+        :param str target: The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+        :param str cmk_arn: The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+        :param bool copy_tags: Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        :param 'LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRuleArgs' deprecate_rule: The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecate_rule` block.
+        :param 'LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRuleArgs' retain_rule: The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        """
+        pulumi.set(__self__, "encrypted", encrypted)
+        pulumi.set(__self__, "target", target)
+        if cmk_arn is not None:
+            pulumi.set(__self__, "cmk_arn", cmk_arn)
+        if copy_tags is not None:
+            pulumi.set(__self__, "copy_tags", copy_tags)
+        if deprecate_rule is not None:
+            pulumi.set(__self__, "deprecate_rule", deprecate_rule)
+        if retain_rule is not None:
+            pulumi.set(__self__, "retain_rule", retain_rule)
+
+    @property
+    @pulumi.getter
+    def encrypted(self) -> bool:
+        """
+        To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+        """
+        return pulumi.get(self, "encrypted")
+
+    @property
+    @pulumi.getter
+    def target(self) -> str:
+        """
+        The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+        """
+        return pulumi.get(self, "target")
+
+    @property
+    @pulumi.getter(name="cmkArn")
+    def cmk_arn(self) -> Optional[str]:
+        """
+        The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+        """
+        return pulumi.get(self, "cmk_arn")
+
+    @property
+    @pulumi.getter(name="copyTags")
+    def copy_tags(self) -> Optional[bool]:
+        """
+        Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+        """
+        return pulumi.get(self, "copy_tags")
+
+    @property
+    @pulumi.getter(name="deprecateRule")
+    def deprecate_rule(self) -> Optional['outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule']:
+        """
+        The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecate_rule` block.
+        """
+        return pulumi.get(self, "deprecate_rule")
+
+    @property
+    @pulumi.getter(name="retainRule")
+    def retain_rule(self) -> Optional['outputs.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule']:
+        """
+        The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retain_rule` block. Max of 1 per schedule.
+        """
+        return pulumi.get(self, "retain_rule")
+
+
+@pulumi.output_type
+class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "intervalUnit":
+            suggest = "interval_unit"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 interval: int,
+                 interval_unit: str):
+        """
+        :param int interval: The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        :param str interval_unit: The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        """
+        pulumi.set(__self__, "interval", interval)
+        pulumi.set(__self__, "interval_unit", interval_unit)
+
+    @property
+    @pulumi.getter
+    def interval(self) -> int:
+        """
+        The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        """
+        return pulumi.get(self, "interval")
+
+    @property
+    @pulumi.getter(name="intervalUnit")
+    def interval_unit(self) -> str:
+        """
+        The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        """
+        return pulumi.get(self, "interval_unit")
+
+
+@pulumi.output_type
+class LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "intervalUnit":
+            suggest = "interval_unit"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 interval: int,
+                 interval_unit: str):
+        """
+        :param int interval: The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        :param str interval_unit: The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        """
+        pulumi.set(__self__, "interval", interval)
+        pulumi.set(__self__, "interval_unit", interval_unit)
+
+    @property
+    @pulumi.getter
+    def interval(self) -> int:
+        """
+        The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+        """
+        return pulumi.get(self, "interval")
+
+    @property
+    @pulumi.getter(name="intervalUnit")
+    def interval_unit(self) -> str:
+        """
+        The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+        """
+        return pulumi.get(self, "interval_unit")
+
+
 @pulumi.output_type
 class LifecyclePolicyPolicyDetailsScheduleRetainRule(dict):
     def __init__(__self__, *,
diff --git a/sdk/python/pulumi_aws/ec2/__init__.py b/sdk/python/pulumi_aws/ec2/__init__.py
index 7abb7c4b29e..cd0df6de9ae 100644
--- a/sdk/python/pulumi_aws/ec2/__init__.py
+++ b/sdk/python/pulumi_aws/ec2/__init__.py
@@ -37,6 +37,7 @@
 from .get_instance_type import *
 from .get_instance_type_offering import *
 from .get_instance_type_offerings import *
+from .get_instance_types import *
 from .get_instances import *
 from .get_internet_gateway import *
 from .get_key_pair import *
diff --git a/sdk/python/pulumi_aws/ec2/_inputs.py b/sdk/python/pulumi_aws/ec2/_inputs.py
index a690a8e90e3..2f9cfaea249 100644
--- a/sdk/python/pulumi_aws/ec2/_inputs.py
+++ b/sdk/python/pulumi_aws/ec2/_inputs.py
@@ -115,6 +115,7 @@
     'GetInstanceTypeInstanceDiskArgs',
     'GetInstanceTypeOfferingFilterArgs',
     'GetInstanceTypeOfferingsFilterArgs',
+    'GetInstanceTypesFilterArgs',
     'GetInstancesFilterArgs',
     'GetInternetGatewayFilterArgs',
     'GetKeyPairFilterArgs',
@@ -7523,6 +7524,43 @@ def values(self, value: Sequence[str]):
         pulumi.set(self, "values", value)
 
 
+@pulumi.input_type
+class GetInstanceTypesFilterArgs:
+    def __init__(__self__, *,
+                 name: str,
+                 values: Sequence[str]):
+        """
+        :param str name: Name of the filter.
+        :param Sequence[str] values: List of one or more values for the filter.
+        """
+        pulumi.set(__self__, "name", name)
+        pulumi.set(__self__, "values", values)
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        """
+        Name of the filter.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: str):
+        pulumi.set(self, "name", value)
+
+    @property
+    @pulumi.getter
+    def values(self) -> Sequence[str]:
+        """
+        List of one or more values for the filter.
+        """
+        return pulumi.get(self, "values")
+
+    @values.setter
+    def values(self, value: Sequence[str]):
+        pulumi.set(self, "values", value)
+
+
 @pulumi.input_type
 class GetInstancesFilterArgs:
     def __init__(__self__, *,
diff --git a/sdk/python/pulumi_aws/ec2/get_instance_types.py b/sdk/python/pulumi_aws/ec2/get_instance_types.py
new file mode 100644
index 00000000000..b61171444dc
--- /dev/null
+++ b/sdk/python/pulumi_aws/ec2/get_instance_types.py
@@ -0,0 +1,158 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from .. import _utilities
+from . import outputs
+from ._inputs import *
+
+__all__ = [
+    'GetInstanceTypesResult',
+    'AwaitableGetInstanceTypesResult',
+    'get_instance_types',
+    'get_instance_types_output',
+]
+
+@pulumi.output_type
+class GetInstanceTypesResult:
+    """
+    A collection of values returned by getInstanceTypes.
+    """
+    def __init__(__self__, filters=None, id=None, instance_types=None):
+        if filters and not isinstance(filters, list):
+            raise TypeError("Expected argument 'filters' to be a list")
+        pulumi.set(__self__, "filters", filters)
+        if id and not isinstance(id, str):
+            raise TypeError("Expected argument 'id' to be a str")
+        pulumi.set(__self__, "id", id)
+        if instance_types and not isinstance(instance_types, list):
+            raise TypeError("Expected argument 'instance_types' to be a list")
+        pulumi.set(__self__, "instance_types", instance_types)
+
+    @property
+    @pulumi.getter
+    def filters(self) -> Optional[Sequence['outputs.GetInstanceTypesFilterResult']]:
+        return pulumi.get(self, "filters")
+
+    @property
+    @pulumi.getter
+    def id(self) -> str:
+        """
+        The provider-assigned unique ID for this managed resource.
+        """
+        return pulumi.get(self, "id")
+
+    @property
+    @pulumi.getter(name="instanceTypes")
+    def instance_types(self) -> Sequence[str]:
+        """
+        List of EC2 Instance Types.
+        """
+        return pulumi.get(self, "instance_types")
+
+
+class AwaitableGetInstanceTypesResult(GetInstanceTypesResult):
+    # pylint: disable=using-constant-test
+    def __await__(self):
+        if False:
+            yield self
+        return GetInstanceTypesResult(
+            filters=self.filters,
+            id=self.id,
+            instance_types=self.instance_types)
+
+
+def get_instance_types(filters: Optional[Sequence[pulumi.InputType['GetInstanceTypesFilterArgs']]] = None,
+                       opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetInstanceTypesResult:
+    """
+    Information about EC2 Instance Types.
+
+    ## Example Usage
+
+    ```python
+    import pulumi
+    import pulumi_aws as aws
+
+    test = aws.ec2.get_instance_types(filters=[
+        aws.ec2.GetInstanceTypesFilterArgs(
+            name="auto-recovery-supported",
+            values=["true"],
+        ),
+        aws.ec2.GetInstanceTypesFilterArgs(
+            name="network-info.encryption-in-transit-supported",
+            values=["true"],
+        ),
+        aws.ec2.GetInstanceTypesFilterArgs(
+            name="instance-storage-supported",
+            values=["true"],
+        ),
+        aws.ec2.GetInstanceTypesFilterArgs(
+            name="instance-type",
+            values=[
+                "g5.2xlarge",
+                "g5.4xlarge",
+            ],
+        ),
+    ])
+    ```
+
+
+    :param Sequence[pulumi.InputType['GetInstanceTypesFilterArgs']] filters: One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
+    """
+    __args__ = dict()
+    __args__['filters'] = filters
+    if opts is None:
+        opts = pulumi.InvokeOptions()
+    if opts.version is None:
+        opts.version = _utilities.get_version()
+    __ret__ = pulumi.runtime.invoke('aws:ec2/getInstanceTypes:getInstanceTypes', __args__, opts=opts, typ=GetInstanceTypesResult).value
+
+    return AwaitableGetInstanceTypesResult(
+        filters=__ret__.filters,
+        id=__ret__.id,
+        instance_types=__ret__.instance_types)
+
+
+@_utilities.lift_output_func(get_instance_types)
+def get_instance_types_output(filters: Optional[pulumi.Input[Optional[Sequence[pulumi.InputType['GetInstanceTypesFilterArgs']]]]] = None,
+                              opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetInstanceTypesResult]:
+    """
+    Information about EC2 Instance Types.
+
+    ## Example Usage
+
+    ```python
+    import pulumi
+    import pulumi_aws as aws
+
+    test = aws.ec2.get_instance_types(filters=[
+        aws.ec2.GetInstanceTypesFilterArgs(
+            name="auto-recovery-supported",
+            values=["true"],
+        ),
+        aws.ec2.GetInstanceTypesFilterArgs(
+            name="network-info.encryption-in-transit-supported",
+            values=["true"],
+        ),
+        aws.ec2.GetInstanceTypesFilterArgs(
+            name="instance-storage-supported",
+            values=["true"],
+        ),
+        aws.ec2.GetInstanceTypesFilterArgs(
+            name="instance-type",
+            values=[
+                "g5.2xlarge",
+                "g5.4xlarge",
+            ],
+        ),
+    ])
+    ```
+
+
+    :param Sequence[pulumi.InputType['GetInstanceTypesFilterArgs']] filters: One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
+    """
+    ...
diff --git a/sdk/python/pulumi_aws/ec2/outputs.py b/sdk/python/pulumi_aws/ec2/outputs.py
index 23966fa5dd7..76dd5a64eea 100644
--- a/sdk/python/pulumi_aws/ec2/outputs.py
+++ b/sdk/python/pulumi_aws/ec2/outputs.py
@@ -124,6 +124,7 @@
     'GetInstanceTypeInstanceDiskResult',
     'GetInstanceTypeOfferingFilterResult',
     'GetInstanceTypeOfferingsFilterResult',
+    'GetInstanceTypesFilterResult',
     'GetInstancesFilterResult',
     'GetInternetGatewayAttachmentResult',
     'GetInternetGatewayFilterResult',
@@ -8001,6 +8002,35 @@ def values(self) -> Sequence[str]:
         return pulumi.get(self, "values")
 
 
+@pulumi.output_type
+class GetInstanceTypesFilterResult(dict):
+    def __init__(__self__, *,
+                 name: str,
+                 values: Sequence[str]):
+        """
+        :param str name: Name of the filter.
+        :param Sequence[str] values: List of one or more values for the filter.
+        """
+        pulumi.set(__self__, "name", name)
+        pulumi.set(__self__, "values", values)
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        """
+        Name of the filter.
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter
+    def values(self) -> Sequence[str]:
+        """
+        List of one or more values for the filter.
+        """
+        return pulumi.get(self, "values")
+
+
 @pulumi.output_type
 class GetInstancesFilterResult(dict):
     def __init__(__self__, *,
diff --git a/sdk/python/pulumi_aws/ecs/capacity_provider.py b/sdk/python/pulumi_aws/ecs/capacity_provider.py
index 5de41838974..097fad86569 100644
--- a/sdk/python/pulumi_aws/ecs/capacity_provider.py
+++ b/sdk/python/pulumi_aws/ecs/capacity_provider.py
@@ -166,7 +166,7 @@ def __init__(__self__,
         # ... other configuration, including potentially other tags ...
         test_group = aws.autoscaling.Group("testGroup", tags=[aws.autoscaling.GroupTagArgs(
             key="AmazonECSManaged",
-            value="",
+            value="true",
             propagate_at_launch=True,
         )])
         test_capacity_provider = aws.ecs.CapacityProvider("testCapacityProvider", auto_scaling_group_provider=aws.ecs.CapacityProviderAutoScalingGroupProviderArgs(
@@ -214,7 +214,7 @@ def __init__(__self__,
         # ... other configuration, including potentially other tags ...
         test_group = aws.autoscaling.Group("testGroup", tags=[aws.autoscaling.GroupTagArgs(
             key="AmazonECSManaged",
-            value="",
+            value="true",
             propagate_at_launch=True,
         )])
         test_capacity_provider = aws.ecs.CapacityProvider("testCapacityProvider", auto_scaling_group_provider=aws.ecs.CapacityProviderAutoScalingGroupProviderArgs(
diff --git a/sdk/python/pulumi_aws/ecs/service.py b/sdk/python/pulumi_aws/ecs/service.py
index fa4b8d6dcc7..e334ee7ddab 100644
--- a/sdk/python/pulumi_aws/ecs/service.py
+++ b/sdk/python/pulumi_aws/ecs/service.py
@@ -42,10 +42,10 @@ def __init__(__self__, *,
                  wait_for_steady_state: Optional[pulumi.Input[bool]] = None):
         """
         The set of arguments for constructing a Service resource.
-        :param pulumi.Input[Sequence[pulumi.Input['ServiceCapacityProviderStrategyArgs']]] capacity_provider_strategies: Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
-        :param pulumi.Input[str] cluster: ARN of an ECS cluster
-        :param pulumi.Input['ServiceDeploymentCircuitBreakerArgs'] deployment_circuit_breaker: Configuration block for deployment circuit breaker. Detailed below.
-        :param pulumi.Input['ServiceDeploymentControllerArgs'] deployment_controller: Configuration block for deployment controller configuration. Detailed below.
+        :param pulumi.Input[Sequence[pulumi.Input['ServiceCapacityProviderStrategyArgs']]] capacity_provider_strategies: Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
+        :param pulumi.Input[str] cluster: ARN of an ECS cluster.
+        :param pulumi.Input['ServiceDeploymentCircuitBreakerArgs'] deployment_circuit_breaker: Configuration block for deployment circuit breaker. See below.
+        :param pulumi.Input['ServiceDeploymentControllerArgs'] deployment_controller: Configuration block for deployment controller configuration. See below.
         :param pulumi.Input[int] deployment_maximum_percent: Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
         :param pulumi.Input[int] deployment_minimum_healthy_percent: Lower limit (as a percentage of the service's desiredCount) of the number of running tasks that must remain running and healthy in a service during a deployment.
         :param pulumi.Input[int] desired_count: Number of instances of the task definition to place and keep running. Defaults to 0. Do not specify if using the `DAEMON` scheduling strategy.
@@ -55,16 +55,16 @@ def __init__(__self__, *,
         :param pulumi.Input[int] health_check_grace_period_seconds: Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 2147483647. Only valid for services configured to use load balancers.
         :param pulumi.Input[str] iam_role: ARN of the IAM role that allows Amazon ECS to make calls to your load balancer on your behalf. This parameter is required if you are using a load balancer with your service, but only if your task definition does not use the `awsvpc` network mode. If using `awsvpc` network mode, do not specify this role. If your account has already created the Amazon ECS service-linked role, that role is used by default for your service unless you specify a role here.
         :param pulumi.Input[str] launch_type: Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
-        :param pulumi.Input[Sequence[pulumi.Input['ServiceLoadBalancerArgs']]] load_balancers: Configuration block for load balancers. Detailed below.
+        :param pulumi.Input[Sequence[pulumi.Input['ServiceLoadBalancerArgs']]] load_balancers: Configuration block for load balancers. See below.
         :param pulumi.Input[str] name: Name of the service (up to 255 letters, numbers, hyphens, and underscores)
-        :param pulumi.Input['ServiceNetworkConfigurationArgs'] network_configuration: Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
-        :param pulumi.Input[Sequence[pulumi.Input['ServiceOrderedPlacementStrategyArgs']]] ordered_placement_strategies: Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
-        :param pulumi.Input[Sequence[pulumi.Input['ServicePlacementConstraintArgs']]] placement_constraints: Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        :param pulumi.Input['ServiceNetworkConfigurationArgs'] network_configuration: Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
+        :param pulumi.Input[Sequence[pulumi.Input['ServiceOrderedPlacementStrategyArgs']]] ordered_placement_strategies: Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
+        :param pulumi.Input[Sequence[pulumi.Input['ServicePlacementConstraintArgs']]] placement_constraints: Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         :param pulumi.Input[str] platform_version: Platform version on which to run your service. Only applicable for `launch_type` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
         :param pulumi.Input[str] propagate_tags: Specifies whether to propagate the tags from the task definition or the service to the tasks. The valid values are `SERVICE` and `TASK_DEFINITION`.
         :param pulumi.Input[str] scheduling_strategy: Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
-        :param pulumi.Input['ServiceServiceRegistriesArgs'] service_registries: Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value map of resource tags.
+        :param pulumi.Input['ServiceServiceRegistriesArgs'] service_registries: Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[str] task_definition: Family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service. Required unless using the `EXTERNAL` deployment controller. If a revision is not specified, the latest `ACTIVE` revision is used.
         :param pulumi.Input[bool] wait_for_steady_state: If `true`, this provider will wait for the service to reach a steady state (like [`aws ecs wait services-stable`](https://docs.aws.amazon.com/cli/latest/reference/ecs/wait/services-stable.html)) before continuing. Default `false`.
         """
@@ -123,7 +123,7 @@ def __init__(__self__, *,
     @pulumi.getter(name="capacityProviderStrategies")
     def capacity_provider_strategies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ServiceCapacityProviderStrategyArgs']]]]:
         """
-        Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+        Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
         """
         return pulumi.get(self, "capacity_provider_strategies")
 
@@ -135,7 +135,7 @@ def capacity_provider_strategies(self, value: Optional[pulumi.Input[Sequence[pul
     @pulumi.getter
     def cluster(self) -> Optional[pulumi.Input[str]]:
         """
-        ARN of an ECS cluster
+        ARN of an ECS cluster.
         """
         return pulumi.get(self, "cluster")
 
@@ -147,7 +147,7 @@ def cluster(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="deploymentCircuitBreaker")
     def deployment_circuit_breaker(self) -> Optional[pulumi.Input['ServiceDeploymentCircuitBreakerArgs']]:
         """
-        Configuration block for deployment circuit breaker. Detailed below.
+        Configuration block for deployment circuit breaker. See below.
         """
         return pulumi.get(self, "deployment_circuit_breaker")
 
@@ -159,7 +159,7 @@ def deployment_circuit_breaker(self, value: Optional[pulumi.Input['ServiceDeploy
     @pulumi.getter(name="deploymentController")
     def deployment_controller(self) -> Optional[pulumi.Input['ServiceDeploymentControllerArgs']]:
         """
-        Configuration block for deployment controller configuration. Detailed below.
+        Configuration block for deployment controller configuration. See below.
         """
         return pulumi.get(self, "deployment_controller")
 
@@ -279,7 +279,7 @@ def launch_type(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="loadBalancers")
     def load_balancers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ServiceLoadBalancerArgs']]]]:
         """
-        Configuration block for load balancers. Detailed below.
+        Configuration block for load balancers. See below.
         """
         return pulumi.get(self, "load_balancers")
 
@@ -303,7 +303,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="networkConfiguration")
     def network_configuration(self) -> Optional[pulumi.Input['ServiceNetworkConfigurationArgs']]:
         """
-        Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+        Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
         """
         return pulumi.get(self, "network_configuration")
 
@@ -315,7 +315,7 @@ def network_configuration(self, value: Optional[pulumi.Input['ServiceNetworkConf
     @pulumi.getter(name="orderedPlacementStrategies")
     def ordered_placement_strategies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ServiceOrderedPlacementStrategyArgs']]]]:
         """
-        Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
+        Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
         """
         return pulumi.get(self, "ordered_placement_strategies")
 
@@ -327,7 +327,7 @@ def ordered_placement_strategies(self, value: Optional[pulumi.Input[Sequence[pul
     @pulumi.getter(name="placementConstraints")
     def placement_constraints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ServicePlacementConstraintArgs']]]]:
         """
-        Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         """
         return pulumi.get(self, "placement_constraints")
 
@@ -375,7 +375,7 @@ def scheduling_strategy(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="serviceRegistries")
     def service_registries(self) -> Optional[pulumi.Input['ServiceServiceRegistriesArgs']]:
         """
-        Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
+        Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
         """
         return pulumi.get(self, "service_registries")
 
@@ -387,7 +387,7 @@ def service_registries(self, value: Optional[pulumi.Input['ServiceServiceRegistr
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        Key-value map of resource tags.
+        Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -451,10 +451,10 @@ def __init__(__self__, *,
                  wait_for_steady_state: Optional[pulumi.Input[bool]] = None):
         """
         Input properties used for looking up and filtering Service resources.
-        :param pulumi.Input[Sequence[pulumi.Input['ServiceCapacityProviderStrategyArgs']]] capacity_provider_strategies: Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
-        :param pulumi.Input[str] cluster: ARN of an ECS cluster
-        :param pulumi.Input['ServiceDeploymentCircuitBreakerArgs'] deployment_circuit_breaker: Configuration block for deployment circuit breaker. Detailed below.
-        :param pulumi.Input['ServiceDeploymentControllerArgs'] deployment_controller: Configuration block for deployment controller configuration. Detailed below.
+        :param pulumi.Input[Sequence[pulumi.Input['ServiceCapacityProviderStrategyArgs']]] capacity_provider_strategies: Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
+        :param pulumi.Input[str] cluster: ARN of an ECS cluster.
+        :param pulumi.Input['ServiceDeploymentCircuitBreakerArgs'] deployment_circuit_breaker: Configuration block for deployment circuit breaker. See below.
+        :param pulumi.Input['ServiceDeploymentControllerArgs'] deployment_controller: Configuration block for deployment controller configuration. See below.
         :param pulumi.Input[int] deployment_maximum_percent: Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
         :param pulumi.Input[int] deployment_minimum_healthy_percent: Lower limit (as a percentage of the service's desiredCount) of the number of running tasks that must remain running and healthy in a service during a deployment.
         :param pulumi.Input[int] desired_count: Number of instances of the task definition to place and keep running. Defaults to 0. Do not specify if using the `DAEMON` scheduling strategy.
@@ -464,16 +464,16 @@ def __init__(__self__, *,
         :param pulumi.Input[int] health_check_grace_period_seconds: Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 2147483647. Only valid for services configured to use load balancers.
         :param pulumi.Input[str] iam_role: ARN of the IAM role that allows Amazon ECS to make calls to your load balancer on your behalf. This parameter is required if you are using a load balancer with your service, but only if your task definition does not use the `awsvpc` network mode. If using `awsvpc` network mode, do not specify this role. If your account has already created the Amazon ECS service-linked role, that role is used by default for your service unless you specify a role here.
         :param pulumi.Input[str] launch_type: Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
-        :param pulumi.Input[Sequence[pulumi.Input['ServiceLoadBalancerArgs']]] load_balancers: Configuration block for load balancers. Detailed below.
+        :param pulumi.Input[Sequence[pulumi.Input['ServiceLoadBalancerArgs']]] load_balancers: Configuration block for load balancers. See below.
         :param pulumi.Input[str] name: Name of the service (up to 255 letters, numbers, hyphens, and underscores)
-        :param pulumi.Input['ServiceNetworkConfigurationArgs'] network_configuration: Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
-        :param pulumi.Input[Sequence[pulumi.Input['ServiceOrderedPlacementStrategyArgs']]] ordered_placement_strategies: Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
-        :param pulumi.Input[Sequence[pulumi.Input['ServicePlacementConstraintArgs']]] placement_constraints: Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        :param pulumi.Input['ServiceNetworkConfigurationArgs'] network_configuration: Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
+        :param pulumi.Input[Sequence[pulumi.Input['ServiceOrderedPlacementStrategyArgs']]] ordered_placement_strategies: Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
+        :param pulumi.Input[Sequence[pulumi.Input['ServicePlacementConstraintArgs']]] placement_constraints: Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         :param pulumi.Input[str] platform_version: Platform version on which to run your service. Only applicable for `launch_type` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
         :param pulumi.Input[str] propagate_tags: Specifies whether to propagate the tags from the task definition or the service to the tasks. The valid values are `SERVICE` and `TASK_DEFINITION`.
         :param pulumi.Input[str] scheduling_strategy: Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
-        :param pulumi.Input['ServiceServiceRegistriesArgs'] service_registries: Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value map of resource tags.
+        :param pulumi.Input['ServiceServiceRegistriesArgs'] service_registries: Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider `default_tags` configuration block.
         :param pulumi.Input[str] task_definition: Family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service. Required unless using the `EXTERNAL` deployment controller. If a revision is not specified, the latest `ACTIVE` revision is used.
         :param pulumi.Input[bool] wait_for_steady_state: If `true`, this provider will wait for the service to reach a steady state (like [`aws ecs wait services-stable`](https://docs.aws.amazon.com/cli/latest/reference/ecs/wait/services-stable.html)) before continuing. Default `false`.
@@ -535,7 +535,7 @@ def __init__(__self__, *,
     @pulumi.getter(name="capacityProviderStrategies")
     def capacity_provider_strategies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ServiceCapacityProviderStrategyArgs']]]]:
         """
-        Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+        Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
         """
         return pulumi.get(self, "capacity_provider_strategies")
 
@@ -547,7 +547,7 @@ def capacity_provider_strategies(self, value: Optional[pulumi.Input[Sequence[pul
     @pulumi.getter
     def cluster(self) -> Optional[pulumi.Input[str]]:
         """
-        ARN of an ECS cluster
+        ARN of an ECS cluster.
         """
         return pulumi.get(self, "cluster")
 
@@ -559,7 +559,7 @@ def cluster(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="deploymentCircuitBreaker")
     def deployment_circuit_breaker(self) -> Optional[pulumi.Input['ServiceDeploymentCircuitBreakerArgs']]:
         """
-        Configuration block for deployment circuit breaker. Detailed below.
+        Configuration block for deployment circuit breaker. See below.
         """
         return pulumi.get(self, "deployment_circuit_breaker")
 
@@ -571,7 +571,7 @@ def deployment_circuit_breaker(self, value: Optional[pulumi.Input['ServiceDeploy
     @pulumi.getter(name="deploymentController")
     def deployment_controller(self) -> Optional[pulumi.Input['ServiceDeploymentControllerArgs']]:
         """
-        Configuration block for deployment controller configuration. Detailed below.
+        Configuration block for deployment controller configuration. See below.
         """
         return pulumi.get(self, "deployment_controller")
 
@@ -691,7 +691,7 @@ def launch_type(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="loadBalancers")
     def load_balancers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ServiceLoadBalancerArgs']]]]:
         """
-        Configuration block for load balancers. Detailed below.
+        Configuration block for load balancers. See below.
         """
         return pulumi.get(self, "load_balancers")
 
@@ -715,7 +715,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="networkConfiguration")
     def network_configuration(self) -> Optional[pulumi.Input['ServiceNetworkConfigurationArgs']]:
         """
-        Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+        Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
         """
         return pulumi.get(self, "network_configuration")
 
@@ -727,7 +727,7 @@ def network_configuration(self, value: Optional[pulumi.Input['ServiceNetworkConf
     @pulumi.getter(name="orderedPlacementStrategies")
     def ordered_placement_strategies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ServiceOrderedPlacementStrategyArgs']]]]:
         """
-        Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
+        Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
         """
         return pulumi.get(self, "ordered_placement_strategies")
 
@@ -739,7 +739,7 @@ def ordered_placement_strategies(self, value: Optional[pulumi.Input[Sequence[pul
     @pulumi.getter(name="placementConstraints")
     def placement_constraints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ServicePlacementConstraintArgs']]]]:
         """
-        Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         """
         return pulumi.get(self, "placement_constraints")
 
@@ -787,7 +787,7 @@ def scheduling_strategy(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="serviceRegistries")
     def service_registries(self) -> Optional[pulumi.Input['ServiceServiceRegistriesArgs']]:
         """
-        Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
+        Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
         """
         return pulumi.get(self, "service_registries")
 
@@ -799,7 +799,7 @@ def service_registries(self, value: Optional[pulumi.Input['ServiceServiceRegistr
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        Key-value map of resource tags.
+        Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -953,10 +953,10 @@ def __init__(__self__,
 
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceCapacityProviderStrategyArgs']]]] capacity_provider_strategies: Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
-        :param pulumi.Input[str] cluster: ARN of an ECS cluster
-        :param pulumi.Input[pulumi.InputType['ServiceDeploymentCircuitBreakerArgs']] deployment_circuit_breaker: Configuration block for deployment circuit breaker. Detailed below.
-        :param pulumi.Input[pulumi.InputType['ServiceDeploymentControllerArgs']] deployment_controller: Configuration block for deployment controller configuration. Detailed below.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceCapacityProviderStrategyArgs']]]] capacity_provider_strategies: Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
+        :param pulumi.Input[str] cluster: ARN of an ECS cluster.
+        :param pulumi.Input[pulumi.InputType['ServiceDeploymentCircuitBreakerArgs']] deployment_circuit_breaker: Configuration block for deployment circuit breaker. See below.
+        :param pulumi.Input[pulumi.InputType['ServiceDeploymentControllerArgs']] deployment_controller: Configuration block for deployment controller configuration. See below.
         :param pulumi.Input[int] deployment_maximum_percent: Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
         :param pulumi.Input[int] deployment_minimum_healthy_percent: Lower limit (as a percentage of the service's desiredCount) of the number of running tasks that must remain running and healthy in a service during a deployment.
         :param pulumi.Input[int] desired_count: Number of instances of the task definition to place and keep running. Defaults to 0. Do not specify if using the `DAEMON` scheduling strategy.
@@ -966,16 +966,16 @@ def __init__(__self__,
         :param pulumi.Input[int] health_check_grace_period_seconds: Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 2147483647. Only valid for services configured to use load balancers.
         :param pulumi.Input[str] iam_role: ARN of the IAM role that allows Amazon ECS to make calls to your load balancer on your behalf. This parameter is required if you are using a load balancer with your service, but only if your task definition does not use the `awsvpc` network mode. If using `awsvpc` network mode, do not specify this role. If your account has already created the Amazon ECS service-linked role, that role is used by default for your service unless you specify a role here.
         :param pulumi.Input[str] launch_type: Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceLoadBalancerArgs']]]] load_balancers: Configuration block for load balancers. Detailed below.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceLoadBalancerArgs']]]] load_balancers: Configuration block for load balancers. See below.
         :param pulumi.Input[str] name: Name of the service (up to 255 letters, numbers, hyphens, and underscores)
-        :param pulumi.Input[pulumi.InputType['ServiceNetworkConfigurationArgs']] network_configuration: Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceOrderedPlacementStrategyArgs']]]] ordered_placement_strategies: Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServicePlacementConstraintArgs']]]] placement_constraints: Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        :param pulumi.Input[pulumi.InputType['ServiceNetworkConfigurationArgs']] network_configuration: Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceOrderedPlacementStrategyArgs']]]] ordered_placement_strategies: Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServicePlacementConstraintArgs']]]] placement_constraints: Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         :param pulumi.Input[str] platform_version: Platform version on which to run your service. Only applicable for `launch_type` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
         :param pulumi.Input[str] propagate_tags: Specifies whether to propagate the tags from the task definition or the service to the tasks. The valid values are `SERVICE` and `TASK_DEFINITION`.
         :param pulumi.Input[str] scheduling_strategy: Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
-        :param pulumi.Input[pulumi.InputType['ServiceServiceRegistriesArgs']] service_registries: Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value map of resource tags.
+        :param pulumi.Input[pulumi.InputType['ServiceServiceRegistriesArgs']] service_registries: Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[str] task_definition: Family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service. Required unless using the `EXTERNAL` deployment controller. If a revision is not specified, the latest `ACTIVE` revision is used.
         :param pulumi.Input[bool] wait_for_steady_state: If `true`, this provider will wait for the service to reach a steady state (like [`aws ecs wait services-stable`](https://docs.aws.amazon.com/cli/latest/reference/ecs/wait/services-stable.html)) before continuing. Default `false`.
         """
@@ -1182,10 +1182,10 @@ def get(resource_name: str,
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceCapacityProviderStrategyArgs']]]] capacity_provider_strategies: Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
-        :param pulumi.Input[str] cluster: ARN of an ECS cluster
-        :param pulumi.Input[pulumi.InputType['ServiceDeploymentCircuitBreakerArgs']] deployment_circuit_breaker: Configuration block for deployment circuit breaker. Detailed below.
-        :param pulumi.Input[pulumi.InputType['ServiceDeploymentControllerArgs']] deployment_controller: Configuration block for deployment controller configuration. Detailed below.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceCapacityProviderStrategyArgs']]]] capacity_provider_strategies: Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
+        :param pulumi.Input[str] cluster: ARN of an ECS cluster.
+        :param pulumi.Input[pulumi.InputType['ServiceDeploymentCircuitBreakerArgs']] deployment_circuit_breaker: Configuration block for deployment circuit breaker. See below.
+        :param pulumi.Input[pulumi.InputType['ServiceDeploymentControllerArgs']] deployment_controller: Configuration block for deployment controller configuration. See below.
         :param pulumi.Input[int] deployment_maximum_percent: Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
         :param pulumi.Input[int] deployment_minimum_healthy_percent: Lower limit (as a percentage of the service's desiredCount) of the number of running tasks that must remain running and healthy in a service during a deployment.
         :param pulumi.Input[int] desired_count: Number of instances of the task definition to place and keep running. Defaults to 0. Do not specify if using the `DAEMON` scheduling strategy.
@@ -1195,16 +1195,16 @@ def get(resource_name: str,
         :param pulumi.Input[int] health_check_grace_period_seconds: Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 2147483647. Only valid for services configured to use load balancers.
         :param pulumi.Input[str] iam_role: ARN of the IAM role that allows Amazon ECS to make calls to your load balancer on your behalf. This parameter is required if you are using a load balancer with your service, but only if your task definition does not use the `awsvpc` network mode. If using `awsvpc` network mode, do not specify this role. If your account has already created the Amazon ECS service-linked role, that role is used by default for your service unless you specify a role here.
         :param pulumi.Input[str] launch_type: Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceLoadBalancerArgs']]]] load_balancers: Configuration block for load balancers. Detailed below.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceLoadBalancerArgs']]]] load_balancers: Configuration block for load balancers. See below.
         :param pulumi.Input[str] name: Name of the service (up to 255 letters, numbers, hyphens, and underscores)
-        :param pulumi.Input[pulumi.InputType['ServiceNetworkConfigurationArgs']] network_configuration: Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceOrderedPlacementStrategyArgs']]]] ordered_placement_strategies: Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServicePlacementConstraintArgs']]]] placement_constraints: Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        :param pulumi.Input[pulumi.InputType['ServiceNetworkConfigurationArgs']] network_configuration: Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServiceOrderedPlacementStrategyArgs']]]] ordered_placement_strategies: Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ServicePlacementConstraintArgs']]]] placement_constraints: Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         :param pulumi.Input[str] platform_version: Platform version on which to run your service. Only applicable for `launch_type` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
         :param pulumi.Input[str] propagate_tags: Specifies whether to propagate the tags from the task definition or the service to the tasks. The valid values are `SERVICE` and `TASK_DEFINITION`.
         :param pulumi.Input[str] scheduling_strategy: Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
-        :param pulumi.Input[pulumi.InputType['ServiceServiceRegistriesArgs']] service_registries: Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value map of resource tags.
+        :param pulumi.Input[pulumi.InputType['ServiceServiceRegistriesArgs']] service_registries: Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider `default_tags` configuration block.
         :param pulumi.Input[str] task_definition: Family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service. Required unless using the `EXTERNAL` deployment controller. If a revision is not specified, the latest `ACTIVE` revision is used.
         :param pulumi.Input[bool] wait_for_steady_state: If `true`, this provider will wait for the service to reach a steady state (like [`aws ecs wait services-stable`](https://docs.aws.amazon.com/cli/latest/reference/ecs/wait/services-stable.html)) before continuing. Default `false`.
@@ -1245,7 +1245,7 @@ def get(resource_name: str,
     @pulumi.getter(name="capacityProviderStrategies")
     def capacity_provider_strategies(self) -> pulumi.Output[Optional[Sequence['outputs.ServiceCapacityProviderStrategy']]]:
         """
-        Capacity provider strategy to use for the service. Can be one or more.  Detailed below.
+        Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
         """
         return pulumi.get(self, "capacity_provider_strategies")
 
@@ -1253,7 +1253,7 @@ def capacity_provider_strategies(self) -> pulumi.Output[Optional[Sequence['outpu
     @pulumi.getter
     def cluster(self) -> pulumi.Output[str]:
         """
-        ARN of an ECS cluster
+        ARN of an ECS cluster.
         """
         return pulumi.get(self, "cluster")
 
@@ -1261,7 +1261,7 @@ def cluster(self) -> pulumi.Output[str]:
     @pulumi.getter(name="deploymentCircuitBreaker")
     def deployment_circuit_breaker(self) -> pulumi.Output[Optional['outputs.ServiceDeploymentCircuitBreaker']]:
         """
-        Configuration block for deployment circuit breaker. Detailed below.
+        Configuration block for deployment circuit breaker. See below.
         """
         return pulumi.get(self, "deployment_circuit_breaker")
 
@@ -1269,7 +1269,7 @@ def deployment_circuit_breaker(self) -> pulumi.Output[Optional['outputs.ServiceD
     @pulumi.getter(name="deploymentController")
     def deployment_controller(self) -> pulumi.Output[Optional['outputs.ServiceDeploymentController']]:
         """
-        Configuration block for deployment controller configuration. Detailed below.
+        Configuration block for deployment controller configuration. See below.
         """
         return pulumi.get(self, "deployment_controller")
 
@@ -1349,7 +1349,7 @@ def launch_type(self) -> pulumi.Output[str]:
     @pulumi.getter(name="loadBalancers")
     def load_balancers(self) -> pulumi.Output[Optional[Sequence['outputs.ServiceLoadBalancer']]]:
         """
-        Configuration block for load balancers. Detailed below.
+        Configuration block for load balancers. See below.
         """
         return pulumi.get(self, "load_balancers")
 
@@ -1365,7 +1365,7 @@ def name(self) -> pulumi.Output[str]:
     @pulumi.getter(name="networkConfiguration")
     def network_configuration(self) -> pulumi.Output[Optional['outputs.ServiceNetworkConfiguration']]:
         """
-        Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. Detailed below.
+        Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
         """
         return pulumi.get(self, "network_configuration")
 
@@ -1373,7 +1373,7 @@ def network_configuration(self) -> pulumi.Output[Optional['outputs.ServiceNetwor
     @pulumi.getter(name="orderedPlacementStrategies")
     def ordered_placement_strategies(self) -> pulumi.Output[Optional[Sequence['outputs.ServiceOrderedPlacementStrategy']]]:
         """
-        Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. Detailed below.
+        Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
         """
         return pulumi.get(self, "ordered_placement_strategies")
 
@@ -1381,7 +1381,7 @@ def ordered_placement_strategies(self) -> pulumi.Output[Optional[Sequence['outpu
     @pulumi.getter(name="placementConstraints")
     def placement_constraints(self) -> pulumi.Output[Optional[Sequence['outputs.ServicePlacementConstraint']]]:
         """
-        Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. Detailed below.
+        Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
         """
         return pulumi.get(self, "placement_constraints")
 
@@ -1413,7 +1413,7 @@ def scheduling_strategy(self) -> pulumi.Output[Optional[str]]:
     @pulumi.getter(name="serviceRegistries")
     def service_registries(self) -> pulumi.Output[Optional['outputs.ServiceServiceRegistries']]:
         """
-        Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. Detailed below.
+        Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
         """
         return pulumi.get(self, "service_registries")
 
@@ -1421,7 +1421,7 @@ def service_registries(self) -> pulumi.Output[Optional['outputs.ServiceServiceRe
     @pulumi.getter
     def tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
-        Key-value map of resource tags.
+        Key-value map of resource tags. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
diff --git a/sdk/python/pulumi_aws/elasticloadbalancing/get_load_balancer.py b/sdk/python/pulumi_aws/elasticloadbalancing/get_load_balancer.py
index c99ec6bde4b..6566ca2d5c2 100644
--- a/sdk/python/pulumi_aws/elasticloadbalancing/get_load_balancer.py
+++ b/sdk/python/pulumi_aws/elasticloadbalancing/get_load_balancer.py
@@ -23,7 +23,7 @@ class GetLoadBalancerResult:
     """
     A collection of values returned by getLoadBalancer.
     """
-    def __init__(__self__, access_logs=None, arn=None, availability_zones=None, connection_draining=None, connection_draining_timeout=None, cross_zone_load_balancing=None, dns_name=None, health_check=None, id=None, idle_timeout=None, instances=None, internal=None, listeners=None, name=None, security_groups=None, source_security_group=None, source_security_group_id=None, subnets=None, tags=None, zone_id=None):
+    def __init__(__self__, access_logs=None, arn=None, availability_zones=None, connection_draining=None, connection_draining_timeout=None, cross_zone_load_balancing=None, desync_mitigation_mode=None, dns_name=None, health_check=None, id=None, idle_timeout=None, instances=None, internal=None, listeners=None, name=None, security_groups=None, source_security_group=None, source_security_group_id=None, subnets=None, tags=None, zone_id=None):
         if access_logs and not isinstance(access_logs, dict):
             raise TypeError("Expected argument 'access_logs' to be a dict")
         pulumi.set(__self__, "access_logs", access_logs)
@@ -42,6 +42,9 @@ def __init__(__self__, access_logs=None, arn=None, availability_zones=None, conn
         if cross_zone_load_balancing and not isinstance(cross_zone_load_balancing, bool):
             raise TypeError("Expected argument 'cross_zone_load_balancing' to be a bool")
         pulumi.set(__self__, "cross_zone_load_balancing", cross_zone_load_balancing)
+        if desync_mitigation_mode and not isinstance(desync_mitigation_mode, str):
+            raise TypeError("Expected argument 'desync_mitigation_mode' to be a str")
+        pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name and not isinstance(dns_name, str):
             raise TypeError("Expected argument 'dns_name' to be a str")
         pulumi.set(__self__, "dns_name", dns_name)
@@ -115,6 +118,11 @@ def connection_draining_timeout(self) -> int:
     def cross_zone_load_balancing(self) -> bool:
         return pulumi.get(self, "cross_zone_load_balancing")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> str:
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> str:
@@ -201,6 +209,7 @@ def __await__(self):
             connection_draining=self.connection_draining,
             connection_draining_timeout=self.connection_draining_timeout,
             cross_zone_load_balancing=self.cross_zone_load_balancing,
+            desync_mitigation_mode=self.desync_mitigation_mode,
             dns_name=self.dns_name,
             health_check=self.health_check,
             id=self.id,
@@ -262,6 +271,7 @@ def get_load_balancer(name: Optional[str] = None,
         connection_draining=__ret__.connection_draining,
         connection_draining_timeout=__ret__.connection_draining_timeout,
         cross_zone_load_balancing=__ret__.cross_zone_load_balancing,
+        desync_mitigation_mode=__ret__.desync_mitigation_mode,
         dns_name=__ret__.dns_name,
         health_check=__ret__.health_check,
         id=__ret__.id,
diff --git a/sdk/python/pulumi_aws/elasticloadbalancing/load_balancer.py b/sdk/python/pulumi_aws/elasticloadbalancing/load_balancer.py
index 23e5d6eb109..17ebae8547c 100644
--- a/sdk/python/pulumi_aws/elasticloadbalancing/load_balancer.py
+++ b/sdk/python/pulumi_aws/elasticloadbalancing/load_balancer.py
@@ -21,6 +21,7 @@ def __init__(__self__, *,
                  connection_draining: Optional[pulumi.Input[bool]] = None,
                  connection_draining_timeout: Optional[pulumi.Input[int]] = None,
                  cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  health_check: Optional[pulumi.Input['LoadBalancerHealthCheckArgs']] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  instances: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -39,6 +40,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] connection_draining: Boolean to enable connection draining. Default: `false`
         :param pulumi.Input[int] connection_draining_timeout: The time in seconds to allow for connections to drain. Default: `300`
         :param pulumi.Input[bool] cross_zone_load_balancing: Enable cross-zone load balancing. Default: `true`
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input['LoadBalancerHealthCheckArgs'] health_check: A health_check block. Health Check documented below.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Default: `60`
         :param pulumi.Input[Sequence[pulumi.Input[str]]] instances: A list of instance ids to place in the ELB pool.
@@ -64,6 +66,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "connection_draining_timeout", connection_draining_timeout)
         if cross_zone_load_balancing is not None:
             pulumi.set(__self__, "cross_zone_load_balancing", cross_zone_load_balancing)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if health_check is not None:
             pulumi.set(__self__, "health_check", health_check)
         if idle_timeout is not None:
@@ -157,6 +161,18 @@ def cross_zone_load_balancing(self) -> Optional[pulumi.Input[bool]]:
     def cross_zone_load_balancing(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "cross_zone_load_balancing", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="healthCheck")
     def health_check(self) -> Optional[pulumi.Input['LoadBalancerHealthCheckArgs']]:
@@ -288,6 +304,7 @@ def __init__(__self__, *,
                  connection_draining: Optional[pulumi.Input[bool]] = None,
                  connection_draining_timeout: Optional[pulumi.Input[int]] = None,
                  cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  dns_name: Optional[pulumi.Input[str]] = None,
                  health_check: Optional[pulumi.Input['LoadBalancerHealthCheckArgs']] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
@@ -311,6 +328,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] connection_draining: Boolean to enable connection draining. Default: `false`
         :param pulumi.Input[int] connection_draining_timeout: The time in seconds to allow for connections to drain. Default: `300`
         :param pulumi.Input[bool] cross_zone_load_balancing: Enable cross-zone load balancing. Default: `true`
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the ELB
         :param pulumi.Input['LoadBalancerHealthCheckArgs'] health_check: A health_check block. Health Check documented below.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Default: `60`
@@ -344,6 +362,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "connection_draining_timeout", connection_draining_timeout)
         if cross_zone_load_balancing is not None:
             pulumi.set(__self__, "cross_zone_load_balancing", cross_zone_load_balancing)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name is not None:
             pulumi.set(__self__, "dns_name", dns_name)
         if health_check is not None:
@@ -447,6 +467,18 @@ def cross_zone_load_balancing(self) -> Optional[pulumi.Input[bool]]:
     def cross_zone_load_balancing(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "cross_zone_load_balancing", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> Optional[pulumi.Input[str]]:
@@ -646,6 +678,7 @@ def __init__(__self__,
                  connection_draining: Optional[pulumi.Input[bool]] = None,
                  connection_draining_timeout: Optional[pulumi.Input[int]] = None,
                  cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  health_check: Optional[pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  instances: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -742,6 +775,7 @@ def __init__(__self__,
         :param pulumi.Input[bool] connection_draining: Boolean to enable connection draining. Default: `false`
         :param pulumi.Input[int] connection_draining_timeout: The time in seconds to allow for connections to drain. Default: `300`
         :param pulumi.Input[bool] cross_zone_load_balancing: Enable cross-zone load balancing. Default: `true`
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']] health_check: A health_check block. Health Check documented below.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Default: `60`
         :param pulumi.Input[Sequence[pulumi.Input[str]]] instances: A list of instance ids to place in the ELB pool.
@@ -860,6 +894,7 @@ def _internal_init(__self__,
                  connection_draining: Optional[pulumi.Input[bool]] = None,
                  connection_draining_timeout: Optional[pulumi.Input[int]] = None,
                  cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  health_check: Optional[pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  instances: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -889,6 +924,7 @@ def _internal_init(__self__,
             __props__.__dict__["connection_draining"] = connection_draining
             __props__.__dict__["connection_draining_timeout"] = connection_draining_timeout
             __props__.__dict__["cross_zone_load_balancing"] = cross_zone_load_balancing
+            __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
             __props__.__dict__["health_check"] = health_check
             __props__.__dict__["idle_timeout"] = idle_timeout
             __props__.__dict__["instances"] = instances
@@ -923,6 +959,7 @@ def get(resource_name: str,
             connection_draining: Optional[pulumi.Input[bool]] = None,
             connection_draining_timeout: Optional[pulumi.Input[int]] = None,
             cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+            desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
             dns_name: Optional[pulumi.Input[str]] = None,
             health_check: Optional[pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']]] = None,
             idle_timeout: Optional[pulumi.Input[int]] = None,
@@ -951,6 +988,7 @@ def get(resource_name: str,
         :param pulumi.Input[bool] connection_draining: Boolean to enable connection draining. Default: `false`
         :param pulumi.Input[int] connection_draining_timeout: The time in seconds to allow for connections to drain. Default: `300`
         :param pulumi.Input[bool] cross_zone_load_balancing: Enable cross-zone load balancing. Default: `true`
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the ELB
         :param pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']] health_check: A health_check block. Health Check documented below.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Default: `60`
@@ -982,6 +1020,7 @@ def get(resource_name: str,
         __props__.__dict__["connection_draining"] = connection_draining
         __props__.__dict__["connection_draining_timeout"] = connection_draining_timeout
         __props__.__dict__["cross_zone_load_balancing"] = cross_zone_load_balancing
+        __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
         __props__.__dict__["dns_name"] = dns_name
         __props__.__dict__["health_check"] = health_check
         __props__.__dict__["idle_timeout"] = idle_timeout
@@ -1047,6 +1086,14 @@ def cross_zone_load_balancing(self) -> pulumi.Output[Optional[bool]]:
         """
         return pulumi.get(self, "cross_zone_load_balancing")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> pulumi.Output[Optional[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> pulumi.Output[str]:
diff --git a/sdk/python/pulumi_aws/elasticloadbalancingv2/get_load_balancer.py b/sdk/python/pulumi_aws/elasticloadbalancingv2/get_load_balancer.py
index 30943130bde..ec95365f2ca 100644
--- a/sdk/python/pulumi_aws/elasticloadbalancingv2/get_load_balancer.py
+++ b/sdk/python/pulumi_aws/elasticloadbalancingv2/get_load_balancer.py
@@ -23,7 +23,7 @@ class GetLoadBalancerResult:
     """
     A collection of values returned by getLoadBalancer.
     """
-    def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_owned_ipv4_pool=None, dns_name=None, drop_invalid_header_fields=None, enable_deletion_protection=None, enable_http2=None, id=None, idle_timeout=None, internal=None, ip_address_type=None, load_balancer_type=None, name=None, security_groups=None, subnet_mappings=None, subnets=None, tags=None, vpc_id=None, zone_id=None):
+    def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_owned_ipv4_pool=None, desync_mitigation_mode=None, dns_name=None, drop_invalid_header_fields=None, enable_deletion_protection=None, enable_http2=None, enable_waf_fail_open=None, id=None, idle_timeout=None, internal=None, ip_address_type=None, load_balancer_type=None, name=None, security_groups=None, subnet_mappings=None, subnets=None, tags=None, vpc_id=None, zone_id=None):
         if access_logs and not isinstance(access_logs, dict):
             raise TypeError("Expected argument 'access_logs' to be a dict")
         pulumi.set(__self__, "access_logs", access_logs)
@@ -36,6 +36,9 @@ def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_own
         if customer_owned_ipv4_pool and not isinstance(customer_owned_ipv4_pool, str):
             raise TypeError("Expected argument 'customer_owned_ipv4_pool' to be a str")
         pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode and not isinstance(desync_mitigation_mode, str):
+            raise TypeError("Expected argument 'desync_mitigation_mode' to be a str")
+        pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name and not isinstance(dns_name, str):
             raise TypeError("Expected argument 'dns_name' to be a str")
         pulumi.set(__self__, "dns_name", dns_name)
@@ -48,6 +51,9 @@ def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_own
         if enable_http2 and not isinstance(enable_http2, bool):
             raise TypeError("Expected argument 'enable_http2' to be a bool")
         pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open and not isinstance(enable_waf_fail_open, bool):
+            raise TypeError("Expected argument 'enable_waf_fail_open' to be a bool")
+        pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if id and not isinstance(id, str):
             raise TypeError("Expected argument 'id' to be a str")
         pulumi.set(__self__, "id", id)
@@ -105,6 +111,11 @@ def arn_suffix(self) -> str:
     def customer_owned_ipv4_pool(self) -> str:
         return pulumi.get(self, "customer_owned_ipv4_pool")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> str:
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> str:
@@ -125,6 +136,11 @@ def enable_deletion_protection(self) -> bool:
     def enable_http2(self) -> bool:
         return pulumi.get(self, "enable_http2")
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> bool:
+        return pulumi.get(self, "enable_waf_fail_open")
+
     @property
     @pulumi.getter
     def id(self) -> str:
@@ -199,10 +215,12 @@ def __await__(self):
             arn=self.arn,
             arn_suffix=self.arn_suffix,
             customer_owned_ipv4_pool=self.customer_owned_ipv4_pool,
+            desync_mitigation_mode=self.desync_mitigation_mode,
             dns_name=self.dns_name,
             drop_invalid_header_fields=self.drop_invalid_header_fields,
             enable_deletion_protection=self.enable_deletion_protection,
             enable_http2=self.enable_http2,
+            enable_waf_fail_open=self.enable_waf_fail_open,
             id=self.id,
             idle_timeout=self.idle_timeout,
             internal=self.internal,
@@ -268,10 +286,12 @@ def get_load_balancer(arn: Optional[str] = None,
         arn=__ret__.arn,
         arn_suffix=__ret__.arn_suffix,
         customer_owned_ipv4_pool=__ret__.customer_owned_ipv4_pool,
+        desync_mitigation_mode=__ret__.desync_mitigation_mode,
         dns_name=__ret__.dns_name,
         drop_invalid_header_fields=__ret__.drop_invalid_header_fields,
         enable_deletion_protection=__ret__.enable_deletion_protection,
         enable_http2=__ret__.enable_http2,
+        enable_waf_fail_open=__ret__.enable_waf_fail_open,
         id=__ret__.id,
         idle_timeout=__ret__.idle_timeout,
         internal=__ret__.internal,
diff --git a/sdk/python/pulumi_aws/elasticloadbalancingv2/load_balancer.py b/sdk/python/pulumi_aws/elasticloadbalancingv2/load_balancer.py
index 3124b7e96e4..dd72299dd6d 100644
--- a/sdk/python/pulumi_aws/elasticloadbalancingv2/load_balancer.py
+++ b/sdk/python/pulumi_aws/elasticloadbalancingv2/load_balancer.py
@@ -17,10 +17,12 @@ class LoadBalancerArgs:
     def __init__(__self__, *,
                  access_logs: Optional[pulumi.Input['LoadBalancerAccessLogsArgs']] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -35,12 +37,14 @@ def __init__(__self__, *,
         The set of arguments for constructing a LoadBalancer resource.
         :param pulumi.Input['LoadBalancerAccessLogsArgs'] access_logs: An Access Logs block. Access Logs documented below.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
                This is a `network` load balancer feature. Defaults to `false`.
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -54,12 +58,14 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         if access_logs is not None:
             pulumi.set(__self__, "access_logs", access_logs)
         if customer_owned_ipv4_pool is not None:
             pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if drop_invalid_header_fields is not None:
             pulumi.set(__self__, "drop_invalid_header_fields", drop_invalid_header_fields)
         if enable_cross_zone_load_balancing is not None:
@@ -68,6 +74,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "enable_deletion_protection", enable_deletion_protection)
         if enable_http2 is not None:
             pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open is not None:
+            pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if idle_timeout is not None:
             pulumi.set(__self__, "idle_timeout", idle_timeout)
         if internal is not None:
@@ -113,6 +121,18 @@ def customer_owned_ipv4_pool(self) -> Optional[pulumi.Input[str]]:
     def customer_owned_ipv4_pool(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "customer_owned_ipv4_pool", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dropInvalidHeaderFields")
     def drop_invalid_header_fields(self) -> Optional[pulumi.Input[bool]]:
@@ -163,6 +183,18 @@ def enable_http2(self) -> Optional[pulumi.Input[bool]]:
     def enable_http2(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enable_http2", value)
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
+    @enable_waf_fail_open.setter
+    def enable_waf_fail_open(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enable_waf_fail_open", value)
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> Optional[pulumi.Input[int]]:
@@ -279,7 +311,7 @@ def subnets(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -295,11 +327,13 @@ def __init__(__self__, *,
                  arn: Optional[pulumi.Input[str]] = None,
                  arn_suffix: Optional[pulumi.Input[str]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  dns_name: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -319,6 +353,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] arn: The ARN of the load balancer (matches `id`).
         :param pulumi.Input[str] arn_suffix: The ARN suffix for use with CloudWatch Metrics.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the load balancer.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
@@ -326,6 +361,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -339,7 +375,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
         :param pulumi.Input[str] zone_id: The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
                * `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
@@ -352,6 +388,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "arn_suffix", arn_suffix)
         if customer_owned_ipv4_pool is not None:
             pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name is not None:
             pulumi.set(__self__, "dns_name", dns_name)
         if drop_invalid_header_fields is not None:
@@ -362,6 +400,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "enable_deletion_protection", enable_deletion_protection)
         if enable_http2 is not None:
             pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open is not None:
+            pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if idle_timeout is not None:
             pulumi.set(__self__, "idle_timeout", idle_timeout)
         if internal is not None:
@@ -437,6 +477,18 @@ def customer_owned_ipv4_pool(self) -> Optional[pulumi.Input[str]]:
     def customer_owned_ipv4_pool(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "customer_owned_ipv4_pool", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> Optional[pulumi.Input[str]]:
@@ -499,6 +551,18 @@ def enable_http2(self) -> Optional[pulumi.Input[bool]]:
     def enable_http2(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enable_http2", value)
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
+    @enable_waf_fail_open.setter
+    def enable_waf_fail_open(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enable_waf_fail_open", value)
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> Optional[pulumi.Input[int]]:
@@ -615,7 +679,7 @@ def subnets(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -670,10 +734,12 @@ def __init__(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_logs: Optional[pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -778,12 +844,14 @@ def __init__(__self__,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']] access_logs: An Access Logs block. Access Logs documented below.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
                This is a `network` load balancer feature. Defaults to `false`.
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -797,7 +865,7 @@ def __init__(__self__,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         ...
     @overload
@@ -911,10 +979,12 @@ def _internal_init(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_logs: Optional[pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -940,10 +1010,12 @@ def _internal_init(__self__,
 
             __props__.__dict__["access_logs"] = access_logs
             __props__.__dict__["customer_owned_ipv4_pool"] = customer_owned_ipv4_pool
+            __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
             __props__.__dict__["drop_invalid_header_fields"] = drop_invalid_header_fields
             __props__.__dict__["enable_cross_zone_load_balancing"] = enable_cross_zone_load_balancing
             __props__.__dict__["enable_deletion_protection"] = enable_deletion_protection
             __props__.__dict__["enable_http2"] = enable_http2
+            __props__.__dict__["enable_waf_fail_open"] = enable_waf_fail_open
             __props__.__dict__["idle_timeout"] = idle_timeout
             __props__.__dict__["internal"] = internal
             __props__.__dict__["ip_address_type"] = ip_address_type
@@ -974,11 +1046,13 @@ def get(resource_name: str,
             arn: Optional[pulumi.Input[str]] = None,
             arn_suffix: Optional[pulumi.Input[str]] = None,
             customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+            desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
             dns_name: Optional[pulumi.Input[str]] = None,
             drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
             enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
             enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
             enable_http2: Optional[pulumi.Input[bool]] = None,
+            enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
             idle_timeout: Optional[pulumi.Input[int]] = None,
             internal: Optional[pulumi.Input[bool]] = None,
             ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -1003,6 +1077,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] arn: The ARN of the load balancer (matches `id`).
         :param pulumi.Input[str] arn_suffix: The ARN suffix for use with CloudWatch Metrics.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the load balancer.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
@@ -1010,6 +1085,7 @@ def get(resource_name: str,
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -1023,7 +1099,7 @@ def get(resource_name: str,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
         :param pulumi.Input[str] zone_id: The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
                * `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
@@ -1036,11 +1112,13 @@ def get(resource_name: str,
         __props__.__dict__["arn"] = arn
         __props__.__dict__["arn_suffix"] = arn_suffix
         __props__.__dict__["customer_owned_ipv4_pool"] = customer_owned_ipv4_pool
+        __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
         __props__.__dict__["dns_name"] = dns_name
         __props__.__dict__["drop_invalid_header_fields"] = drop_invalid_header_fields
         __props__.__dict__["enable_cross_zone_load_balancing"] = enable_cross_zone_load_balancing
         __props__.__dict__["enable_deletion_protection"] = enable_deletion_protection
         __props__.__dict__["enable_http2"] = enable_http2
+        __props__.__dict__["enable_waf_fail_open"] = enable_waf_fail_open
         __props__.__dict__["idle_timeout"] = idle_timeout
         __props__.__dict__["internal"] = internal
         __props__.__dict__["ip_address_type"] = ip_address_type
@@ -1088,6 +1166,14 @@ def customer_owned_ipv4_pool(self) -> pulumi.Output[Optional[str]]:
         """
         return pulumi.get(self, "customer_owned_ipv4_pool")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> pulumi.Output[Optional[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> pulumi.Output[str]:
@@ -1130,6 +1216,14 @@ def enable_http2(self) -> pulumi.Output[Optional[bool]]:
         """
         return pulumi.get(self, "enable_http2")
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> pulumi.Output[Optional[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> pulumi.Output[Optional[int]]:
@@ -1210,7 +1304,7 @@ def subnets(self) -> pulumi.Output[Sequence[str]]:
     @pulumi.getter
     def tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
diff --git a/sdk/python/pulumi_aws/elb/get_load_balancer.py b/sdk/python/pulumi_aws/elb/get_load_balancer.py
index 58cced5e407..df928cc69cd 100644
--- a/sdk/python/pulumi_aws/elb/get_load_balancer.py
+++ b/sdk/python/pulumi_aws/elb/get_load_balancer.py
@@ -21,7 +21,7 @@ class GetLoadBalancerResult:
     """
     A collection of values returned by getLoadBalancer.
     """
-    def __init__(__self__, access_logs=None, arn=None, availability_zones=None, connection_draining=None, connection_draining_timeout=None, cross_zone_load_balancing=None, dns_name=None, health_check=None, id=None, idle_timeout=None, instances=None, internal=None, listeners=None, name=None, security_groups=None, source_security_group=None, source_security_group_id=None, subnets=None, tags=None, zone_id=None):
+    def __init__(__self__, access_logs=None, arn=None, availability_zones=None, connection_draining=None, connection_draining_timeout=None, cross_zone_load_balancing=None, desync_mitigation_mode=None, dns_name=None, health_check=None, id=None, idle_timeout=None, instances=None, internal=None, listeners=None, name=None, security_groups=None, source_security_group=None, source_security_group_id=None, subnets=None, tags=None, zone_id=None):
         if access_logs and not isinstance(access_logs, dict):
             raise TypeError("Expected argument 'access_logs' to be a dict")
         pulumi.set(__self__, "access_logs", access_logs)
@@ -40,6 +40,9 @@ def __init__(__self__, access_logs=None, arn=None, availability_zones=None, conn
         if cross_zone_load_balancing and not isinstance(cross_zone_load_balancing, bool):
             raise TypeError("Expected argument 'cross_zone_load_balancing' to be a bool")
         pulumi.set(__self__, "cross_zone_load_balancing", cross_zone_load_balancing)
+        if desync_mitigation_mode and not isinstance(desync_mitigation_mode, str):
+            raise TypeError("Expected argument 'desync_mitigation_mode' to be a str")
+        pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name and not isinstance(dns_name, str):
             raise TypeError("Expected argument 'dns_name' to be a str")
         pulumi.set(__self__, "dns_name", dns_name)
@@ -113,6 +116,11 @@ def connection_draining_timeout(self) -> int:
     def cross_zone_load_balancing(self) -> bool:
         return pulumi.get(self, "cross_zone_load_balancing")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> str:
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> str:
@@ -199,6 +207,7 @@ def __await__(self):
             connection_draining=self.connection_draining,
             connection_draining_timeout=self.connection_draining_timeout,
             cross_zone_load_balancing=self.cross_zone_load_balancing,
+            desync_mitigation_mode=self.desync_mitigation_mode,
             dns_name=self.dns_name,
             health_check=self.health_check,
             id=self.id,
@@ -259,6 +268,7 @@ def get_load_balancer(name: Optional[str] = None,
         connection_draining=__ret__.connection_draining,
         connection_draining_timeout=__ret__.connection_draining_timeout,
         cross_zone_load_balancing=__ret__.cross_zone_load_balancing,
+        desync_mitigation_mode=__ret__.desync_mitigation_mode,
         dns_name=__ret__.dns_name,
         health_check=__ret__.health_check,
         id=__ret__.id,
diff --git a/sdk/python/pulumi_aws/elb/load_balancer.py b/sdk/python/pulumi_aws/elb/load_balancer.py
index 0c4e7cae997..6cf365d1688 100644
--- a/sdk/python/pulumi_aws/elb/load_balancer.py
+++ b/sdk/python/pulumi_aws/elb/load_balancer.py
@@ -21,6 +21,7 @@ def __init__(__self__, *,
                  connection_draining: Optional[pulumi.Input[bool]] = None,
                  connection_draining_timeout: Optional[pulumi.Input[int]] = None,
                  cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  health_check: Optional[pulumi.Input['LoadBalancerHealthCheckArgs']] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  instances: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -39,6 +40,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] connection_draining: Boolean to enable connection draining. Default: `false`
         :param pulumi.Input[int] connection_draining_timeout: The time in seconds to allow for connections to drain. Default: `300`
         :param pulumi.Input[bool] cross_zone_load_balancing: Enable cross-zone load balancing. Default: `true`
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input['LoadBalancerHealthCheckArgs'] health_check: A health_check block. Health Check documented below.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Default: `60`
         :param pulumi.Input[Sequence[pulumi.Input[str]]] instances: A list of instance ids to place in the ELB pool.
@@ -64,6 +66,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "connection_draining_timeout", connection_draining_timeout)
         if cross_zone_load_balancing is not None:
             pulumi.set(__self__, "cross_zone_load_balancing", cross_zone_load_balancing)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if health_check is not None:
             pulumi.set(__self__, "health_check", health_check)
         if idle_timeout is not None:
@@ -157,6 +161,18 @@ def cross_zone_load_balancing(self) -> Optional[pulumi.Input[bool]]:
     def cross_zone_load_balancing(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "cross_zone_load_balancing", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="healthCheck")
     def health_check(self) -> Optional[pulumi.Input['LoadBalancerHealthCheckArgs']]:
@@ -288,6 +304,7 @@ def __init__(__self__, *,
                  connection_draining: Optional[pulumi.Input[bool]] = None,
                  connection_draining_timeout: Optional[pulumi.Input[int]] = None,
                  cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  dns_name: Optional[pulumi.Input[str]] = None,
                  health_check: Optional[pulumi.Input['LoadBalancerHealthCheckArgs']] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
@@ -311,6 +328,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] connection_draining: Boolean to enable connection draining. Default: `false`
         :param pulumi.Input[int] connection_draining_timeout: The time in seconds to allow for connections to drain. Default: `300`
         :param pulumi.Input[bool] cross_zone_load_balancing: Enable cross-zone load balancing. Default: `true`
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the ELB
         :param pulumi.Input['LoadBalancerHealthCheckArgs'] health_check: A health_check block. Health Check documented below.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Default: `60`
@@ -344,6 +362,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "connection_draining_timeout", connection_draining_timeout)
         if cross_zone_load_balancing is not None:
             pulumi.set(__self__, "cross_zone_load_balancing", cross_zone_load_balancing)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name is not None:
             pulumi.set(__self__, "dns_name", dns_name)
         if health_check is not None:
@@ -447,6 +467,18 @@ def cross_zone_load_balancing(self) -> Optional[pulumi.Input[bool]]:
     def cross_zone_load_balancing(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "cross_zone_load_balancing", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> Optional[pulumi.Input[str]]:
@@ -641,6 +673,7 @@ def __init__(__self__,
                  connection_draining: Optional[pulumi.Input[bool]] = None,
                  connection_draining_timeout: Optional[pulumi.Input[int]] = None,
                  cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  health_check: Optional[pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  instances: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -737,6 +770,7 @@ def __init__(__self__,
         :param pulumi.Input[bool] connection_draining: Boolean to enable connection draining. Default: `false`
         :param pulumi.Input[int] connection_draining_timeout: The time in seconds to allow for connections to drain. Default: `300`
         :param pulumi.Input[bool] cross_zone_load_balancing: Enable cross-zone load balancing. Default: `true`
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']] health_check: A health_check block. Health Check documented below.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Default: `60`
         :param pulumi.Input[Sequence[pulumi.Input[str]]] instances: A list of instance ids to place in the ELB pool.
@@ -855,6 +889,7 @@ def _internal_init(__self__,
                  connection_draining: Optional[pulumi.Input[bool]] = None,
                  connection_draining_timeout: Optional[pulumi.Input[int]] = None,
                  cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  health_check: Optional[pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  instances: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -883,6 +918,7 @@ def _internal_init(__self__,
             __props__.__dict__["connection_draining"] = connection_draining
             __props__.__dict__["connection_draining_timeout"] = connection_draining_timeout
             __props__.__dict__["cross_zone_load_balancing"] = cross_zone_load_balancing
+            __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
             __props__.__dict__["health_check"] = health_check
             __props__.__dict__["idle_timeout"] = idle_timeout
             __props__.__dict__["instances"] = instances
@@ -919,6 +955,7 @@ def get(resource_name: str,
             connection_draining: Optional[pulumi.Input[bool]] = None,
             connection_draining_timeout: Optional[pulumi.Input[int]] = None,
             cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
+            desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
             dns_name: Optional[pulumi.Input[str]] = None,
             health_check: Optional[pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']]] = None,
             idle_timeout: Optional[pulumi.Input[int]] = None,
@@ -947,6 +984,7 @@ def get(resource_name: str,
         :param pulumi.Input[bool] connection_draining: Boolean to enable connection draining. Default: `false`
         :param pulumi.Input[int] connection_draining_timeout: The time in seconds to allow for connections to drain. Default: `300`
         :param pulumi.Input[bool] cross_zone_load_balancing: Enable cross-zone load balancing. Default: `true`
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the ELB
         :param pulumi.Input[pulumi.InputType['LoadBalancerHealthCheckArgs']] health_check: A health_check block. Health Check documented below.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Default: `60`
@@ -978,6 +1016,7 @@ def get(resource_name: str,
         __props__.__dict__["connection_draining"] = connection_draining
         __props__.__dict__["connection_draining_timeout"] = connection_draining_timeout
         __props__.__dict__["cross_zone_load_balancing"] = cross_zone_load_balancing
+        __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
         __props__.__dict__["dns_name"] = dns_name
         __props__.__dict__["health_check"] = health_check
         __props__.__dict__["idle_timeout"] = idle_timeout
@@ -1043,6 +1082,14 @@ def cross_zone_load_balancing(self) -> pulumi.Output[Optional[bool]]:
         """
         return pulumi.get(self, "cross_zone_load_balancing")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> pulumi.Output[Optional[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> pulumi.Output[str]:
diff --git a/sdk/python/pulumi_aws/fsx/__init__.py b/sdk/python/pulumi_aws/fsx/__init__.py
index 796c77b4ddc..df02c78d5a2 100644
--- a/sdk/python/pulumi_aws/fsx/__init__.py
+++ b/sdk/python/pulumi_aws/fsx/__init__.py
@@ -8,6 +8,8 @@
 from .backup import *
 from .lustre_file_system import *
 from .ontap_file_system import *
+from .ontap_storage_virtual_machine import *
+from .ontap_volume import *
 from .windows_file_system import *
 from ._inputs import *
 from . import outputs
diff --git a/sdk/python/pulumi_aws/fsx/_inputs.py b/sdk/python/pulumi_aws/fsx/_inputs.py
index f16cc0176c6..5a3b82b2b6f 100644
--- a/sdk/python/pulumi_aws/fsx/_inputs.py
+++ b/sdk/python/pulumi_aws/fsx/_inputs.py
@@ -13,6 +13,14 @@
     'OntapFileSystemEndpointArgs',
     'OntapFileSystemEndpointInterclusterArgs',
     'OntapFileSystemEndpointManagementArgs',
+    'OntapStorageVirtualMachineActiveDirectoryConfigurationArgs',
+    'OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs',
+    'OntapStorageVirtualMachineEndpointArgs',
+    'OntapStorageVirtualMachineEndpointIscseArgs',
+    'OntapStorageVirtualMachineEndpointManagementArgs',
+    'OntapStorageVirtualMachineEndpointNfArgs',
+    'OntapStorageVirtualMachineEndpointSmbArgs',
+    'OntapVolumeTieringPolicyArgs',
     'WindowsFileSystemAuditLogConfigurationArgs',
     'WindowsFileSystemSelfManagedActiveDirectoryArgs',
 ]
@@ -173,6 +181,398 @@ def ip_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]
         pulumi.set(self, "ip_addresses", value)
 
 
+@pulumi.input_type
+class OntapStorageVirtualMachineActiveDirectoryConfigurationArgs:
+    def __init__(__self__, *,
+                 netbios_name: Optional[pulumi.Input[str]] = None,
+                 self_managed_active_directory_configuration: Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs']] = None):
+        """
+        :param pulumi.Input[str] netbios_name: The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+        """
+        if netbios_name is not None:
+            pulumi.set(__self__, "netbios_name", netbios_name)
+        if self_managed_active_directory_configuration is not None:
+            pulumi.set(__self__, "self_managed_active_directory_configuration", self_managed_active_directory_configuration)
+
+    @property
+    @pulumi.getter(name="netbiosName")
+    def netbios_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+        """
+        return pulumi.get(self, "netbios_name")
+
+    @netbios_name.setter
+    def netbios_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "netbios_name", value)
+
+    @property
+    @pulumi.getter(name="selfManagedActiveDirectoryConfiguration")
+    def self_managed_active_directory_configuration(self) -> Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs']]:
+        return pulumi.get(self, "self_managed_active_directory_configuration")
+
+    @self_managed_active_directory_configuration.setter
+    def self_managed_active_directory_configuration(self, value: Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs']]):
+        pulumi.set(self, "self_managed_active_directory_configuration", value)
+
+
+@pulumi.input_type
+class OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs:
+    def __init__(__self__, *,
+                 dns_ips: pulumi.Input[Sequence[pulumi.Input[str]]],
+                 domain_name: pulumi.Input[str],
+                 password: pulumi.Input[str],
+                 username: pulumi.Input[str],
+                 file_system_administrators_group: Optional[pulumi.Input[str]] = None,
+                 organizational_unit_distinguidshed_name: Optional[pulumi.Input[str]] = None):
+        """
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] dns_ips: A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+        :param pulumi.Input[str] domain_name: The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+        :param pulumi.Input[str] password: The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        :param pulumi.Input[str] username: The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        :param pulumi.Input[str] file_system_administrators_group: The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+        """
+        pulumi.set(__self__, "dns_ips", dns_ips)
+        pulumi.set(__self__, "domain_name", domain_name)
+        pulumi.set(__self__, "password", password)
+        pulumi.set(__self__, "username", username)
+        if file_system_administrators_group is not None:
+            pulumi.set(__self__, "file_system_administrators_group", file_system_administrators_group)
+        if organizational_unit_distinguidshed_name is not None:
+            pulumi.set(__self__, "organizational_unit_distinguidshed_name", organizational_unit_distinguidshed_name)
+
+    @property
+    @pulumi.getter(name="dnsIps")
+    def dns_ips(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
+        """
+        A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+        """
+        return pulumi.get(self, "dns_ips")
+
+    @dns_ips.setter
+    def dns_ips(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
+        pulumi.set(self, "dns_ips", value)
+
+    @property
+    @pulumi.getter(name="domainName")
+    def domain_name(self) -> pulumi.Input[str]:
+        """
+        The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+        """
+        return pulumi.get(self, "domain_name")
+
+    @domain_name.setter
+    def domain_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "domain_name", value)
+
+    @property
+    @pulumi.getter
+    def password(self) -> pulumi.Input[str]:
+        """
+        The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        """
+        return pulumi.get(self, "password")
+
+    @password.setter
+    def password(self, value: pulumi.Input[str]):
+        pulumi.set(self, "password", value)
+
+    @property
+    @pulumi.getter
+    def username(self) -> pulumi.Input[str]:
+        """
+        The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        """
+        return pulumi.get(self, "username")
+
+    @username.setter
+    def username(self, value: pulumi.Input[str]):
+        pulumi.set(self, "username", value)
+
+    @property
+    @pulumi.getter(name="fileSystemAdministratorsGroup")
+    def file_system_administrators_group(self) -> Optional[pulumi.Input[str]]:
+        """
+        The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+        """
+        return pulumi.get(self, "file_system_administrators_group")
+
+    @file_system_administrators_group.setter
+    def file_system_administrators_group(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "file_system_administrators_group", value)
+
+    @property
+    @pulumi.getter(name="organizationalUnitDistinguidshedName")
+    def organizational_unit_distinguidshed_name(self) -> Optional[pulumi.Input[str]]:
+        return pulumi.get(self, "organizational_unit_distinguidshed_name")
+
+    @organizational_unit_distinguidshed_name.setter
+    def organizational_unit_distinguidshed_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "organizational_unit_distinguidshed_name", value)
+
+
+@pulumi.input_type
+class OntapStorageVirtualMachineEndpointArgs:
+    def __init__(__self__, *,
+                 iscses: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointIscseArgs']]]] = None,
+                 managements: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointManagementArgs']]]] = None,
+                 nfs: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointNfArgs']]]] = None,
+                 smbs: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointSmbArgs']]]] = None):
+        """
+        :param pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointIscseArgs']]] iscses: An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+        :param pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointManagementArgs']]] managements: An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+        :param pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointNfArgs']]] nfs: An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+        :param pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointSmbArgs']]] smbs: An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See Endpoint.
+        """
+        if iscses is not None:
+            pulumi.set(__self__, "iscses", iscses)
+        if managements is not None:
+            pulumi.set(__self__, "managements", managements)
+        if nfs is not None:
+            pulumi.set(__self__, "nfs", nfs)
+        if smbs is not None:
+            pulumi.set(__self__, "smbs", smbs)
+
+    @property
+    @pulumi.getter
+    def iscses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointIscseArgs']]]]:
+        """
+        An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+        """
+        return pulumi.get(self, "iscses")
+
+    @iscses.setter
+    def iscses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointIscseArgs']]]]):
+        pulumi.set(self, "iscses", value)
+
+    @property
+    @pulumi.getter
+    def managements(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointManagementArgs']]]]:
+        """
+        An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+        """
+        return pulumi.get(self, "managements")
+
+    @managements.setter
+    def managements(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointManagementArgs']]]]):
+        pulumi.set(self, "managements", value)
+
+    @property
+    @pulumi.getter
+    def nfs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointNfArgs']]]]:
+        """
+        An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+        """
+        return pulumi.get(self, "nfs")
+
+    @nfs.setter
+    def nfs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointNfArgs']]]]):
+        pulumi.set(self, "nfs", value)
+
+    @property
+    @pulumi.getter
+    def smbs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointSmbArgs']]]]:
+        """
+        An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See Endpoint.
+        """
+        return pulumi.get(self, "smbs")
+
+    @smbs.setter
+    def smbs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointSmbArgs']]]]):
+        pulumi.set(self, "smbs", value)
+
+
+@pulumi.input_type
+class OntapStorageVirtualMachineEndpointIscseArgs:
+    def __init__(__self__, *,
+                 dns_name: Optional[pulumi.Input[str]] = None,
+                 ip_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
+        """
+        :param pulumi.Input[str] dns_name: The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] ip_addresses: IP addresses of the storage virtual machine endpoint.
+        """
+        if dns_name is not None:
+            pulumi.set(__self__, "dns_name", dns_name)
+        if ip_addresses is not None:
+            pulumi.set(__self__, "ip_addresses", ip_addresses)
+
+    @property
+    @pulumi.getter(name="dnsName")
+    def dns_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        """
+        return pulumi.get(self, "dns_name")
+
+    @dns_name.setter
+    def dns_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "dns_name", value)
+
+    @property
+    @pulumi.getter(name="ipAddresses")
+    def ip_addresses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+        """
+        IP addresses of the storage virtual machine endpoint.
+        """
+        return pulumi.get(self, "ip_addresses")
+
+    @ip_addresses.setter
+    def ip_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+        pulumi.set(self, "ip_addresses", value)
+
+
+@pulumi.input_type
+class OntapStorageVirtualMachineEndpointManagementArgs:
+    def __init__(__self__, *,
+                 dns_name: Optional[pulumi.Input[str]] = None,
+                 ip_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
+        """
+        :param pulumi.Input[str] dns_name: The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] ip_addresses: IP addresses of the storage virtual machine endpoint.
+        """
+        if dns_name is not None:
+            pulumi.set(__self__, "dns_name", dns_name)
+        if ip_addresses is not None:
+            pulumi.set(__self__, "ip_addresses", ip_addresses)
+
+    @property
+    @pulumi.getter(name="dnsName")
+    def dns_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        """
+        return pulumi.get(self, "dns_name")
+
+    @dns_name.setter
+    def dns_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "dns_name", value)
+
+    @property
+    @pulumi.getter(name="ipAddresses")
+    def ip_addresses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+        """
+        IP addresses of the storage virtual machine endpoint.
+        """
+        return pulumi.get(self, "ip_addresses")
+
+    @ip_addresses.setter
+    def ip_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+        pulumi.set(self, "ip_addresses", value)
+
+
+@pulumi.input_type
+class OntapStorageVirtualMachineEndpointNfArgs:
+    def __init__(__self__, *,
+                 dns_name: Optional[pulumi.Input[str]] = None,
+                 ip_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
+        """
+        :param pulumi.Input[str] dns_name: The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] ip_addresses: IP addresses of the storage virtual machine endpoint.
+        """
+        if dns_name is not None:
+            pulumi.set(__self__, "dns_name", dns_name)
+        if ip_addresses is not None:
+            pulumi.set(__self__, "ip_addresses", ip_addresses)
+
+    @property
+    @pulumi.getter(name="dnsName")
+    def dns_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        """
+        return pulumi.get(self, "dns_name")
+
+    @dns_name.setter
+    def dns_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "dns_name", value)
+
+    @property
+    @pulumi.getter(name="ipAddresses")
+    def ip_addresses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+        """
+        IP addresses of the storage virtual machine endpoint.
+        """
+        return pulumi.get(self, "ip_addresses")
+
+    @ip_addresses.setter
+    def ip_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+        pulumi.set(self, "ip_addresses", value)
+
+
+@pulumi.input_type
+class OntapStorageVirtualMachineEndpointSmbArgs:
+    def __init__(__self__, *,
+                 dns_name: Optional[pulumi.Input[str]] = None,
+                 ip_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
+        """
+        :param pulumi.Input[str] dns_name: The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] ip_addresses: IP addresses of the storage virtual machine endpoint.
+        """
+        if dns_name is not None:
+            pulumi.set(__self__, "dns_name", dns_name)
+        if ip_addresses is not None:
+            pulumi.set(__self__, "ip_addresses", ip_addresses)
+
+    @property
+    @pulumi.getter(name="dnsName")
+    def dns_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        """
+        return pulumi.get(self, "dns_name")
+
+    @dns_name.setter
+    def dns_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "dns_name", value)
+
+    @property
+    @pulumi.getter(name="ipAddresses")
+    def ip_addresses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+        """
+        IP addresses of the storage virtual machine endpoint.
+        """
+        return pulumi.get(self, "ip_addresses")
+
+    @ip_addresses.setter
+    def ip_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+        pulumi.set(self, "ip_addresses", value)
+
+
+@pulumi.input_type
+class OntapVolumeTieringPolicyArgs:
+    def __init__(__self__, *,
+                 cooling_period: Optional[pulumi.Input[int]] = None,
+                 name: Optional[pulumi.Input[str]] = None):
+        """
+        :param pulumi.Input[str] name: Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        """
+        if cooling_period is not None:
+            pulumi.set(__self__, "cooling_period", cooling_period)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter(name="coolingPeriod")
+    def cooling_period(self) -> Optional[pulumi.Input[int]]:
+        return pulumi.get(self, "cooling_period")
+
+    @cooling_period.setter
+    def cooling_period(self, value: Optional[pulumi.Input[int]]):
+        pulumi.set(self, "cooling_period", value)
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "name", value)
+
+
 @pulumi.input_type
 class WindowsFileSystemAuditLogConfigurationArgs:
     def __init__(__self__, *,
diff --git a/sdk/python/pulumi_aws/fsx/ontap_storage_virtual_machine.py b/sdk/python/pulumi_aws/fsx/ontap_storage_virtual_machine.py
new file mode 100644
index 00000000000..f15965d2a49
--- /dev/null
+++ b/sdk/python/pulumi_aws/fsx/ontap_storage_virtual_machine.py
@@ -0,0 +1,643 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from .. import _utilities
+from . import outputs
+from ._inputs import *
+
+__all__ = ['OntapStorageVirtualMachineArgs', 'OntapStorageVirtualMachine']
+
+@pulumi.input_type
+class OntapStorageVirtualMachineArgs:
+    def __init__(__self__, *,
+                 file_system_id: pulumi.Input[str],
+                 active_directory_configuration: Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 root_volume_security_style: Optional[pulumi.Input[str]] = None,
+                 svm_admin_password: Optional[pulumi.Input[str]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None):
+        """
+        The set of arguments for constructing a OntapStorageVirtualMachine resource.
+        :param pulumi.Input[str] file_system_id: The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        :param pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs'] active_directory_configuration: Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        :param pulumi.Input[str] name: The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        :param pulumi.Input[str] root_volume_security_style: Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        """
+        pulumi.set(__self__, "file_system_id", file_system_id)
+        if active_directory_configuration is not None:
+            pulumi.set(__self__, "active_directory_configuration", active_directory_configuration)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+        if root_volume_security_style is not None:
+            pulumi.set(__self__, "root_volume_security_style", root_volume_security_style)
+        if svm_admin_password is not None:
+            pulumi.set(__self__, "svm_admin_password", svm_admin_password)
+        if tags is not None:
+            pulumi.set(__self__, "tags", tags)
+        if tags_all is not None:
+            pulumi.set(__self__, "tags_all", tags_all)
+
+    @property
+    @pulumi.getter(name="fileSystemId")
+    def file_system_id(self) -> pulumi.Input[str]:
+        """
+        The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        """
+        return pulumi.get(self, "file_system_id")
+
+    @file_system_id.setter
+    def file_system_id(self, value: pulumi.Input[str]):
+        pulumi.set(self, "file_system_id", value)
+
+    @property
+    @pulumi.getter(name="activeDirectoryConfiguration")
+    def active_directory_configuration(self) -> Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']]:
+        """
+        Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        """
+        return pulumi.get(self, "active_directory_configuration")
+
+    @active_directory_configuration.setter
+    def active_directory_configuration(self, value: Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']]):
+        pulumi.set(self, "active_directory_configuration", value)
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "name", value)
+
+    @property
+    @pulumi.getter(name="rootVolumeSecurityStyle")
+    def root_volume_security_style(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        """
+        return pulumi.get(self, "root_volume_security_style")
+
+    @root_volume_security_style.setter
+    def root_volume_security_style(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "root_volume_security_style", value)
+
+    @property
+    @pulumi.getter(name="svmAdminPassword")
+    def svm_admin_password(self) -> Optional[pulumi.Input[str]]:
+        return pulumi.get(self, "svm_admin_password")
+
+    @svm_admin_password.setter
+    def svm_admin_password(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "svm_admin_password", value)
+
+    @property
+    @pulumi.getter
+    def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
+        """
+        A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        """
+        return pulumi.get(self, "tags")
+
+    @tags.setter
+    def tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
+        pulumi.set(self, "tags", value)
+
+    @property
+    @pulumi.getter(name="tagsAll")
+    def tags_all(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
+        """
+        A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        """
+        return pulumi.get(self, "tags_all")
+
+    @tags_all.setter
+    def tags_all(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
+        pulumi.set(self, "tags_all", value)
+
+
+@pulumi.input_type
+class _OntapStorageVirtualMachineState:
+    def __init__(__self__, *,
+                 active_directory_configuration: Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']] = None,
+                 arn: Optional[pulumi.Input[str]] = None,
+                 endpoints: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointArgs']]]] = None,
+                 file_system_id: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 root_volume_security_style: Optional[pulumi.Input[str]] = None,
+                 subtype: Optional[pulumi.Input[str]] = None,
+                 svm_admin_password: Optional[pulumi.Input[str]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 uuid: Optional[pulumi.Input[str]] = None):
+        """
+        Input properties used for looking up and filtering OntapStorageVirtualMachine resources.
+        :param pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs'] active_directory_configuration: Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        :param pulumi.Input[str] arn: Amazon Resource Name of the storage virtual machine.
+        :param pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointArgs']]] endpoints: The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+        :param pulumi.Input[str] file_system_id: The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        :param pulumi.Input[str] name: The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        :param pulumi.Input[str] root_volume_security_style: Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        :param pulumi.Input[str] subtype: Describes the SVM's subtype, e.g. `DEFAULT`
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        :param pulumi.Input[str] uuid: The SVM's UUID (universally unique identifier).
+        """
+        if active_directory_configuration is not None:
+            pulumi.set(__self__, "active_directory_configuration", active_directory_configuration)
+        if arn is not None:
+            pulumi.set(__self__, "arn", arn)
+        if endpoints is not None:
+            pulumi.set(__self__, "endpoints", endpoints)
+        if file_system_id is not None:
+            pulumi.set(__self__, "file_system_id", file_system_id)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+        if root_volume_security_style is not None:
+            pulumi.set(__self__, "root_volume_security_style", root_volume_security_style)
+        if subtype is not None:
+            pulumi.set(__self__, "subtype", subtype)
+        if svm_admin_password is not None:
+            pulumi.set(__self__, "svm_admin_password", svm_admin_password)
+        if tags is not None:
+            pulumi.set(__self__, "tags", tags)
+        if tags_all is not None:
+            pulumi.set(__self__, "tags_all", tags_all)
+        if uuid is not None:
+            pulumi.set(__self__, "uuid", uuid)
+
+    @property
+    @pulumi.getter(name="activeDirectoryConfiguration")
+    def active_directory_configuration(self) -> Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']]:
+        """
+        Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        """
+        return pulumi.get(self, "active_directory_configuration")
+
+    @active_directory_configuration.setter
+    def active_directory_configuration(self, value: Optional[pulumi.Input['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']]):
+        pulumi.set(self, "active_directory_configuration", value)
+
+    @property
+    @pulumi.getter
+    def arn(self) -> Optional[pulumi.Input[str]]:
+        """
+        Amazon Resource Name of the storage virtual machine.
+        """
+        return pulumi.get(self, "arn")
+
+    @arn.setter
+    def arn(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "arn", value)
+
+    @property
+    @pulumi.getter
+    def endpoints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointArgs']]]]:
+        """
+        The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+        """
+        return pulumi.get(self, "endpoints")
+
+    @endpoints.setter
+    def endpoints(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['OntapStorageVirtualMachineEndpointArgs']]]]):
+        pulumi.set(self, "endpoints", value)
+
+    @property
+    @pulumi.getter(name="fileSystemId")
+    def file_system_id(self) -> Optional[pulumi.Input[str]]:
+        """
+        The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        """
+        return pulumi.get(self, "file_system_id")
+
+    @file_system_id.setter
+    def file_system_id(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "file_system_id", value)
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "name", value)
+
+    @property
+    @pulumi.getter(name="rootVolumeSecurityStyle")
+    def root_volume_security_style(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        """
+        return pulumi.get(self, "root_volume_security_style")
+
+    @root_volume_security_style.setter
+    def root_volume_security_style(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "root_volume_security_style", value)
+
+    @property
+    @pulumi.getter
+    def subtype(self) -> Optional[pulumi.Input[str]]:
+        """
+        Describes the SVM's subtype, e.g. `DEFAULT`
+        """
+        return pulumi.get(self, "subtype")
+
+    @subtype.setter
+    def subtype(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "subtype", value)
+
+    @property
+    @pulumi.getter(name="svmAdminPassword")
+    def svm_admin_password(self) -> Optional[pulumi.Input[str]]:
+        return pulumi.get(self, "svm_admin_password")
+
+    @svm_admin_password.setter
+    def svm_admin_password(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "svm_admin_password", value)
+
+    @property
+    @pulumi.getter
+    def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
+        """
+        A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        """
+        return pulumi.get(self, "tags")
+
+    @tags.setter
+    def tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
+        pulumi.set(self, "tags", value)
+
+    @property
+    @pulumi.getter(name="tagsAll")
+    def tags_all(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
+        """
+        A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        """
+        return pulumi.get(self, "tags_all")
+
+    @tags_all.setter
+    def tags_all(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
+        pulumi.set(self, "tags_all", value)
+
+    @property
+    @pulumi.getter
+    def uuid(self) -> Optional[pulumi.Input[str]]:
+        """
+        The SVM's UUID (universally unique identifier).
+        """
+        return pulumi.get(self, "uuid")
+
+    @uuid.setter
+    def uuid(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "uuid", value)
+
+
+class OntapStorageVirtualMachine(pulumi.CustomResource):
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 active_directory_configuration: Optional[pulumi.Input[pulumi.InputType['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']]] = None,
+                 file_system_id: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 root_volume_security_style: Optional[pulumi.Input[str]] = None,
+                 svm_admin_password: Optional[pulumi.Input[str]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 __props__=None):
+        """
+        Manages a FSx Storage Virtual Machine.
+        See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html) for more information.
+
+        ## Example Usage
+        ### Basic Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test = aws.fsx.OntapStorageVirtualMachine("test", file_system_id=aws_fsx_ontap_file_system["test"]["id"])
+        ```
+        ### Using a Self-Managed Microsoft Active Directory
+
+        Additional information for using AWS Directory Service with ONTAP File Systems can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD.html).
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test = aws.fsx.OntapStorageVirtualMachine("test",
+            file_system_id=aws_fsx_ontap_file_system["test"]["id"],
+            active_directory_configuration=aws.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationArgs(
+                netbios_name="mysvm",
+                self_managed_active_directory_configuration=aws.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs(
+                    dns_ips=[
+                        "10.0.0.111",
+                        "10.0.0.222",
+                    ],
+                    domain_name="corp.example.com",
+                    password="avoid-plaintext-passwords",
+                    username="Admin",
+                ),
+            ))
+        ```
+
+        ## Import
+
+        FSx Storage Virtual Machine can be imported using the `id`, e.g.,
+
+        ```sh
+         $ pulumi import aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine example svm-12345678abcdef123
+        ```
+
+         Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g., terraform resource "aws_fsx_ontap_storage_virtual_machine" "example" {
+
+        # ... other configuration ...
+
+         svm_admin_password = "avoid-plaintext-passwords"
+
+        # There is no FSx API for reading svm_admin_password
+
+         lifecycle {
+
+         ignore_changes = [svm_admin_password]
+
+         } }
+
+        :param str resource_name: The name of the resource.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[pulumi.InputType['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']] active_directory_configuration: Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        :param pulumi.Input[str] file_system_id: The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        :param pulumi.Input[str] name: The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        :param pulumi.Input[str] root_volume_security_style: Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        """
+        ...
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 args: OntapStorageVirtualMachineArgs,
+                 opts: Optional[pulumi.ResourceOptions] = None):
+        """
+        Manages a FSx Storage Virtual Machine.
+        See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html) for more information.
+
+        ## Example Usage
+        ### Basic Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test = aws.fsx.OntapStorageVirtualMachine("test", file_system_id=aws_fsx_ontap_file_system["test"]["id"])
+        ```
+        ### Using a Self-Managed Microsoft Active Directory
+
+        Additional information for using AWS Directory Service with ONTAP File Systems can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD.html).
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test = aws.fsx.OntapStorageVirtualMachine("test",
+            file_system_id=aws_fsx_ontap_file_system["test"]["id"],
+            active_directory_configuration=aws.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationArgs(
+                netbios_name="mysvm",
+                self_managed_active_directory_configuration=aws.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfigurationArgs(
+                    dns_ips=[
+                        "10.0.0.111",
+                        "10.0.0.222",
+                    ],
+                    domain_name="corp.example.com",
+                    password="avoid-plaintext-passwords",
+                    username="Admin",
+                ),
+            ))
+        ```
+
+        ## Import
+
+        FSx Storage Virtual Machine can be imported using the `id`, e.g.,
+
+        ```sh
+         $ pulumi import aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine example svm-12345678abcdef123
+        ```
+
+         Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g., terraform resource "aws_fsx_ontap_storage_virtual_machine" "example" {
+
+        # ... other configuration ...
+
+         svm_admin_password = "avoid-plaintext-passwords"
+
+        # There is no FSx API for reading svm_admin_password
+
+         lifecycle {
+
+         ignore_changes = [svm_admin_password]
+
+         } }
+
+        :param str resource_name: The name of the resource.
+        :param OntapStorageVirtualMachineArgs args: The arguments to use to populate this resource's properties.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        """
+        ...
+    def __init__(__self__, resource_name: str, *args, **kwargs):
+        resource_args, opts = _utilities.get_resource_args_opts(OntapStorageVirtualMachineArgs, pulumi.ResourceOptions, *args, **kwargs)
+        if resource_args is not None:
+            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
+        else:
+            __self__._internal_init(resource_name, *args, **kwargs)
+
+    def _internal_init(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 active_directory_configuration: Optional[pulumi.Input[pulumi.InputType['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']]] = None,
+                 file_system_id: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 root_volume_security_style: Optional[pulumi.Input[str]] = None,
+                 svm_admin_password: Optional[pulumi.Input[str]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 __props__=None):
+        if opts is None:
+            opts = pulumi.ResourceOptions()
+        if not isinstance(opts, pulumi.ResourceOptions):
+            raise TypeError('Expected resource options to be a ResourceOptions instance')
+        if opts.version is None:
+            opts.version = _utilities.get_version()
+        if opts.id is None:
+            if __props__ is not None:
+                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
+            __props__ = OntapStorageVirtualMachineArgs.__new__(OntapStorageVirtualMachineArgs)
+
+            __props__.__dict__["active_directory_configuration"] = active_directory_configuration
+            if file_system_id is None and not opts.urn:
+                raise TypeError("Missing required property 'file_system_id'")
+            __props__.__dict__["file_system_id"] = file_system_id
+            __props__.__dict__["name"] = name
+            __props__.__dict__["root_volume_security_style"] = root_volume_security_style
+            __props__.__dict__["svm_admin_password"] = svm_admin_password
+            __props__.__dict__["tags"] = tags
+            __props__.__dict__["tags_all"] = tags_all
+            __props__.__dict__["arn"] = None
+            __props__.__dict__["endpoints"] = None
+            __props__.__dict__["subtype"] = None
+            __props__.__dict__["uuid"] = None
+        super(OntapStorageVirtualMachine, __self__).__init__(
+            'aws:fsx/ontapStorageVirtualMachine:OntapStorageVirtualMachine',
+            resource_name,
+            __props__,
+            opts)
+
+    @staticmethod
+    def get(resource_name: str,
+            id: pulumi.Input[str],
+            opts: Optional[pulumi.ResourceOptions] = None,
+            active_directory_configuration: Optional[pulumi.Input[pulumi.InputType['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']]] = None,
+            arn: Optional[pulumi.Input[str]] = None,
+            endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['OntapStorageVirtualMachineEndpointArgs']]]]] = None,
+            file_system_id: Optional[pulumi.Input[str]] = None,
+            name: Optional[pulumi.Input[str]] = None,
+            root_volume_security_style: Optional[pulumi.Input[str]] = None,
+            subtype: Optional[pulumi.Input[str]] = None,
+            svm_admin_password: Optional[pulumi.Input[str]] = None,
+            tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+            tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+            uuid: Optional[pulumi.Input[str]] = None) -> 'OntapStorageVirtualMachine':
+        """
+        Get an existing OntapStorageVirtualMachine resource's state with the given name, id, and optional extra
+        properties used to qualify the lookup.
+
+        :param str resource_name: The unique name of the resulting resource.
+        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[pulumi.InputType['OntapStorageVirtualMachineActiveDirectoryConfigurationArgs']] active_directory_configuration: Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        :param pulumi.Input[str] arn: Amazon Resource Name of the storage virtual machine.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['OntapStorageVirtualMachineEndpointArgs']]]] endpoints: The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+        :param pulumi.Input[str] file_system_id: The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        :param pulumi.Input[str] name: The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        :param pulumi.Input[str] root_volume_security_style: Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        :param pulumi.Input[str] subtype: Describes the SVM's subtype, e.g. `DEFAULT`
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        :param pulumi.Input[str] uuid: The SVM's UUID (universally unique identifier).
+        """
+        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
+
+        __props__ = _OntapStorageVirtualMachineState.__new__(_OntapStorageVirtualMachineState)
+
+        __props__.__dict__["active_directory_configuration"] = active_directory_configuration
+        __props__.__dict__["arn"] = arn
+        __props__.__dict__["endpoints"] = endpoints
+        __props__.__dict__["file_system_id"] = file_system_id
+        __props__.__dict__["name"] = name
+        __props__.__dict__["root_volume_security_style"] = root_volume_security_style
+        __props__.__dict__["subtype"] = subtype
+        __props__.__dict__["svm_admin_password"] = svm_admin_password
+        __props__.__dict__["tags"] = tags
+        __props__.__dict__["tags_all"] = tags_all
+        __props__.__dict__["uuid"] = uuid
+        return OntapStorageVirtualMachine(resource_name, opts=opts, __props__=__props__)
+
+    @property
+    @pulumi.getter(name="activeDirectoryConfiguration")
+    def active_directory_configuration(self) -> pulumi.Output[Optional['outputs.OntapStorageVirtualMachineActiveDirectoryConfiguration']]:
+        """
+        Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+        """
+        return pulumi.get(self, "active_directory_configuration")
+
+    @property
+    @pulumi.getter
+    def arn(self) -> pulumi.Output[str]:
+        """
+        Amazon Resource Name of the storage virtual machine.
+        """
+        return pulumi.get(self, "arn")
+
+    @property
+    @pulumi.getter
+    def endpoints(self) -> pulumi.Output[Sequence['outputs.OntapStorageVirtualMachineEndpoint']]:
+        """
+        The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See Endpoints below.
+        """
+        return pulumi.get(self, "endpoints")
+
+    @property
+    @pulumi.getter(name="fileSystemId")
+    def file_system_id(self) -> pulumi.Output[str]:
+        """
+        The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+        """
+        return pulumi.get(self, "file_system_id")
+
+    @property
+    @pulumi.getter
+    def name(self) -> pulumi.Output[str]:
+        """
+        The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter(name="rootVolumeSecurityStyle")
+    def root_volume_security_style(self) -> pulumi.Output[Optional[str]]:
+        """
+        Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+        """
+        return pulumi.get(self, "root_volume_security_style")
+
+    @property
+    @pulumi.getter
+    def subtype(self) -> pulumi.Output[str]:
+        """
+        Describes the SVM's subtype, e.g. `DEFAULT`
+        """
+        return pulumi.get(self, "subtype")
+
+    @property
+    @pulumi.getter(name="svmAdminPassword")
+    def svm_admin_password(self) -> pulumi.Output[Optional[str]]:
+        return pulumi.get(self, "svm_admin_password")
+
+    @property
+    @pulumi.getter
+    def tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
+        """
+        A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        """
+        return pulumi.get(self, "tags")
+
+    @property
+    @pulumi.getter(name="tagsAll")
+    def tags_all(self) -> pulumi.Output[Mapping[str, str]]:
+        """
+        A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        """
+        return pulumi.get(self, "tags_all")
+
+    @property
+    @pulumi.getter
+    def uuid(self) -> pulumi.Output[str]:
+        """
+        The SVM's UUID (universally unique identifier).
+        """
+        return pulumi.get(self, "uuid")
+
diff --git a/sdk/python/pulumi_aws/fsx/ontap_volume.py b/sdk/python/pulumi_aws/fsx/ontap_volume.py
new file mode 100644
index 00000000000..01846b8a23c
--- /dev/null
+++ b/sdk/python/pulumi_aws/fsx/ontap_volume.py
@@ -0,0 +1,785 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from .. import _utilities
+from . import outputs
+from ._inputs import *
+
+__all__ = ['OntapVolumeArgs', 'OntapVolume']
+
+@pulumi.input_type
+class OntapVolumeArgs:
+    def __init__(__self__, *,
+                 junction_path: pulumi.Input[str],
+                 size_in_megabytes: pulumi.Input[int],
+                 storage_efficiency_enabled: pulumi.Input[bool],
+                 storage_virtual_machine_id: pulumi.Input[str],
+                 name: Optional[pulumi.Input[str]] = None,
+                 security_style: Optional[pulumi.Input[str]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tiering_policy: Optional[pulumi.Input['OntapVolumeTieringPolicyArgs']] = None,
+                 volume_type: Optional[pulumi.Input[str]] = None):
+        """
+        The set of arguments for constructing a OntapVolume resource.
+        :param pulumi.Input[str] junction_path: Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        :param pulumi.Input[int] size_in_megabytes: Specifies the size of the volume, in megabytes (MB), that you are creating.
+        :param pulumi.Input[bool] storage_efficiency_enabled: Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        :param pulumi.Input[str] storage_virtual_machine_id: Specifies the storage virtual machine in which to create the volume.
+        :param pulumi.Input[str] name: Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        :param pulumi.Input[str] security_style: Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        :param pulumi.Input[str] volume_type: The type of volume, currently the only valid value is `ONTAP`.
+        """
+        pulumi.set(__self__, "junction_path", junction_path)
+        pulumi.set(__self__, "size_in_megabytes", size_in_megabytes)
+        pulumi.set(__self__, "storage_efficiency_enabled", storage_efficiency_enabled)
+        pulumi.set(__self__, "storage_virtual_machine_id", storage_virtual_machine_id)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+        if security_style is not None:
+            pulumi.set(__self__, "security_style", security_style)
+        if tags is not None:
+            pulumi.set(__self__, "tags", tags)
+        if tags_all is not None:
+            pulumi.set(__self__, "tags_all", tags_all)
+        if tiering_policy is not None:
+            pulumi.set(__self__, "tiering_policy", tiering_policy)
+        if volume_type is not None:
+            pulumi.set(__self__, "volume_type", volume_type)
+
+    @property
+    @pulumi.getter(name="junctionPath")
+    def junction_path(self) -> pulumi.Input[str]:
+        """
+        Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        """
+        return pulumi.get(self, "junction_path")
+
+    @junction_path.setter
+    def junction_path(self, value: pulumi.Input[str]):
+        pulumi.set(self, "junction_path", value)
+
+    @property
+    @pulumi.getter(name="sizeInMegabytes")
+    def size_in_megabytes(self) -> pulumi.Input[int]:
+        """
+        Specifies the size of the volume, in megabytes (MB), that you are creating.
+        """
+        return pulumi.get(self, "size_in_megabytes")
+
+    @size_in_megabytes.setter
+    def size_in_megabytes(self, value: pulumi.Input[int]):
+        pulumi.set(self, "size_in_megabytes", value)
+
+    @property
+    @pulumi.getter(name="storageEfficiencyEnabled")
+    def storage_efficiency_enabled(self) -> pulumi.Input[bool]:
+        """
+        Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        """
+        return pulumi.get(self, "storage_efficiency_enabled")
+
+    @storage_efficiency_enabled.setter
+    def storage_efficiency_enabled(self, value: pulumi.Input[bool]):
+        pulumi.set(self, "storage_efficiency_enabled", value)
+
+    @property
+    @pulumi.getter(name="storageVirtualMachineId")
+    def storage_virtual_machine_id(self) -> pulumi.Input[str]:
+        """
+        Specifies the storage virtual machine in which to create the volume.
+        """
+        return pulumi.get(self, "storage_virtual_machine_id")
+
+    @storage_virtual_machine_id.setter
+    def storage_virtual_machine_id(self, value: pulumi.Input[str]):
+        pulumi.set(self, "storage_virtual_machine_id", value)
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "name", value)
+
+    @property
+    @pulumi.getter(name="securityStyle")
+    def security_style(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        """
+        return pulumi.get(self, "security_style")
+
+    @security_style.setter
+    def security_style(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "security_style", value)
+
+    @property
+    @pulumi.getter
+    def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
+        """
+        A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        """
+        return pulumi.get(self, "tags")
+
+    @tags.setter
+    def tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
+        pulumi.set(self, "tags", value)
+
+    @property
+    @pulumi.getter(name="tagsAll")
+    def tags_all(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
+        """
+        A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        """
+        return pulumi.get(self, "tags_all")
+
+    @tags_all.setter
+    def tags_all(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
+        pulumi.set(self, "tags_all", value)
+
+    @property
+    @pulumi.getter(name="tieringPolicy")
+    def tiering_policy(self) -> Optional[pulumi.Input['OntapVolumeTieringPolicyArgs']]:
+        return pulumi.get(self, "tiering_policy")
+
+    @tiering_policy.setter
+    def tiering_policy(self, value: Optional[pulumi.Input['OntapVolumeTieringPolicyArgs']]):
+        pulumi.set(self, "tiering_policy", value)
+
+    @property
+    @pulumi.getter(name="volumeType")
+    def volume_type(self) -> Optional[pulumi.Input[str]]:
+        """
+        The type of volume, currently the only valid value is `ONTAP`.
+        """
+        return pulumi.get(self, "volume_type")
+
+    @volume_type.setter
+    def volume_type(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "volume_type", value)
+
+
+@pulumi.input_type
+class _OntapVolumeState:
+    def __init__(__self__, *,
+                 arn: Optional[pulumi.Input[str]] = None,
+                 file_system_id: Optional[pulumi.Input[str]] = None,
+                 flexcache_endpoint_type: Optional[pulumi.Input[str]] = None,
+                 junction_path: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 ontap_volume_type: Optional[pulumi.Input[str]] = None,
+                 security_style: Optional[pulumi.Input[str]] = None,
+                 size_in_megabytes: Optional[pulumi.Input[int]] = None,
+                 storage_efficiency_enabled: Optional[pulumi.Input[bool]] = None,
+                 storage_virtual_machine_id: Optional[pulumi.Input[str]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tiering_policy: Optional[pulumi.Input['OntapVolumeTieringPolicyArgs']] = None,
+                 uuid: Optional[pulumi.Input[str]] = None,
+                 volume_type: Optional[pulumi.Input[str]] = None):
+        """
+        Input properties used for looking up and filtering OntapVolume resources.
+        :param pulumi.Input[str] arn: Amazon Resource Name of the volune.
+        :param pulumi.Input[str] file_system_id: Describes the file system for the volume, e.g. `fs-12345679`
+        :param pulumi.Input[str] flexcache_endpoint_type: Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+        :param pulumi.Input[str] junction_path: Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        :param pulumi.Input[str] name: Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        :param pulumi.Input[str] ontap_volume_type: Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+        :param pulumi.Input[str] security_style: Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        :param pulumi.Input[int] size_in_megabytes: Specifies the size of the volume, in megabytes (MB), that you are creating.
+        :param pulumi.Input[bool] storage_efficiency_enabled: Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        :param pulumi.Input[str] storage_virtual_machine_id: Specifies the storage virtual machine in which to create the volume.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        :param pulumi.Input[str] uuid: The Volume's UUID (universally unique identifier).
+        :param pulumi.Input[str] volume_type: The type of volume, currently the only valid value is `ONTAP`.
+        """
+        if arn is not None:
+            pulumi.set(__self__, "arn", arn)
+        if file_system_id is not None:
+            pulumi.set(__self__, "file_system_id", file_system_id)
+        if flexcache_endpoint_type is not None:
+            pulumi.set(__self__, "flexcache_endpoint_type", flexcache_endpoint_type)
+        if junction_path is not None:
+            pulumi.set(__self__, "junction_path", junction_path)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+        if ontap_volume_type is not None:
+            pulumi.set(__self__, "ontap_volume_type", ontap_volume_type)
+        if security_style is not None:
+            pulumi.set(__self__, "security_style", security_style)
+        if size_in_megabytes is not None:
+            pulumi.set(__self__, "size_in_megabytes", size_in_megabytes)
+        if storage_efficiency_enabled is not None:
+            pulumi.set(__self__, "storage_efficiency_enabled", storage_efficiency_enabled)
+        if storage_virtual_machine_id is not None:
+            pulumi.set(__self__, "storage_virtual_machine_id", storage_virtual_machine_id)
+        if tags is not None:
+            pulumi.set(__self__, "tags", tags)
+        if tags_all is not None:
+            pulumi.set(__self__, "tags_all", tags_all)
+        if tiering_policy is not None:
+            pulumi.set(__self__, "tiering_policy", tiering_policy)
+        if uuid is not None:
+            pulumi.set(__self__, "uuid", uuid)
+        if volume_type is not None:
+            pulumi.set(__self__, "volume_type", volume_type)
+
+    @property
+    @pulumi.getter
+    def arn(self) -> Optional[pulumi.Input[str]]:
+        """
+        Amazon Resource Name of the volune.
+        """
+        return pulumi.get(self, "arn")
+
+    @arn.setter
+    def arn(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "arn", value)
+
+    @property
+    @pulumi.getter(name="fileSystemId")
+    def file_system_id(self) -> Optional[pulumi.Input[str]]:
+        """
+        Describes the file system for the volume, e.g. `fs-12345679`
+        """
+        return pulumi.get(self, "file_system_id")
+
+    @file_system_id.setter
+    def file_system_id(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "file_system_id", value)
+
+    @property
+    @pulumi.getter(name="flexcacheEndpointType")
+    def flexcache_endpoint_type(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+        """
+        return pulumi.get(self, "flexcache_endpoint_type")
+
+    @flexcache_endpoint_type.setter
+    def flexcache_endpoint_type(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "flexcache_endpoint_type", value)
+
+    @property
+    @pulumi.getter(name="junctionPath")
+    def junction_path(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        """
+        return pulumi.get(self, "junction_path")
+
+    @junction_path.setter
+    def junction_path(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "junction_path", value)
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "name", value)
+
+    @property
+    @pulumi.getter(name="ontapVolumeType")
+    def ontap_volume_type(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+        """
+        return pulumi.get(self, "ontap_volume_type")
+
+    @ontap_volume_type.setter
+    def ontap_volume_type(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "ontap_volume_type", value)
+
+    @property
+    @pulumi.getter(name="securityStyle")
+    def security_style(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        """
+        return pulumi.get(self, "security_style")
+
+    @security_style.setter
+    def security_style(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "security_style", value)
+
+    @property
+    @pulumi.getter(name="sizeInMegabytes")
+    def size_in_megabytes(self) -> Optional[pulumi.Input[int]]:
+        """
+        Specifies the size of the volume, in megabytes (MB), that you are creating.
+        """
+        return pulumi.get(self, "size_in_megabytes")
+
+    @size_in_megabytes.setter
+    def size_in_megabytes(self, value: Optional[pulumi.Input[int]]):
+        pulumi.set(self, "size_in_megabytes", value)
+
+    @property
+    @pulumi.getter(name="storageEfficiencyEnabled")
+    def storage_efficiency_enabled(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        """
+        return pulumi.get(self, "storage_efficiency_enabled")
+
+    @storage_efficiency_enabled.setter
+    def storage_efficiency_enabled(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "storage_efficiency_enabled", value)
+
+    @property
+    @pulumi.getter(name="storageVirtualMachineId")
+    def storage_virtual_machine_id(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the storage virtual machine in which to create the volume.
+        """
+        return pulumi.get(self, "storage_virtual_machine_id")
+
+    @storage_virtual_machine_id.setter
+    def storage_virtual_machine_id(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "storage_virtual_machine_id", value)
+
+    @property
+    @pulumi.getter
+    def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
+        """
+        A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        """
+        return pulumi.get(self, "tags")
+
+    @tags.setter
+    def tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
+        pulumi.set(self, "tags", value)
+
+    @property
+    @pulumi.getter(name="tagsAll")
+    def tags_all(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
+        """
+        A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        """
+        return pulumi.get(self, "tags_all")
+
+    @tags_all.setter
+    def tags_all(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
+        pulumi.set(self, "tags_all", value)
+
+    @property
+    @pulumi.getter(name="tieringPolicy")
+    def tiering_policy(self) -> Optional[pulumi.Input['OntapVolumeTieringPolicyArgs']]:
+        return pulumi.get(self, "tiering_policy")
+
+    @tiering_policy.setter
+    def tiering_policy(self, value: Optional[pulumi.Input['OntapVolumeTieringPolicyArgs']]):
+        pulumi.set(self, "tiering_policy", value)
+
+    @property
+    @pulumi.getter
+    def uuid(self) -> Optional[pulumi.Input[str]]:
+        """
+        The Volume's UUID (universally unique identifier).
+        """
+        return pulumi.get(self, "uuid")
+
+    @uuid.setter
+    def uuid(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "uuid", value)
+
+    @property
+    @pulumi.getter(name="volumeType")
+    def volume_type(self) -> Optional[pulumi.Input[str]]:
+        """
+        The type of volume, currently the only valid value is `ONTAP`.
+        """
+        return pulumi.get(self, "volume_type")
+
+    @volume_type.setter
+    def volume_type(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "volume_type", value)
+
+
+class OntapVolume(pulumi.CustomResource):
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 junction_path: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 security_style: Optional[pulumi.Input[str]] = None,
+                 size_in_megabytes: Optional[pulumi.Input[int]] = None,
+                 storage_efficiency_enabled: Optional[pulumi.Input[bool]] = None,
+                 storage_virtual_machine_id: Optional[pulumi.Input[str]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tiering_policy: Optional[pulumi.Input[pulumi.InputType['OntapVolumeTieringPolicyArgs']]] = None,
+                 volume_type: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        """
+        Manages a FSx ONTAP Volume.
+        See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html) for more information.
+
+        ## Example Usage
+        ### Basic Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test = aws.fsx.OntapVolume("test",
+            junction_path="/test",
+            size_in_megabytes=1024,
+            storage_efficiency_enabled=True,
+            storage_virtual_machine_id=aws_fsx_ontap_storage_virtual_machine["test"]["id"])
+        ```
+        ### Using Tiering Policy
+
+        Additional information on tiering policy with ONTAP Volumes can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html).
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test = aws.fsx.OntapVolume("test",
+            junction_path="/test",
+            size_in_megabytes=1024,
+            storage_efficiency_enabled=True,
+            storage_virtual_machine_id=aws_fsx_ontap_storage_virtual_machine["test"]["id"],
+            tiering_policy=aws.fsx.OntapVolumeTieringPolicyArgs(
+                name="AUTO",
+                cooling_period=31,
+            ))
+        ```
+
+        ## Import
+
+        FSx ONTAP volume can be imported using the `id`, e.g.,
+
+        ```sh
+         $ pulumi import aws:fsx/ontapVolume:OntapVolume example fsvol-12345678abcdef123
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] junction_path: Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        :param pulumi.Input[str] name: Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        :param pulumi.Input[str] security_style: Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        :param pulumi.Input[int] size_in_megabytes: Specifies the size of the volume, in megabytes (MB), that you are creating.
+        :param pulumi.Input[bool] storage_efficiency_enabled: Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        :param pulumi.Input[str] storage_virtual_machine_id: Specifies the storage virtual machine in which to create the volume.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        :param pulumi.Input[str] volume_type: The type of volume, currently the only valid value is `ONTAP`.
+        """
+        ...
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 args: OntapVolumeArgs,
+                 opts: Optional[pulumi.ResourceOptions] = None):
+        """
+        Manages a FSx ONTAP Volume.
+        See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html) for more information.
+
+        ## Example Usage
+        ### Basic Usage
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test = aws.fsx.OntapVolume("test",
+            junction_path="/test",
+            size_in_megabytes=1024,
+            storage_efficiency_enabled=True,
+            storage_virtual_machine_id=aws_fsx_ontap_storage_virtual_machine["test"]["id"])
+        ```
+        ### Using Tiering Policy
+
+        Additional information on tiering policy with ONTAP Volumes can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html).
+
+        ```python
+        import pulumi
+        import pulumi_aws as aws
+
+        test = aws.fsx.OntapVolume("test",
+            junction_path="/test",
+            size_in_megabytes=1024,
+            storage_efficiency_enabled=True,
+            storage_virtual_machine_id=aws_fsx_ontap_storage_virtual_machine["test"]["id"],
+            tiering_policy=aws.fsx.OntapVolumeTieringPolicyArgs(
+                name="AUTO",
+                cooling_period=31,
+            ))
+        ```
+
+        ## Import
+
+        FSx ONTAP volume can be imported using the `id`, e.g.,
+
+        ```sh
+         $ pulumi import aws:fsx/ontapVolume:OntapVolume example fsvol-12345678abcdef123
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param OntapVolumeArgs args: The arguments to use to populate this resource's properties.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        """
+        ...
+    def __init__(__self__, resource_name: str, *args, **kwargs):
+        resource_args, opts = _utilities.get_resource_args_opts(OntapVolumeArgs, pulumi.ResourceOptions, *args, **kwargs)
+        if resource_args is not None:
+            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
+        else:
+            __self__._internal_init(resource_name, *args, **kwargs)
+
+    def _internal_init(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 junction_path: Optional[pulumi.Input[str]] = None,
+                 name: Optional[pulumi.Input[str]] = None,
+                 security_style: Optional[pulumi.Input[str]] = None,
+                 size_in_megabytes: Optional[pulumi.Input[int]] = None,
+                 storage_efficiency_enabled: Optional[pulumi.Input[bool]] = None,
+                 storage_virtual_machine_id: Optional[pulumi.Input[str]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 tiering_policy: Optional[pulumi.Input[pulumi.InputType['OntapVolumeTieringPolicyArgs']]] = None,
+                 volume_type: Optional[pulumi.Input[str]] = None,
+                 __props__=None):
+        if opts is None:
+            opts = pulumi.ResourceOptions()
+        if not isinstance(opts, pulumi.ResourceOptions):
+            raise TypeError('Expected resource options to be a ResourceOptions instance')
+        if opts.version is None:
+            opts.version = _utilities.get_version()
+        if opts.id is None:
+            if __props__ is not None:
+                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
+            __props__ = OntapVolumeArgs.__new__(OntapVolumeArgs)
+
+            if junction_path is None and not opts.urn:
+                raise TypeError("Missing required property 'junction_path'")
+            __props__.__dict__["junction_path"] = junction_path
+            __props__.__dict__["name"] = name
+            __props__.__dict__["security_style"] = security_style
+            if size_in_megabytes is None and not opts.urn:
+                raise TypeError("Missing required property 'size_in_megabytes'")
+            __props__.__dict__["size_in_megabytes"] = size_in_megabytes
+            if storage_efficiency_enabled is None and not opts.urn:
+                raise TypeError("Missing required property 'storage_efficiency_enabled'")
+            __props__.__dict__["storage_efficiency_enabled"] = storage_efficiency_enabled
+            if storage_virtual_machine_id is None and not opts.urn:
+                raise TypeError("Missing required property 'storage_virtual_machine_id'")
+            __props__.__dict__["storage_virtual_machine_id"] = storage_virtual_machine_id
+            __props__.__dict__["tags"] = tags
+            __props__.__dict__["tags_all"] = tags_all
+            __props__.__dict__["tiering_policy"] = tiering_policy
+            __props__.__dict__["volume_type"] = volume_type
+            __props__.__dict__["arn"] = None
+            __props__.__dict__["file_system_id"] = None
+            __props__.__dict__["flexcache_endpoint_type"] = None
+            __props__.__dict__["ontap_volume_type"] = None
+            __props__.__dict__["uuid"] = None
+        super(OntapVolume, __self__).__init__(
+            'aws:fsx/ontapVolume:OntapVolume',
+            resource_name,
+            __props__,
+            opts)
+
+    @staticmethod
+    def get(resource_name: str,
+            id: pulumi.Input[str],
+            opts: Optional[pulumi.ResourceOptions] = None,
+            arn: Optional[pulumi.Input[str]] = None,
+            file_system_id: Optional[pulumi.Input[str]] = None,
+            flexcache_endpoint_type: Optional[pulumi.Input[str]] = None,
+            junction_path: Optional[pulumi.Input[str]] = None,
+            name: Optional[pulumi.Input[str]] = None,
+            ontap_volume_type: Optional[pulumi.Input[str]] = None,
+            security_style: Optional[pulumi.Input[str]] = None,
+            size_in_megabytes: Optional[pulumi.Input[int]] = None,
+            storage_efficiency_enabled: Optional[pulumi.Input[bool]] = None,
+            storage_virtual_machine_id: Optional[pulumi.Input[str]] = None,
+            tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+            tags_all: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+            tiering_policy: Optional[pulumi.Input[pulumi.InputType['OntapVolumeTieringPolicyArgs']]] = None,
+            uuid: Optional[pulumi.Input[str]] = None,
+            volume_type: Optional[pulumi.Input[str]] = None) -> 'OntapVolume':
+        """
+        Get an existing OntapVolume resource's state with the given name, id, and optional extra
+        properties used to qualify the lookup.
+
+        :param str resource_name: The unique name of the resulting resource.
+        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] arn: Amazon Resource Name of the volune.
+        :param pulumi.Input[str] file_system_id: Describes the file system for the volume, e.g. `fs-12345679`
+        :param pulumi.Input[str] flexcache_endpoint_type: Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+        :param pulumi.Input[str] junction_path: Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        :param pulumi.Input[str] name: Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        :param pulumi.Input[str] ontap_volume_type: Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+        :param pulumi.Input[str] security_style: Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        :param pulumi.Input[int] size_in_megabytes: Specifies the size of the volume, in megabytes (MB), that you are creating.
+        :param pulumi.Input[bool] storage_efficiency_enabled: Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        :param pulumi.Input[str] storage_virtual_machine_id: Specifies the storage virtual machine in which to create the volume.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        :param pulumi.Input[str] uuid: The Volume's UUID (universally unique identifier).
+        :param pulumi.Input[str] volume_type: The type of volume, currently the only valid value is `ONTAP`.
+        """
+        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
+
+        __props__ = _OntapVolumeState.__new__(_OntapVolumeState)
+
+        __props__.__dict__["arn"] = arn
+        __props__.__dict__["file_system_id"] = file_system_id
+        __props__.__dict__["flexcache_endpoint_type"] = flexcache_endpoint_type
+        __props__.__dict__["junction_path"] = junction_path
+        __props__.__dict__["name"] = name
+        __props__.__dict__["ontap_volume_type"] = ontap_volume_type
+        __props__.__dict__["security_style"] = security_style
+        __props__.__dict__["size_in_megabytes"] = size_in_megabytes
+        __props__.__dict__["storage_efficiency_enabled"] = storage_efficiency_enabled
+        __props__.__dict__["storage_virtual_machine_id"] = storage_virtual_machine_id
+        __props__.__dict__["tags"] = tags
+        __props__.__dict__["tags_all"] = tags_all
+        __props__.__dict__["tiering_policy"] = tiering_policy
+        __props__.__dict__["uuid"] = uuid
+        __props__.__dict__["volume_type"] = volume_type
+        return OntapVolume(resource_name, opts=opts, __props__=__props__)
+
+    @property
+    @pulumi.getter
+    def arn(self) -> pulumi.Output[str]:
+        """
+        Amazon Resource Name of the volune.
+        """
+        return pulumi.get(self, "arn")
+
+    @property
+    @pulumi.getter(name="fileSystemId")
+    def file_system_id(self) -> pulumi.Output[str]:
+        """
+        Describes the file system for the volume, e.g. `fs-12345679`
+        """
+        return pulumi.get(self, "file_system_id")
+
+    @property
+    @pulumi.getter(name="flexcacheEndpointType")
+    def flexcache_endpoint_type(self) -> pulumi.Output[str]:
+        """
+        Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+        """
+        return pulumi.get(self, "flexcache_endpoint_type")
+
+    @property
+    @pulumi.getter(name="junctionPath")
+    def junction_path(self) -> pulumi.Output[str]:
+        """
+        Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+        """
+        return pulumi.get(self, "junction_path")
+
+    @property
+    @pulumi.getter
+    def name(self) -> pulumi.Output[str]:
+        """
+        Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter(name="ontapVolumeType")
+    def ontap_volume_type(self) -> pulumi.Output[str]:
+        """
+        Specifies the type of volume, Valid values are `RW`, `DP`,  and `LS`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+        """
+        return pulumi.get(self, "ontap_volume_type")
+
+    @property
+    @pulumi.getter(name="securityStyle")
+    def security_style(self) -> pulumi.Output[Optional[str]]:
+        """
+        Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. Default value is `UNIX`.
+        """
+        return pulumi.get(self, "security_style")
+
+    @property
+    @pulumi.getter(name="sizeInMegabytes")
+    def size_in_megabytes(self) -> pulumi.Output[int]:
+        """
+        Specifies the size of the volume, in megabytes (MB), that you are creating.
+        """
+        return pulumi.get(self, "size_in_megabytes")
+
+    @property
+    @pulumi.getter(name="storageEfficiencyEnabled")
+    def storage_efficiency_enabled(self) -> pulumi.Output[bool]:
+        """
+        Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+        """
+        return pulumi.get(self, "storage_efficiency_enabled")
+
+    @property
+    @pulumi.getter(name="storageVirtualMachineId")
+    def storage_virtual_machine_id(self) -> pulumi.Output[str]:
+        """
+        Specifies the storage virtual machine in which to create the volume.
+        """
+        return pulumi.get(self, "storage_virtual_machine_id")
+
+    @property
+    @pulumi.getter
+    def tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
+        """
+        A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+        """
+        return pulumi.get(self, "tags")
+
+    @property
+    @pulumi.getter(name="tagsAll")
+    def tags_all(self) -> pulumi.Output[Mapping[str, str]]:
+        """
+        A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+        """
+        return pulumi.get(self, "tags_all")
+
+    @property
+    @pulumi.getter(name="tieringPolicy")
+    def tiering_policy(self) -> pulumi.Output[Optional['outputs.OntapVolumeTieringPolicy']]:
+        return pulumi.get(self, "tiering_policy")
+
+    @property
+    @pulumi.getter
+    def uuid(self) -> pulumi.Output[str]:
+        """
+        The Volume's UUID (universally unique identifier).
+        """
+        return pulumi.get(self, "uuid")
+
+    @property
+    @pulumi.getter(name="volumeType")
+    def volume_type(self) -> pulumi.Output[Optional[str]]:
+        """
+        The type of volume, currently the only valid value is `ONTAP`.
+        """
+        return pulumi.get(self, "volume_type")
+
diff --git a/sdk/python/pulumi_aws/fsx/outputs.py b/sdk/python/pulumi_aws/fsx/outputs.py
index 67bbf8c3a65..78672d3c430 100644
--- a/sdk/python/pulumi_aws/fsx/outputs.py
+++ b/sdk/python/pulumi_aws/fsx/outputs.py
@@ -14,6 +14,14 @@
     'OntapFileSystemEndpoint',
     'OntapFileSystemEndpointIntercluster',
     'OntapFileSystemEndpointManagement',
+    'OntapStorageVirtualMachineActiveDirectoryConfiguration',
+    'OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration',
+    'OntapStorageVirtualMachineEndpoint',
+    'OntapStorageVirtualMachineEndpointIscse',
+    'OntapStorageVirtualMachineEndpointManagement',
+    'OntapStorageVirtualMachineEndpointNf',
+    'OntapStorageVirtualMachineEndpointSmb',
+    'OntapVolumeTieringPolicy',
     'WindowsFileSystemAuditLogConfiguration',
     'WindowsFileSystemSelfManagedActiveDirectory',
 ]
@@ -180,6 +188,445 @@ def ip_addresses(self) -> Optional[Sequence[str]]:
         return pulumi.get(self, "ip_addresses")
 
 
+@pulumi.output_type
+class OntapStorageVirtualMachineActiveDirectoryConfiguration(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "netbiosName":
+            suggest = "netbios_name"
+        elif key == "selfManagedActiveDirectoryConfiguration":
+            suggest = "self_managed_active_directory_configuration"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in OntapStorageVirtualMachineActiveDirectoryConfiguration. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        OntapStorageVirtualMachineActiveDirectoryConfiguration.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        OntapStorageVirtualMachineActiveDirectoryConfiguration.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 netbios_name: Optional[str] = None,
+                 self_managed_active_directory_configuration: Optional['outputs.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration'] = None):
+        """
+        :param str netbios_name: The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+        """
+        if netbios_name is not None:
+            pulumi.set(__self__, "netbios_name", netbios_name)
+        if self_managed_active_directory_configuration is not None:
+            pulumi.set(__self__, "self_managed_active_directory_configuration", self_managed_active_directory_configuration)
+
+    @property
+    @pulumi.getter(name="netbiosName")
+    def netbios_name(self) -> Optional[str]:
+        """
+        The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+        """
+        return pulumi.get(self, "netbios_name")
+
+    @property
+    @pulumi.getter(name="selfManagedActiveDirectoryConfiguration")
+    def self_managed_active_directory_configuration(self) -> Optional['outputs.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration']:
+        return pulumi.get(self, "self_managed_active_directory_configuration")
+
+
+@pulumi.output_type
+class OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "dnsIps":
+            suggest = "dns_ips"
+        elif key == "domainName":
+            suggest = "domain_name"
+        elif key == "fileSystemAdministratorsGroup":
+            suggest = "file_system_administrators_group"
+        elif key == "organizationalUnitDistinguidshedName":
+            suggest = "organizational_unit_distinguidshed_name"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 dns_ips: Sequence[str],
+                 domain_name: str,
+                 password: str,
+                 username: str,
+                 file_system_administrators_group: Optional[str] = None,
+                 organizational_unit_distinguidshed_name: Optional[str] = None):
+        """
+        :param Sequence[str] dns_ips: A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+        :param str domain_name: The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+        :param str password: The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        :param str username: The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        :param str file_system_administrators_group: The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+        """
+        pulumi.set(__self__, "dns_ips", dns_ips)
+        pulumi.set(__self__, "domain_name", domain_name)
+        pulumi.set(__self__, "password", password)
+        pulumi.set(__self__, "username", username)
+        if file_system_administrators_group is not None:
+            pulumi.set(__self__, "file_system_administrators_group", file_system_administrators_group)
+        if organizational_unit_distinguidshed_name is not None:
+            pulumi.set(__self__, "organizational_unit_distinguidshed_name", organizational_unit_distinguidshed_name)
+
+    @property
+    @pulumi.getter(name="dnsIps")
+    def dns_ips(self) -> Sequence[str]:
+        """
+        A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+        """
+        return pulumi.get(self, "dns_ips")
+
+    @property
+    @pulumi.getter(name="domainName")
+    def domain_name(self) -> str:
+        """
+        The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+        """
+        return pulumi.get(self, "domain_name")
+
+    @property
+    @pulumi.getter
+    def password(self) -> str:
+        """
+        The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        """
+        return pulumi.get(self, "password")
+
+    @property
+    @pulumi.getter
+    def username(self) -> str:
+        """
+        The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+        """
+        return pulumi.get(self, "username")
+
+    @property
+    @pulumi.getter(name="fileSystemAdministratorsGroup")
+    def file_system_administrators_group(self) -> Optional[str]:
+        """
+        The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+        """
+        return pulumi.get(self, "file_system_administrators_group")
+
+    @property
+    @pulumi.getter(name="organizationalUnitDistinguidshedName")
+    def organizational_unit_distinguidshed_name(self) -> Optional[str]:
+        return pulumi.get(self, "organizational_unit_distinguidshed_name")
+
+
+@pulumi.output_type
+class OntapStorageVirtualMachineEndpoint(dict):
+    def __init__(__self__, *,
+                 iscses: Optional[Sequence['outputs.OntapStorageVirtualMachineEndpointIscse']] = None,
+                 managements: Optional[Sequence['outputs.OntapStorageVirtualMachineEndpointManagement']] = None,
+                 nfs: Optional[Sequence['outputs.OntapStorageVirtualMachineEndpointNf']] = None,
+                 smbs: Optional[Sequence['outputs.OntapStorageVirtualMachineEndpointSmb']] = None):
+        """
+        :param Sequence['OntapStorageVirtualMachineEndpointIscseArgs'] iscses: An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+        :param Sequence['OntapStorageVirtualMachineEndpointManagementArgs'] managements: An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+        :param Sequence['OntapStorageVirtualMachineEndpointNfArgs'] nfs: An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+        :param Sequence['OntapStorageVirtualMachineEndpointSmbArgs'] smbs: An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See Endpoint.
+        """
+        if iscses is not None:
+            pulumi.set(__self__, "iscses", iscses)
+        if managements is not None:
+            pulumi.set(__self__, "managements", managements)
+        if nfs is not None:
+            pulumi.set(__self__, "nfs", nfs)
+        if smbs is not None:
+            pulumi.set(__self__, "smbs", smbs)
+
+    @property
+    @pulumi.getter
+    def iscses(self) -> Optional[Sequence['outputs.OntapStorageVirtualMachineEndpointIscse']]:
+        """
+        An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+        """
+        return pulumi.get(self, "iscses")
+
+    @property
+    @pulumi.getter
+    def managements(self) -> Optional[Sequence['outputs.OntapStorageVirtualMachineEndpointManagement']]:
+        """
+        An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+        """
+        return pulumi.get(self, "managements")
+
+    @property
+    @pulumi.getter
+    def nfs(self) -> Optional[Sequence['outputs.OntapStorageVirtualMachineEndpointNf']]:
+        """
+        An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+        """
+        return pulumi.get(self, "nfs")
+
+    @property
+    @pulumi.getter
+    def smbs(self) -> Optional[Sequence['outputs.OntapStorageVirtualMachineEndpointSmb']]:
+        """
+        An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See Endpoint.
+        """
+        return pulumi.get(self, "smbs")
+
+
+@pulumi.output_type
+class OntapStorageVirtualMachineEndpointIscse(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "dnsName":
+            suggest = "dns_name"
+        elif key == "ipAddresses":
+            suggest = "ip_addresses"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in OntapStorageVirtualMachineEndpointIscse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        OntapStorageVirtualMachineEndpointIscse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        OntapStorageVirtualMachineEndpointIscse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 dns_name: Optional[str] = None,
+                 ip_addresses: Optional[Sequence[str]] = None):
+        """
+        :param str dns_name: The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        :param Sequence[str] ip_addresses: IP addresses of the storage virtual machine endpoint.
+        """
+        if dns_name is not None:
+            pulumi.set(__self__, "dns_name", dns_name)
+        if ip_addresses is not None:
+            pulumi.set(__self__, "ip_addresses", ip_addresses)
+
+    @property
+    @pulumi.getter(name="dnsName")
+    def dns_name(self) -> Optional[str]:
+        """
+        The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        """
+        return pulumi.get(self, "dns_name")
+
+    @property
+    @pulumi.getter(name="ipAddresses")
+    def ip_addresses(self) -> Optional[Sequence[str]]:
+        """
+        IP addresses of the storage virtual machine endpoint.
+        """
+        return pulumi.get(self, "ip_addresses")
+
+
+@pulumi.output_type
+class OntapStorageVirtualMachineEndpointManagement(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "dnsName":
+            suggest = "dns_name"
+        elif key == "ipAddresses":
+            suggest = "ip_addresses"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in OntapStorageVirtualMachineEndpointManagement. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        OntapStorageVirtualMachineEndpointManagement.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        OntapStorageVirtualMachineEndpointManagement.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 dns_name: Optional[str] = None,
+                 ip_addresses: Optional[Sequence[str]] = None):
+        """
+        :param str dns_name: The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        :param Sequence[str] ip_addresses: IP addresses of the storage virtual machine endpoint.
+        """
+        if dns_name is not None:
+            pulumi.set(__self__, "dns_name", dns_name)
+        if ip_addresses is not None:
+            pulumi.set(__self__, "ip_addresses", ip_addresses)
+
+    @property
+    @pulumi.getter(name="dnsName")
+    def dns_name(self) -> Optional[str]:
+        """
+        The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        """
+        return pulumi.get(self, "dns_name")
+
+    @property
+    @pulumi.getter(name="ipAddresses")
+    def ip_addresses(self) -> Optional[Sequence[str]]:
+        """
+        IP addresses of the storage virtual machine endpoint.
+        """
+        return pulumi.get(self, "ip_addresses")
+
+
+@pulumi.output_type
+class OntapStorageVirtualMachineEndpointNf(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "dnsName":
+            suggest = "dns_name"
+        elif key == "ipAddresses":
+            suggest = "ip_addresses"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in OntapStorageVirtualMachineEndpointNf. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        OntapStorageVirtualMachineEndpointNf.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        OntapStorageVirtualMachineEndpointNf.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 dns_name: Optional[str] = None,
+                 ip_addresses: Optional[Sequence[str]] = None):
+        """
+        :param str dns_name: The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        :param Sequence[str] ip_addresses: IP addresses of the storage virtual machine endpoint.
+        """
+        if dns_name is not None:
+            pulumi.set(__self__, "dns_name", dns_name)
+        if ip_addresses is not None:
+            pulumi.set(__self__, "ip_addresses", ip_addresses)
+
+    @property
+    @pulumi.getter(name="dnsName")
+    def dns_name(self) -> Optional[str]:
+        """
+        The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        """
+        return pulumi.get(self, "dns_name")
+
+    @property
+    @pulumi.getter(name="ipAddresses")
+    def ip_addresses(self) -> Optional[Sequence[str]]:
+        """
+        IP addresses of the storage virtual machine endpoint.
+        """
+        return pulumi.get(self, "ip_addresses")
+
+
+@pulumi.output_type
+class OntapStorageVirtualMachineEndpointSmb(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "dnsName":
+            suggest = "dns_name"
+        elif key == "ipAddresses":
+            suggest = "ip_addresses"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in OntapStorageVirtualMachineEndpointSmb. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        OntapStorageVirtualMachineEndpointSmb.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        OntapStorageVirtualMachineEndpointSmb.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 dns_name: Optional[str] = None,
+                 ip_addresses: Optional[Sequence[str]] = None):
+        """
+        :param str dns_name: The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        :param Sequence[str] ip_addresses: IP addresses of the storage virtual machine endpoint.
+        """
+        if dns_name is not None:
+            pulumi.set(__self__, "dns_name", dns_name)
+        if ip_addresses is not None:
+            pulumi.set(__self__, "ip_addresses", ip_addresses)
+
+    @property
+    @pulumi.getter(name="dnsName")
+    def dns_name(self) -> Optional[str]:
+        """
+        The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+        """
+        return pulumi.get(self, "dns_name")
+
+    @property
+    @pulumi.getter(name="ipAddresses")
+    def ip_addresses(self) -> Optional[Sequence[str]]:
+        """
+        IP addresses of the storage virtual machine endpoint.
+        """
+        return pulumi.get(self, "ip_addresses")
+
+
+@pulumi.output_type
+class OntapVolumeTieringPolicy(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "coolingPeriod":
+            suggest = "cooling_period"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in OntapVolumeTieringPolicy. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        OntapVolumeTieringPolicy.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        OntapVolumeTieringPolicy.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 cooling_period: Optional[int] = None,
+                 name: Optional[str] = None):
+        """
+        :param str name: Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        """
+        if cooling_period is not None:
+            pulumi.set(__self__, "cooling_period", cooling_period)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter(name="coolingPeriod")
+    def cooling_period(self) -> Optional[int]:
+        return pulumi.get(self, "cooling_period")
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[str]:
+        """
+        Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+        """
+        return pulumi.get(self, "name")
+
+
 @pulumi.output_type
 class WindowsFileSystemAuditLogConfiguration(dict):
     @staticmethod
diff --git a/sdk/python/pulumi_aws/imagebuilder/__init__.py b/sdk/python/pulumi_aws/imagebuilder/__init__.py
index 40222dd55ff..3f898e31bf1 100644
--- a/sdk/python/pulumi_aws/imagebuilder/__init__.py
+++ b/sdk/python/pulumi_aws/imagebuilder/__init__.py
@@ -12,6 +12,7 @@
 from .get_image import *
 from .get_image_pipeline import *
 from .get_image_recipe import *
+from .get_image_recipes import *
 from .get_infrastructure_configuration import *
 from .image import *
 from .image_pipeline import *
diff --git a/sdk/python/pulumi_aws/imagebuilder/_inputs.py b/sdk/python/pulumi_aws/imagebuilder/_inputs.py
index 304781e5bc4..fdcdde033db 100644
--- a/sdk/python/pulumi_aws/imagebuilder/_inputs.py
+++ b/sdk/python/pulumi_aws/imagebuilder/_inputs.py
@@ -22,6 +22,7 @@
     'ImageRecipeComponentArgs',
     'InfrastructureConfigurationLoggingArgs',
     'InfrastructureConfigurationLoggingS3LogsArgs',
+    'GetImageRecipesFilterArgs',
 ]
 
 @pulumi.input_type
@@ -718,3 +719,40 @@ def s3_key_prefix(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "s3_key_prefix", value)
 
 
+@pulumi.input_type
+class GetImageRecipesFilterArgs:
+    def __init__(__self__, *,
+                 name: str,
+                 values: Sequence[str]):
+        """
+        :param str name: The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+        :param Sequence[str] values: Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+        """
+        pulumi.set(__self__, "name", name)
+        pulumi.set(__self__, "values", values)
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        """
+        The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: str):
+        pulumi.set(self, "name", value)
+
+    @property
+    @pulumi.getter
+    def values(self) -> Sequence[str]:
+        """
+        Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+        """
+        return pulumi.get(self, "values")
+
+    @values.setter
+    def values(self, value: Sequence[str]):
+        pulumi.set(self, "values", value)
+
+
diff --git a/sdk/python/pulumi_aws/imagebuilder/get_image_recipes.py b/sdk/python/pulumi_aws/imagebuilder/get_image_recipes.py
new file mode 100644
index 00000000000..fd41ee5e02b
--- /dev/null
+++ b/sdk/python/pulumi_aws/imagebuilder/get_image_recipes.py
@@ -0,0 +1,154 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from .. import _utilities
+from . import outputs
+from ._inputs import *
+
+__all__ = [
+    'GetImageRecipesResult',
+    'AwaitableGetImageRecipesResult',
+    'get_image_recipes',
+    'get_image_recipes_output',
+]
+
+@pulumi.output_type
+class GetImageRecipesResult:
+    """
+    A collection of values returned by getImageRecipes.
+    """
+    def __init__(__self__, arns=None, filters=None, id=None, names=None, owner=None):
+        if arns and not isinstance(arns, list):
+            raise TypeError("Expected argument 'arns' to be a list")
+        pulumi.set(__self__, "arns", arns)
+        if filters and not isinstance(filters, list):
+            raise TypeError("Expected argument 'filters' to be a list")
+        pulumi.set(__self__, "filters", filters)
+        if id and not isinstance(id, str):
+            raise TypeError("Expected argument 'id' to be a str")
+        pulumi.set(__self__, "id", id)
+        if names and not isinstance(names, list):
+            raise TypeError("Expected argument 'names' to be a list")
+        pulumi.set(__self__, "names", names)
+        if owner and not isinstance(owner, str):
+            raise TypeError("Expected argument 'owner' to be a str")
+        pulumi.set(__self__, "owner", owner)
+
+    @property
+    @pulumi.getter
+    def arns(self) -> Sequence[str]:
+        """
+        Set of ARNs of the matched Image Builder Image Recipes.
+        """
+        return pulumi.get(self, "arns")
+
+    @property
+    @pulumi.getter
+    def filters(self) -> Optional[Sequence['outputs.GetImageRecipesFilterResult']]:
+        return pulumi.get(self, "filters")
+
+    @property
+    @pulumi.getter
+    def id(self) -> str:
+        """
+        The provider-assigned unique ID for this managed resource.
+        """
+        return pulumi.get(self, "id")
+
+    @property
+    @pulumi.getter
+    def names(self) -> Sequence[str]:
+        """
+        Set of names of the matched Image Builder Image Recipes.
+        """
+        return pulumi.get(self, "names")
+
+    @property
+    @pulumi.getter
+    def owner(self) -> Optional[str]:
+        return pulumi.get(self, "owner")
+
+
+class AwaitableGetImageRecipesResult(GetImageRecipesResult):
+    # pylint: disable=using-constant-test
+    def __await__(self):
+        if False:
+            yield self
+        return GetImageRecipesResult(
+            arns=self.arns,
+            filters=self.filters,
+            id=self.id,
+            names=self.names,
+            owner=self.owner)
+
+
+def get_image_recipes(filters: Optional[Sequence[pulumi.InputType['GetImageRecipesFilterArgs']]] = None,
+                      owner: Optional[str] = None,
+                      opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetImageRecipesResult:
+    """
+    Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.
+
+    ## Example Usage
+
+    ```python
+    import pulumi
+    import pulumi_aws as aws
+
+    example = aws.imagebuilder.get_image_recipes(filters=[aws.imagebuilder.GetImageRecipesFilterArgs(
+            name="platform",
+            values=["Linux"],
+        )],
+        owner="Self")
+    ```
+
+
+    :param Sequence[pulumi.InputType['GetImageRecipesFilterArgs']] filters: Configuration block(s) for filtering. Detailed below.
+    :param str owner: The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+    """
+    __args__ = dict()
+    __args__['filters'] = filters
+    __args__['owner'] = owner
+    if opts is None:
+        opts = pulumi.InvokeOptions()
+    if opts.version is None:
+        opts.version = _utilities.get_version()
+    __ret__ = pulumi.runtime.invoke('aws:imagebuilder/getImageRecipes:getImageRecipes', __args__, opts=opts, typ=GetImageRecipesResult).value
+
+    return AwaitableGetImageRecipesResult(
+        arns=__ret__.arns,
+        filters=__ret__.filters,
+        id=__ret__.id,
+        names=__ret__.names,
+        owner=__ret__.owner)
+
+
+@_utilities.lift_output_func(get_image_recipes)
+def get_image_recipes_output(filters: Optional[pulumi.Input[Optional[Sequence[pulumi.InputType['GetImageRecipesFilterArgs']]]]] = None,
+                             owner: Optional[pulumi.Input[Optional[str]]] = None,
+                             opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetImageRecipesResult]:
+    """
+    Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.
+
+    ## Example Usage
+
+    ```python
+    import pulumi
+    import pulumi_aws as aws
+
+    example = aws.imagebuilder.get_image_recipes(filters=[aws.imagebuilder.GetImageRecipesFilterArgs(
+            name="platform",
+            values=["Linux"],
+        )],
+        owner="Self")
+    ```
+
+
+    :param Sequence[pulumi.InputType['GetImageRecipesFilterArgs']] filters: Configuration block(s) for filtering. Detailed below.
+    :param str owner: The owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+    """
+    ...
diff --git a/sdk/python/pulumi_aws/imagebuilder/outputs.py b/sdk/python/pulumi_aws/imagebuilder/outputs.py
index ca6bf480a3e..6d1ca779363 100644
--- a/sdk/python/pulumi_aws/imagebuilder/outputs.py
+++ b/sdk/python/pulumi_aws/imagebuilder/outputs.py
@@ -34,6 +34,7 @@
     'GetImageRecipeBlockDeviceMappingResult',
     'GetImageRecipeBlockDeviceMappingEbResult',
     'GetImageRecipeComponentResult',
+    'GetImageRecipesFilterResult',
     'GetInfrastructureConfigurationLoggingResult',
     'GetInfrastructureConfigurationLoggingS3LogResult',
 ]
@@ -1276,6 +1277,35 @@ def component_arn(self) -> str:
         return pulumi.get(self, "component_arn")
 
 
+@pulumi.output_type
+class GetImageRecipesFilterResult(dict):
+    def __init__(__self__, *,
+                 name: str,
+                 values: Sequence[str]):
+        """
+        :param str name: The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+        :param Sequence[str] values: Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+        """
+        pulumi.set(__self__, "name", name)
+        pulumi.set(__self__, "values", values)
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        """
+        The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter
+    def values(self) -> Sequence[str]:
+        """
+        Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+        """
+        return pulumi.get(self, "values")
+
+
 @pulumi.output_type
 class GetInfrastructureConfigurationLoggingResult(dict):
     def __init__(__self__, *,
diff --git a/sdk/python/pulumi_aws/lambda_/get_function.py b/sdk/python/pulumi_aws/lambda_/get_function.py
index 9a9832d5733..21157a952b7 100644
--- a/sdk/python/pulumi_aws/lambda_/get_function.py
+++ b/sdk/python/pulumi_aws/lambda_/get_function.py
@@ -21,7 +21,7 @@ class GetFunctionResult:
     """
     A collection of values returned by getFunction.
     """
-    def __init__(__self__, architectures=None, arn=None, code_signing_config_arn=None, dead_letter_config=None, description=None, environment=None, file_system_configs=None, function_name=None, handler=None, id=None, invoke_arn=None, kms_key_arn=None, last_modified=None, layers=None, memory_size=None, qualified_arn=None, qualifier=None, reserved_concurrent_executions=None, role=None, runtime=None, signing_job_arn=None, signing_profile_version_arn=None, source_code_hash=None, source_code_size=None, tags=None, timeout=None, tracing_config=None, version=None, vpc_config=None):
+    def __init__(__self__, architectures=None, arn=None, code_signing_config_arn=None, dead_letter_config=None, description=None, environment=None, file_system_configs=None, function_name=None, handler=None, id=None, image_uri=None, invoke_arn=None, kms_key_arn=None, last_modified=None, layers=None, memory_size=None, qualified_arn=None, qualifier=None, reserved_concurrent_executions=None, role=None, runtime=None, signing_job_arn=None, signing_profile_version_arn=None, source_code_hash=None, source_code_size=None, tags=None, timeout=None, tracing_config=None, version=None, vpc_config=None):
         if architectures and not isinstance(architectures, list):
             raise TypeError("Expected argument 'architectures' to be a list")
         pulumi.set(__self__, "architectures", architectures)
@@ -52,6 +52,9 @@ def __init__(__self__, architectures=None, arn=None, code_signing_config_arn=Non
         if id and not isinstance(id, str):
             raise TypeError("Expected argument 'id' to be a str")
         pulumi.set(__self__, "id", id)
+        if image_uri and not isinstance(image_uri, str):
+            raise TypeError("Expected argument 'image_uri' to be a str")
+        pulumi.set(__self__, "image_uri", image_uri)
         if invoke_arn and not isinstance(invoke_arn, str):
             raise TypeError("Expected argument 'invoke_arn' to be a str")
         pulumi.set(__self__, "invoke_arn", invoke_arn)
@@ -187,6 +190,14 @@ def id(self) -> str:
         """
         return pulumi.get(self, "id")
 
+    @property
+    @pulumi.getter(name="imageUri")
+    def image_uri(self) -> str:
+        """
+        The URI of the container image.
+        """
+        return pulumi.get(self, "image_uri")
+
     @property
     @pulumi.getter(name="invokeArn")
     def invoke_arn(self) -> str:
@@ -350,6 +361,7 @@ def __await__(self):
             function_name=self.function_name,
             handler=self.handler,
             id=self.id,
+            image_uri=self.image_uri,
             invoke_arn=self.invoke_arn,
             kms_key_arn=self.kms_key_arn,
             last_modified=self.last_modified,
@@ -414,6 +426,7 @@ def get_function(function_name: Optional[str] = None,
         function_name=__ret__.function_name,
         handler=__ret__.handler,
         id=__ret__.id,
+        image_uri=__ret__.image_uri,
         invoke_arn=__ret__.invoke_arn,
         kms_key_arn=__ret__.kms_key_arn,
         last_modified=__ret__.last_modified,
diff --git a/sdk/python/pulumi_aws/lb/get_load_balancer.py b/sdk/python/pulumi_aws/lb/get_load_balancer.py
index f6735c804d6..bbebafe4909 100644
--- a/sdk/python/pulumi_aws/lb/get_load_balancer.py
+++ b/sdk/python/pulumi_aws/lb/get_load_balancer.py
@@ -21,7 +21,7 @@ class GetLoadBalancerResult:
     """
     A collection of values returned by getLoadBalancer.
     """
-    def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_owned_ipv4_pool=None, dns_name=None, drop_invalid_header_fields=None, enable_deletion_protection=None, enable_http2=None, id=None, idle_timeout=None, internal=None, ip_address_type=None, load_balancer_type=None, name=None, security_groups=None, subnet_mappings=None, subnets=None, tags=None, vpc_id=None, zone_id=None):
+    def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_owned_ipv4_pool=None, desync_mitigation_mode=None, dns_name=None, drop_invalid_header_fields=None, enable_deletion_protection=None, enable_http2=None, enable_waf_fail_open=None, id=None, idle_timeout=None, internal=None, ip_address_type=None, load_balancer_type=None, name=None, security_groups=None, subnet_mappings=None, subnets=None, tags=None, vpc_id=None, zone_id=None):
         if access_logs and not isinstance(access_logs, dict):
             raise TypeError("Expected argument 'access_logs' to be a dict")
         pulumi.set(__self__, "access_logs", access_logs)
@@ -34,6 +34,9 @@ def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_own
         if customer_owned_ipv4_pool and not isinstance(customer_owned_ipv4_pool, str):
             raise TypeError("Expected argument 'customer_owned_ipv4_pool' to be a str")
         pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode and not isinstance(desync_mitigation_mode, str):
+            raise TypeError("Expected argument 'desync_mitigation_mode' to be a str")
+        pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name and not isinstance(dns_name, str):
             raise TypeError("Expected argument 'dns_name' to be a str")
         pulumi.set(__self__, "dns_name", dns_name)
@@ -46,6 +49,9 @@ def __init__(__self__, access_logs=None, arn=None, arn_suffix=None, customer_own
         if enable_http2 and not isinstance(enable_http2, bool):
             raise TypeError("Expected argument 'enable_http2' to be a bool")
         pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open and not isinstance(enable_waf_fail_open, bool):
+            raise TypeError("Expected argument 'enable_waf_fail_open' to be a bool")
+        pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if id and not isinstance(id, str):
             raise TypeError("Expected argument 'id' to be a str")
         pulumi.set(__self__, "id", id)
@@ -103,6 +109,11 @@ def arn_suffix(self) -> str:
     def customer_owned_ipv4_pool(self) -> str:
         return pulumi.get(self, "customer_owned_ipv4_pool")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> str:
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> str:
@@ -123,6 +134,11 @@ def enable_deletion_protection(self) -> bool:
     def enable_http2(self) -> bool:
         return pulumi.get(self, "enable_http2")
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> bool:
+        return pulumi.get(self, "enable_waf_fail_open")
+
     @property
     @pulumi.getter
     def id(self) -> str:
@@ -197,10 +213,12 @@ def __await__(self):
             arn=self.arn,
             arn_suffix=self.arn_suffix,
             customer_owned_ipv4_pool=self.customer_owned_ipv4_pool,
+            desync_mitigation_mode=self.desync_mitigation_mode,
             dns_name=self.dns_name,
             drop_invalid_header_fields=self.drop_invalid_header_fields,
             enable_deletion_protection=self.enable_deletion_protection,
             enable_http2=self.enable_http2,
+            enable_waf_fail_open=self.enable_waf_fail_open,
             id=self.id,
             idle_timeout=self.idle_timeout,
             internal=self.internal,
@@ -265,10 +283,12 @@ def get_load_balancer(arn: Optional[str] = None,
         arn=__ret__.arn,
         arn_suffix=__ret__.arn_suffix,
         customer_owned_ipv4_pool=__ret__.customer_owned_ipv4_pool,
+        desync_mitigation_mode=__ret__.desync_mitigation_mode,
         dns_name=__ret__.dns_name,
         drop_invalid_header_fields=__ret__.drop_invalid_header_fields,
         enable_deletion_protection=__ret__.enable_deletion_protection,
         enable_http2=__ret__.enable_http2,
+        enable_waf_fail_open=__ret__.enable_waf_fail_open,
         id=__ret__.id,
         idle_timeout=__ret__.idle_timeout,
         internal=__ret__.internal,
diff --git a/sdk/python/pulumi_aws/lb/load_balancer.py b/sdk/python/pulumi_aws/lb/load_balancer.py
index daa26b1bdd1..0c14662da72 100644
--- a/sdk/python/pulumi_aws/lb/load_balancer.py
+++ b/sdk/python/pulumi_aws/lb/load_balancer.py
@@ -17,10 +17,12 @@ class LoadBalancerArgs:
     def __init__(__self__, *,
                  access_logs: Optional[pulumi.Input['LoadBalancerAccessLogsArgs']] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -35,12 +37,14 @@ def __init__(__self__, *,
         The set of arguments for constructing a LoadBalancer resource.
         :param pulumi.Input['LoadBalancerAccessLogsArgs'] access_logs: An Access Logs block. Access Logs documented below.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
                This is a `network` load balancer feature. Defaults to `false`.
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -54,12 +58,14 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         if access_logs is not None:
             pulumi.set(__self__, "access_logs", access_logs)
         if customer_owned_ipv4_pool is not None:
             pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if drop_invalid_header_fields is not None:
             pulumi.set(__self__, "drop_invalid_header_fields", drop_invalid_header_fields)
         if enable_cross_zone_load_balancing is not None:
@@ -68,6 +74,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "enable_deletion_protection", enable_deletion_protection)
         if enable_http2 is not None:
             pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open is not None:
+            pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if idle_timeout is not None:
             pulumi.set(__self__, "idle_timeout", idle_timeout)
         if internal is not None:
@@ -113,6 +121,18 @@ def customer_owned_ipv4_pool(self) -> Optional[pulumi.Input[str]]:
     def customer_owned_ipv4_pool(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "customer_owned_ipv4_pool", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dropInvalidHeaderFields")
     def drop_invalid_header_fields(self) -> Optional[pulumi.Input[bool]]:
@@ -163,6 +183,18 @@ def enable_http2(self) -> Optional[pulumi.Input[bool]]:
     def enable_http2(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enable_http2", value)
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
+    @enable_waf_fail_open.setter
+    def enable_waf_fail_open(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enable_waf_fail_open", value)
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> Optional[pulumi.Input[int]]:
@@ -279,7 +311,7 @@ def subnets(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -295,11 +327,13 @@ def __init__(__self__, *,
                  arn: Optional[pulumi.Input[str]] = None,
                  arn_suffix: Optional[pulumi.Input[str]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  dns_name: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -319,6 +353,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] arn: The ARN of the load balancer (matches `id`).
         :param pulumi.Input[str] arn_suffix: The ARN suffix for use with CloudWatch Metrics.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the load balancer.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
@@ -326,6 +361,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -339,7 +375,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
         :param pulumi.Input[str] zone_id: The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
                * `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
@@ -352,6 +388,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "arn_suffix", arn_suffix)
         if customer_owned_ipv4_pool is not None:
             pulumi.set(__self__, "customer_owned_ipv4_pool", customer_owned_ipv4_pool)
+        if desync_mitigation_mode is not None:
+            pulumi.set(__self__, "desync_mitigation_mode", desync_mitigation_mode)
         if dns_name is not None:
             pulumi.set(__self__, "dns_name", dns_name)
         if drop_invalid_header_fields is not None:
@@ -362,6 +400,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "enable_deletion_protection", enable_deletion_protection)
         if enable_http2 is not None:
             pulumi.set(__self__, "enable_http2", enable_http2)
+        if enable_waf_fail_open is not None:
+            pulumi.set(__self__, "enable_waf_fail_open", enable_waf_fail_open)
         if idle_timeout is not None:
             pulumi.set(__self__, "idle_timeout", idle_timeout)
         if internal is not None:
@@ -437,6 +477,18 @@ def customer_owned_ipv4_pool(self) -> Optional[pulumi.Input[str]]:
     def customer_owned_ipv4_pool(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "customer_owned_ipv4_pool", value)
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> Optional[pulumi.Input[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
+    @desync_mitigation_mode.setter
+    def desync_mitigation_mode(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "desync_mitigation_mode", value)
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> Optional[pulumi.Input[str]]:
@@ -499,6 +551,18 @@ def enable_http2(self) -> Optional[pulumi.Input[bool]]:
     def enable_http2(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "enable_http2", value)
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
+    @enable_waf_fail_open.setter
+    def enable_waf_fail_open(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "enable_waf_fail_open", value)
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> Optional[pulumi.Input[int]]:
@@ -615,7 +679,7 @@ def subnets(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
     @pulumi.getter
     def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
@@ -665,10 +729,12 @@ def __init__(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_logs: Optional[pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -773,12 +839,14 @@ def __init__(__self__,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']] access_logs: An Access Logs block. Access Logs documented below.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
                This is a `network` load balancer feature. Defaults to `false`.
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -792,7 +860,7 @@ def __init__(__self__,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         ...
     @overload
@@ -906,10 +974,12 @@ def _internal_init(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_logs: Optional[pulumi.Input[pulumi.InputType['LoadBalancerAccessLogsArgs']]] = None,
                  customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+                 desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
                  drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
                  enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
                  enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
                  enable_http2: Optional[pulumi.Input[bool]] = None,
+                 enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
                  idle_timeout: Optional[pulumi.Input[int]] = None,
                  internal: Optional[pulumi.Input[bool]] = None,
                  ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -934,10 +1004,12 @@ def _internal_init(__self__,
 
             __props__.__dict__["access_logs"] = access_logs
             __props__.__dict__["customer_owned_ipv4_pool"] = customer_owned_ipv4_pool
+            __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
             __props__.__dict__["drop_invalid_header_fields"] = drop_invalid_header_fields
             __props__.__dict__["enable_cross_zone_load_balancing"] = enable_cross_zone_load_balancing
             __props__.__dict__["enable_deletion_protection"] = enable_deletion_protection
             __props__.__dict__["enable_http2"] = enable_http2
+            __props__.__dict__["enable_waf_fail_open"] = enable_waf_fail_open
             __props__.__dict__["idle_timeout"] = idle_timeout
             __props__.__dict__["internal"] = internal
             __props__.__dict__["ip_address_type"] = ip_address_type
@@ -970,11 +1042,13 @@ def get(resource_name: str,
             arn: Optional[pulumi.Input[str]] = None,
             arn_suffix: Optional[pulumi.Input[str]] = None,
             customer_owned_ipv4_pool: Optional[pulumi.Input[str]] = None,
+            desync_mitigation_mode: Optional[pulumi.Input[str]] = None,
             dns_name: Optional[pulumi.Input[str]] = None,
             drop_invalid_header_fields: Optional[pulumi.Input[bool]] = None,
             enable_cross_zone_load_balancing: Optional[pulumi.Input[bool]] = None,
             enable_deletion_protection: Optional[pulumi.Input[bool]] = None,
             enable_http2: Optional[pulumi.Input[bool]] = None,
+            enable_waf_fail_open: Optional[pulumi.Input[bool]] = None,
             idle_timeout: Optional[pulumi.Input[int]] = None,
             internal: Optional[pulumi.Input[bool]] = None,
             ip_address_type: Optional[pulumi.Input[str]] = None,
@@ -999,6 +1073,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] arn: The ARN of the load balancer (matches `id`).
         :param pulumi.Input[str] arn_suffix: The ARN suffix for use with CloudWatch Metrics.
         :param pulumi.Input[str] customer_owned_ipv4_pool: The ID of the customer owned ipv4 pool to use for this load balancer.
+        :param pulumi.Input[str] desync_mitigation_mode: Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
         :param pulumi.Input[str] dns_name: The DNS name of the load balancer.
         :param pulumi.Input[bool] drop_invalid_header_fields: Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
         :param pulumi.Input[bool] enable_cross_zone_load_balancing: If true, cross-zone load balancing of the load balancer will be enabled.
@@ -1006,6 +1081,7 @@ def get(resource_name: str,
         :param pulumi.Input[bool] enable_deletion_protection: If true, deletion of the load balancer will be disabled via
                the AWS API. This will prevent this provider from deleting the load balancer. Defaults to `false`.
         :param pulumi.Input[bool] enable_http2: Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+        :param pulumi.Input[bool] enable_waf_fail_open: Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
         :param pulumi.Input[int] idle_timeout: The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
         :param pulumi.Input[bool] internal: If true, the LB will be internal.
         :param pulumi.Input[str] ip_address_type: The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
@@ -1019,7 +1095,7 @@ def get(resource_name: str,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] subnets: A list of subnet IDs to attach to the LB. Subnets
                cannot be updated for Load Balancers of type `network`. Changing this value
                for load balancers of type `network` will force a recreation of the resource.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
         :param pulumi.Input[str] zone_id: The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
                * `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
@@ -1032,11 +1108,13 @@ def get(resource_name: str,
         __props__.__dict__["arn"] = arn
         __props__.__dict__["arn_suffix"] = arn_suffix
         __props__.__dict__["customer_owned_ipv4_pool"] = customer_owned_ipv4_pool
+        __props__.__dict__["desync_mitigation_mode"] = desync_mitigation_mode
         __props__.__dict__["dns_name"] = dns_name
         __props__.__dict__["drop_invalid_header_fields"] = drop_invalid_header_fields
         __props__.__dict__["enable_cross_zone_load_balancing"] = enable_cross_zone_load_balancing
         __props__.__dict__["enable_deletion_protection"] = enable_deletion_protection
         __props__.__dict__["enable_http2"] = enable_http2
+        __props__.__dict__["enable_waf_fail_open"] = enable_waf_fail_open
         __props__.__dict__["idle_timeout"] = idle_timeout
         __props__.__dict__["internal"] = internal
         __props__.__dict__["ip_address_type"] = ip_address_type
@@ -1084,6 +1162,14 @@ def customer_owned_ipv4_pool(self) -> pulumi.Output[Optional[str]]:
         """
         return pulumi.get(self, "customer_owned_ipv4_pool")
 
+    @property
+    @pulumi.getter(name="desyncMitigationMode")
+    def desync_mitigation_mode(self) -> pulumi.Output[Optional[str]]:
+        """
+        Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+        """
+        return pulumi.get(self, "desync_mitigation_mode")
+
     @property
     @pulumi.getter(name="dnsName")
     def dns_name(self) -> pulumi.Output[str]:
@@ -1126,6 +1212,14 @@ def enable_http2(self) -> pulumi.Output[Optional[bool]]:
         """
         return pulumi.get(self, "enable_http2")
 
+    @property
+    @pulumi.getter(name="enableWafFailOpen")
+    def enable_waf_fail_open(self) -> pulumi.Output[Optional[bool]]:
+        """
+        Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+        """
+        return pulumi.get(self, "enable_waf_fail_open")
+
     @property
     @pulumi.getter(name="idleTimeout")
     def idle_timeout(self) -> pulumi.Output[Optional[int]]:
@@ -1206,7 +1300,7 @@ def subnets(self) -> pulumi.Output[Sequence[str]]:
     @pulumi.getter
     def tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
-        A map of tags to assign to the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+        A map of tags to assign to the resource. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         """
         return pulumi.get(self, "tags")
 
diff --git a/sdk/python/pulumi_aws/quicksight/user.py b/sdk/python/pulumi_aws/quicksight/user.py
index b987eed5b2f..e2760522270 100644
--- a/sdk/python/pulumi_aws/quicksight/user.py
+++ b/sdk/python/pulumi_aws/quicksight/user.py
@@ -29,8 +29,8 @@ def __init__(__self__, *,
         :param pulumi.Input[str] aws_account_id: The ID for the AWS account that the user is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
         :param pulumi.Input[str] iam_arn: The ARN of the IAM user or role that you are registering with Amazon QuickSight.
         :param pulumi.Input[str] namespace: The namespace. Currently, you should set this to `default`.
-        :param pulumi.Input[str] session_name: The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
-        :param pulumi.Input[str] user_name: The Amazon QuickSight user name that you want to create for the user you are registering.
+        :param pulumi.Input[str] session_name: The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
+        :param pulumi.Input[str] user_name: The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         """
         pulumi.set(__self__, "email", email)
         pulumi.set(__self__, "identity_type", identity_type)
@@ -122,7 +122,7 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="sessionName")
     def session_name(self) -> Optional[pulumi.Input[str]]:
         """
-        The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+        The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
         """
         return pulumi.get(self, "session_name")
 
@@ -134,7 +134,7 @@ def session_name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="userName")
     def user_name(self) -> Optional[pulumi.Input[str]]:
         """
-        The Amazon QuickSight user name that you want to create for the user you are registering.
+        The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         """
         return pulumi.get(self, "user_name")
 
@@ -163,8 +163,8 @@ def __init__(__self__, *,
         :param pulumi.Input[str] iam_arn: The ARN of the IAM user or role that you are registering with Amazon QuickSight.
         :param pulumi.Input[str] identity_type: Amazon QuickSight supports several ways of managing the identity of users. This parameter accepts either  `IAM` or `QUICKSIGHT`.
         :param pulumi.Input[str] namespace: The namespace. Currently, you should set this to `default`.
-        :param pulumi.Input[str] session_name: The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
-        :param pulumi.Input[str] user_name: The Amazon QuickSight user name that you want to create for the user you are registering.
+        :param pulumi.Input[str] session_name: The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
+        :param pulumi.Input[str] user_name: The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         :param pulumi.Input[str] user_role: The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
         """
         if arn is not None:
@@ -262,7 +262,7 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="sessionName")
     def session_name(self) -> Optional[pulumi.Input[str]]:
         """
-        The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+        The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
         """
         return pulumi.get(self, "session_name")
 
@@ -274,7 +274,7 @@ def session_name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="userName")
     def user_name(self) -> Optional[pulumi.Input[str]]:
         """
-        The Amazon QuickSight user name that you want to create for the user you are registering.
+        The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         """
         return pulumi.get(self, "user_name")
 
@@ -336,8 +336,8 @@ def __init__(__self__,
         :param pulumi.Input[str] iam_arn: The ARN of the IAM user or role that you are registering with Amazon QuickSight.
         :param pulumi.Input[str] identity_type: Amazon QuickSight supports several ways of managing the identity of users. This parameter accepts either  `IAM` or `QUICKSIGHT`.
         :param pulumi.Input[str] namespace: The namespace. Currently, you should set this to `default`.
-        :param pulumi.Input[str] session_name: The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
-        :param pulumi.Input[str] user_name: The Amazon QuickSight user name that you want to create for the user you are registering.
+        :param pulumi.Input[str] session_name: The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
+        :param pulumi.Input[str] user_name: The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         :param pulumi.Input[str] user_role: The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
         """
         ...
@@ -448,8 +448,8 @@ def get(resource_name: str,
         :param pulumi.Input[str] iam_arn: The ARN of the IAM user or role that you are registering with Amazon QuickSight.
         :param pulumi.Input[str] identity_type: Amazon QuickSight supports several ways of managing the identity of users. This parameter accepts either  `IAM` or `QUICKSIGHT`.
         :param pulumi.Input[str] namespace: The namespace. Currently, you should set this to `default`.
-        :param pulumi.Input[str] session_name: The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
-        :param pulumi.Input[str] user_name: The Amazon QuickSight user name that you want to create for the user you are registering.
+        :param pulumi.Input[str] session_name: The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
+        :param pulumi.Input[str] user_name: The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         :param pulumi.Input[str] user_role: The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
@@ -519,7 +519,7 @@ def namespace(self) -> pulumi.Output[Optional[str]]:
     @pulumi.getter(name="sessionName")
     def session_name(self) -> pulumi.Output[Optional[str]]:
         """
-        The name of the IAM session to use when assuming roles that can embed QuickSight dashboards.
+        The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
         """
         return pulumi.get(self, "session_name")
 
@@ -527,7 +527,7 @@ def session_name(self) -> pulumi.Output[Optional[str]]:
     @pulumi.getter(name="userName")
     def user_name(self) -> pulumi.Output[Optional[str]]:
         """
-        The Amazon QuickSight user name that you want to create for the user you are registering.
+        The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
         """
         return pulumi.get(self, "user_name")
 
diff --git a/sdk/python/pulumi_aws/ssm/_inputs.py b/sdk/python/pulumi_aws/ssm/_inputs.py
index f770bdb4ecd..1c8580f47c2 100644
--- a/sdk/python/pulumi_aws/ssm/_inputs.py
+++ b/sdk/python/pulumi_aws/ssm/_inputs.py
@@ -36,14 +36,18 @@
 class AssociationOutputLocationArgs:
     def __init__(__self__, *,
                  s3_bucket_name: pulumi.Input[str],
-                 s3_key_prefix: Optional[pulumi.Input[str]] = None):
+                 s3_key_prefix: Optional[pulumi.Input[str]] = None,
+                 s3_region: Optional[pulumi.Input[str]] = None):
         """
         :param pulumi.Input[str] s3_bucket_name: The S3 bucket name.
         :param pulumi.Input[str] s3_key_prefix: The S3 bucket prefix. Results stored in the root if not configured.
+        :param pulumi.Input[str] s3_region: The S3 bucket region.
         """
         pulumi.set(__self__, "s3_bucket_name", s3_bucket_name)
         if s3_key_prefix is not None:
             pulumi.set(__self__, "s3_key_prefix", s3_key_prefix)
+        if s3_region is not None:
+            pulumi.set(__self__, "s3_region", s3_region)
 
     @property
     @pulumi.getter(name="s3BucketName")
@@ -69,6 +73,18 @@ def s3_key_prefix(self) -> Optional[pulumi.Input[str]]:
     def s3_key_prefix(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "s3_key_prefix", value)
 
+    @property
+    @pulumi.getter(name="s3Region")
+    def s3_region(self) -> Optional[pulumi.Input[str]]:
+        """
+        The S3 bucket region.
+        """
+        return pulumi.get(self, "s3_region")
+
+    @s3_region.setter
+    def s3_region(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "s3_region", value)
+
 
 @pulumi.input_type
 class AssociationTargetArgs:
diff --git a/sdk/python/pulumi_aws/ssm/outputs.py b/sdk/python/pulumi_aws/ssm/outputs.py
index a2b6efe1ff5..cead75a8a75 100644
--- a/sdk/python/pulumi_aws/ssm/outputs.py
+++ b/sdk/python/pulumi_aws/ssm/outputs.py
@@ -42,6 +42,8 @@ def __key_warning(key: str):
             suggest = "s3_bucket_name"
         elif key == "s3KeyPrefix":
             suggest = "s3_key_prefix"
+        elif key == "s3Region":
+            suggest = "s3_region"
 
         if suggest:
             pulumi.log.warn(f"Key '{key}' not found in AssociationOutputLocation. Access the value via the '{suggest}' property getter instead.")
@@ -56,14 +58,18 @@ def get(self, key: str, default = None) -> Any:
 
     def __init__(__self__, *,
                  s3_bucket_name: str,
-                 s3_key_prefix: Optional[str] = None):
+                 s3_key_prefix: Optional[str] = None,
+                 s3_region: Optional[str] = None):
         """
         :param str s3_bucket_name: The S3 bucket name.
         :param str s3_key_prefix: The S3 bucket prefix. Results stored in the root if not configured.
+        :param str s3_region: The S3 bucket region.
         """
         pulumi.set(__self__, "s3_bucket_name", s3_bucket_name)
         if s3_key_prefix is not None:
             pulumi.set(__self__, "s3_key_prefix", s3_key_prefix)
+        if s3_region is not None:
+            pulumi.set(__self__, "s3_region", s3_region)
 
     @property
     @pulumi.getter(name="s3BucketName")
@@ -81,6 +87,14 @@ def s3_key_prefix(self) -> Optional[str]:
         """
         return pulumi.get(self, "s3_key_prefix")
 
+    @property
+    @pulumi.getter(name="s3Region")
+    def s3_region(self) -> Optional[str]:
+        """
+        The S3 bucket region.
+        """
+        return pulumi.get(self, "s3_region")
+
 
 @pulumi.output_type
 class AssociationTarget(dict):
diff --git a/sdk/python/pulumi_aws/wafv2/_inputs.py b/sdk/python/pulumi_aws/wafv2/_inputs.py
index 0501468d509..423af962085 100644
--- a/sdk/python/pulumi_aws/wafv2/_inputs.py
+++ b/sdk/python/pulumi_aws/wafv2/_inputs.py
@@ -10,6 +10,7 @@
 
 __all__ = [
     'RegexPatternSetRegularExpressionArgs',
+    'RuleGroupCustomResponseBodyArgs',
     'RuleGroupRuleArgs',
     'RuleGroupRuleActionArgs',
     'RuleGroupRuleActionAllowArgs',
@@ -21,6 +22,7 @@
     'RuleGroupRuleActionCountArgs',
     'RuleGroupRuleActionCountCustomRequestHandlingArgs',
     'RuleGroupRuleActionCountCustomRequestHandlingInsertHeaderArgs',
+    'RuleGroupRuleRuleLabelArgs',
     'RuleGroupRuleStatementArgs',
     'RuleGroupRuleStatementAndStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementArgs',
@@ -40,6 +42,7 @@
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -94,6 +97,7 @@
     'RuleGroupRuleStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementNotStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -110,6 +114,7 @@
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -166,6 +171,7 @@
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -260,6 +266,7 @@
     'RuleGroupRuleStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementNotStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementAndStatementArgs',
@@ -278,6 +285,7 @@
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -332,6 +340,7 @@
     'RuleGroupRuleStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementNotStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -348,6 +357,7 @@
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -404,6 +414,7 @@
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -502,6 +513,7 @@
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -556,6 +568,7 @@
     'RuleGroupRuleStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementNotStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -572,6 +585,7 @@
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -628,6 +642,7 @@
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -750,6 +765,7 @@
     'RuleGroupRuleStatementXssMatchStatementTextTransformationArgs',
     'RuleGroupRuleVisibilityConfigArgs',
     'RuleGroupVisibilityConfigArgs',
+    'WebAclCustomResponseBodyArgs',
     'WebAclDefaultActionArgs',
     'WebAclDefaultActionAllowArgs',
     'WebAclDefaultActionAllowCustomRequestHandlingArgs',
@@ -784,6 +800,7 @@
     'WebAclRuleOverrideActionArgs',
     'WebAclRuleOverrideActionCountArgs',
     'WebAclRuleOverrideActionNoneArgs',
+    'WebAclRuleRuleLabelArgs',
     'WebAclRuleStatementArgs',
     'WebAclRuleStatementAndStatementArgs',
     'WebAclRuleStatementAndStatementStatementArgs',
@@ -805,6 +822,7 @@
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -859,6 +877,7 @@
     'WebAclRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -875,6 +894,7 @@
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -931,6 +951,7 @@
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1025,6 +1046,7 @@
     'WebAclRuleStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementArgs',
@@ -1043,6 +1065,7 @@
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1097,6 +1120,7 @@
     'WebAclRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -1113,6 +1137,7 @@
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1169,6 +1194,7 @@
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1267,6 +1293,7 @@
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1321,6 +1348,7 @@
     'WebAclRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -1337,6 +1365,7 @@
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1393,6 +1422,7 @@
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1527,6 +1557,7 @@
     'WebAclRuleStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementExcludedRuleArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementArgs',
@@ -1548,6 +1579,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1602,6 +1634,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -1618,6 +1651,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1674,6 +1708,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1768,6 +1803,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementArgs',
@@ -1786,6 +1822,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1840,6 +1877,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -1856,6 +1894,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -1912,6 +1951,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2010,6 +2050,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2064,6 +2105,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -2080,6 +2122,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2136,6 +2179,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2276,6 +2320,7 @@
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2330,6 +2375,7 @@
     'WebAclRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -2346,6 +2392,7 @@
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2402,6 +2449,7 @@
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2496,6 +2544,7 @@
     'WebAclRuleStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementArgs',
@@ -2514,6 +2563,7 @@
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2568,6 +2618,7 @@
     'WebAclRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -2584,6 +2635,7 @@
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2640,6 +2692,7 @@
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2738,6 +2791,7 @@
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2792,6 +2846,7 @@
     'WebAclRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -2808,6 +2863,7 @@
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -2864,6 +2920,7 @@
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3004,6 +3061,7 @@
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3058,6 +3116,7 @@
     'WebAclRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -3074,6 +3133,7 @@
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3130,6 +3190,7 @@
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3224,6 +3285,7 @@
     'WebAclRuleStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementArgs',
@@ -3242,6 +3304,7 @@
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3296,6 +3359,7 @@
     'WebAclRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -3312,6 +3376,7 @@
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3368,6 +3433,7 @@
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3466,6 +3532,7 @@
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3520,6 +3587,7 @@
     'WebAclRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -3536,6 +3604,7 @@
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3592,6 +3661,7 @@
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3733,6 +3803,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3787,6 +3858,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -3803,6 +3875,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3859,6 +3932,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -3953,6 +4027,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementArgs',
@@ -3971,6 +4046,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -4025,6 +4101,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -4041,6 +4118,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -4097,6 +4175,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -4195,6 +4274,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -4249,6 +4329,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs',
@@ -4265,6 +4346,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -4321,6 +4403,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfigArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchArgs',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArgumentsArgs',
@@ -4509,6 +4592,58 @@ def regex_string(self, value: pulumi.Input[str]):
         pulumi.set(self, "regex_string", value)
 
 
+@pulumi.input_type
+class RuleGroupCustomResponseBodyArgs:
+    def __init__(__self__, *,
+                 content: pulumi.Input[str],
+                 content_type: pulumi.Input[str],
+                 key: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] content: The payload of the custom response.
+        :param pulumi.Input[str] content_type: The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        :param pulumi.Input[str] key: A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        """
+        pulumi.set(__self__, "content", content)
+        pulumi.set(__self__, "content_type", content_type)
+        pulumi.set(__self__, "key", key)
+
+    @property
+    @pulumi.getter
+    def content(self) -> pulumi.Input[str]:
+        """
+        The payload of the custom response.
+        """
+        return pulumi.get(self, "content")
+
+    @content.setter
+    def content(self, value: pulumi.Input[str]):
+        pulumi.set(self, "content", value)
+
+    @property
+    @pulumi.getter(name="contentType")
+    def content_type(self) -> pulumi.Input[str]:
+        """
+        The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        """
+        return pulumi.get(self, "content_type")
+
+    @content_type.setter
+    def content_type(self, value: pulumi.Input[str]):
+        pulumi.set(self, "content_type", value)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleArgs:
     def __init__(__self__, *,
@@ -4516,19 +4651,23 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  priority: pulumi.Input[int],
                  statement: pulumi.Input['RuleGroupRuleStatementArgs'],
-                 visibility_config: pulumi.Input['RuleGroupRuleVisibilityConfigArgs']):
+                 visibility_config: pulumi.Input['RuleGroupRuleVisibilityConfigArgs'],
+                 rule_labels: Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleRuleLabelArgs']]]] = None):
         """
         :param pulumi.Input['RuleGroupRuleActionArgs'] action: The action that AWS WAF should take on a web request when it matches the rule's statement. Settings at the `wafv2.WebAcl` level can override the rule action setting. See Action below for details.
         :param pulumi.Input[str] name: A friendly name of the rule.
         :param pulumi.Input[int] priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
         :param pulumi.Input['RuleGroupRuleStatementArgs'] statement: The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.
         :param pulumi.Input['RuleGroupRuleVisibilityConfigArgs'] visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
+        :param pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleRuleLabelArgs']]] rule_labels: Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
         """
         pulumi.set(__self__, "action", action)
         pulumi.set(__self__, "name", name)
         pulumi.set(__self__, "priority", priority)
         pulumi.set(__self__, "statement", statement)
         pulumi.set(__self__, "visibility_config", visibility_config)
+        if rule_labels is not None:
+            pulumi.set(__self__, "rule_labels", rule_labels)
 
     @property
     @pulumi.getter
@@ -4590,6 +4729,18 @@ def visibility_config(self) -> pulumi.Input['RuleGroupRuleVisibilityConfigArgs']
     def visibility_config(self, value: pulumi.Input['RuleGroupRuleVisibilityConfigArgs']):
         pulumi.set(self, "visibility_config", value)
 
+    @property
+    @pulumi.getter(name="ruleLabels")
+    def rule_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleRuleLabelArgs']]]]:
+        """
+        Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        """
+        return pulumi.get(self, "rule_labels")
+
+    @rule_labels.setter
+    def rule_labels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleRuleLabelArgs']]]]):
+        pulumi.set(self, "rule_labels", value)
+
 
 @pulumi.input_type
 class RuleGroupRuleActionArgs:
@@ -4697,7 +4848,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  value: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[str] value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -4707,7 +4858,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -4755,12 +4906,16 @@ def custom_response(self, value: Optional[pulumi.Input['RuleGroupRuleActionBlock
 class RuleGroupRuleActionBlockCustomResponseArgs:
     def __init__(__self__, *,
                  response_code: pulumi.Input[int],
+                 custom_response_body_key: Optional[pulumi.Input[str]] = None,
                  response_headers: Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs']]]] = None):
         """
         :param pulumi.Input[int] response_code: The HTTP status code to return to the client.
+        :param pulumi.Input[str] custom_response_body_key: References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
         :param pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs']]] response_headers: The `response_header` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
         """
         pulumi.set(__self__, "response_code", response_code)
+        if custom_response_body_key is not None:
+            pulumi.set(__self__, "custom_response_body_key", custom_response_body_key)
         if response_headers is not None:
             pulumi.set(__self__, "response_headers", response_headers)
 
@@ -4776,6 +4931,18 @@ def response_code(self) -> pulumi.Input[int]:
     def response_code(self, value: pulumi.Input[int]):
         pulumi.set(self, "response_code", value)
 
+    @property
+    @pulumi.getter(name="customResponseBodyKey")
+    def custom_response_body_key(self) -> Optional[pulumi.Input[str]]:
+        """
+        References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        """
+        return pulumi.get(self, "custom_response_body_key")
+
+    @custom_response_body_key.setter
+    def custom_response_body_key(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "custom_response_body_key", value)
+
     @property
     @pulumi.getter(name="responseHeaders")
     def response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs']]]]:
@@ -4795,7 +4962,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  value: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[str] value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -4805,7 +4972,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -4877,7 +5044,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  value: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[str] value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -4887,7 +5054,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -4908,6 +5075,28 @@ def value(self, value: pulumi.Input[str]):
         pulumi.set(self, "value", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleRuleLabelArgs:
+    def __init__(__self__, *,
+                 name: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] name: The label string.
+        """
+        pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter
+    def name(self) -> pulumi.Input[str]:
+        """
+        The label string.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "name", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementArgs:
     def __init__(__self__, *,
@@ -4915,6 +5104,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -4926,6 +5116,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -4941,6 +5132,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -5002,6 +5195,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementArgs']]:
@@ -5104,6 +5309,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -5115,6 +5321,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -5130,6 +5337,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -5191,6 +5400,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementArgs']]:
@@ -5292,6 +5513,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -5300,6 +5522,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -5311,6 +5534,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -5356,6 +5581,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -5868,6 +6105,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -7448,6 +7722,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementAndStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -7476,6 +7787,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -7484,6 +7796,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -7495,6 +7808,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -7540,6 +7855,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -8052,6 +8379,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -9197,6 +9561,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -9205,6 +9570,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -9216,6 +9582,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -9261,6 +9629,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -9773,6 +10153,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -12470,6 +12887,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -12499,6 +12953,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -12510,6 +12965,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -12525,6 +12981,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -12586,6 +13044,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementArgs']]:
@@ -12687,6 +13157,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -12695,6 +13166,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -12706,6 +13178,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -12751,6 +13225,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -13263,6 +13749,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -14843,6 +15366,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementNotStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -14871,6 +15431,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -14879,6 +15440,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -14890,6 +15452,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -14935,6 +15499,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -15447,6 +16023,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -16592,6 +17205,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -16600,6 +17214,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -16611,6 +17226,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -16656,6 +17273,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -17168,6 +17797,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -19431,6 +20097,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -19442,6 +20109,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -19457,6 +20125,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -19518,6 +20188,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementArgs']]:
@@ -19619,6 +20301,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -19627,6 +20310,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -19638,6 +20322,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -19683,6 +20369,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -20195,6 +20893,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -21775,6 +22510,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementOrStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -21803,6 +22575,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -21811,6 +22584,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -21822,6 +22596,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -21867,6 +22643,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -22379,6 +23167,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -23524,6 +24349,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -23532,6 +24358,7 @@ def __init__(__self__, *,
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -23543,6 +24370,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -23588,6 +24417,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStat
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -24100,6 +24941,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -27555,6 +28433,58 @@ def sampled_requests_enabled(self, value: pulumi.Input[bool]):
         pulumi.set(self, "sampled_requests_enabled", value)
 
 
+@pulumi.input_type
+class WebAclCustomResponseBodyArgs:
+    def __init__(__self__, *,
+                 content: pulumi.Input[str],
+                 content_type: pulumi.Input[str],
+                 key: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] content: The payload of the custom response.
+        :param pulumi.Input[str] content_type: The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        :param pulumi.Input[str] key: A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        """
+        pulumi.set(__self__, "content", content)
+        pulumi.set(__self__, "content_type", content_type)
+        pulumi.set(__self__, "key", key)
+
+    @property
+    @pulumi.getter
+    def content(self) -> pulumi.Input[str]:
+        """
+        The payload of the custom response.
+        """
+        return pulumi.get(self, "content")
+
+    @content.setter
+    def content(self, value: pulumi.Input[str]):
+        pulumi.set(self, "content", value)
+
+    @property
+    @pulumi.getter(name="contentType")
+    def content_type(self) -> pulumi.Input[str]:
+        """
+        The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        """
+        return pulumi.get(self, "content_type")
+
+    @content_type.setter
+    def content_type(self, value: pulumi.Input[str]):
+        pulumi.set(self, "content_type", value)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+
 @pulumi.input_type
 class WebAclDefaultActionArgs:
     def __init__(__self__, *,
@@ -27645,7 +28575,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  value: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[str] value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -27655,7 +28585,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -27703,12 +28633,16 @@ def custom_response(self, value: Optional[pulumi.Input['WebAclDefaultActionBlock
 class WebAclDefaultActionBlockCustomResponseArgs:
     def __init__(__self__, *,
                  response_code: pulumi.Input[int],
+                 custom_response_body_key: Optional[pulumi.Input[str]] = None,
                  response_headers: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclDefaultActionBlockCustomResponseResponseHeaderArgs']]]] = None):
         """
         :param pulumi.Input[int] response_code: The HTTP status code to return to the client.
+        :param pulumi.Input[str] custom_response_body_key: References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
         :param pulumi.Input[Sequence[pulumi.Input['WebAclDefaultActionBlockCustomResponseResponseHeaderArgs']]] response_headers: The `response_header` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
         """
         pulumi.set(__self__, "response_code", response_code)
+        if custom_response_body_key is not None:
+            pulumi.set(__self__, "custom_response_body_key", custom_response_body_key)
         if response_headers is not None:
             pulumi.set(__self__, "response_headers", response_headers)
 
@@ -27724,6 +28658,18 @@ def response_code(self) -> pulumi.Input[int]:
     def response_code(self, value: pulumi.Input[int]):
         pulumi.set(self, "response_code", value)
 
+    @property
+    @pulumi.getter(name="customResponseBodyKey")
+    def custom_response_body_key(self) -> Optional[pulumi.Input[str]]:
+        """
+        References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        """
+        return pulumi.get(self, "custom_response_body_key")
+
+    @custom_response_body_key.setter
+    def custom_response_body_key(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "custom_response_body_key", value)
+
     @property
     @pulumi.getter(name="responseHeaders")
     def response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['WebAclDefaultActionBlockCustomResponseResponseHeaderArgs']]]]:
@@ -27743,7 +28689,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  value: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[str] value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -27753,7 +28699,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -28159,7 +29105,8 @@ def __init__(__self__, *,
                  statement: pulumi.Input['WebAclRuleStatementArgs'],
                  visibility_config: pulumi.Input['WebAclRuleVisibilityConfigArgs'],
                  action: Optional[pulumi.Input['WebAclRuleActionArgs']] = None,
-                 override_action: Optional[pulumi.Input['WebAclRuleOverrideActionArgs']] = None):
+                 override_action: Optional[pulumi.Input['WebAclRuleOverrideActionArgs']] = None,
+                 rule_labels: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclRuleRuleLabelArgs']]]] = None):
         """
         :param pulumi.Input[str] name: A friendly name of the rule.
         :param pulumi.Input[int] priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
@@ -28167,6 +29114,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleVisibilityConfigArgs'] visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
         :param pulumi.Input['WebAclRuleActionArgs'] action: The action that AWS WAF should take on a web request when it matches the rule's statement. This is used only for rules whose **statements do not reference a rule group**. See Action below for details.
         :param pulumi.Input['WebAclRuleOverrideActionArgs'] override_action: The override action to apply to the rules in a rule group. Used only for rule **statements that reference a rule group**, like `rule_group_reference_statement` and `managed_rule_group_statement`. See Override Action below for details.
+        :param pulumi.Input[Sequence[pulumi.Input['WebAclRuleRuleLabelArgs']]] rule_labels: Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
         """
         pulumi.set(__self__, "name", name)
         pulumi.set(__self__, "priority", priority)
@@ -28176,6 +29124,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "action", action)
         if override_action is not None:
             pulumi.set(__self__, "override_action", override_action)
+        if rule_labels is not None:
+            pulumi.set(__self__, "rule_labels", rule_labels)
 
     @property
     @pulumi.getter
@@ -28249,6 +29199,18 @@ def override_action(self) -> Optional[pulumi.Input['WebAclRuleOverrideActionArgs
     def override_action(self, value: Optional[pulumi.Input['WebAclRuleOverrideActionArgs']]):
         pulumi.set(self, "override_action", value)
 
+    @property
+    @pulumi.getter(name="ruleLabels")
+    def rule_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['WebAclRuleRuleLabelArgs']]]]:
+        """
+        Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        """
+        return pulumi.get(self, "rule_labels")
+
+    @rule_labels.setter
+    def rule_labels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclRuleRuleLabelArgs']]]]):
+        pulumi.set(self, "rule_labels", value)
+
 
 @pulumi.input_type
 class WebAclRuleActionArgs:
@@ -28356,7 +29318,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  value: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[str] value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -28366,7 +29328,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -28414,12 +29376,16 @@ def custom_response(self, value: Optional[pulumi.Input['WebAclRuleActionBlockCus
 class WebAclRuleActionBlockCustomResponseArgs:
     def __init__(__self__, *,
                  response_code: pulumi.Input[int],
+                 custom_response_body_key: Optional[pulumi.Input[str]] = None,
                  response_headers: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclRuleActionBlockCustomResponseResponseHeaderArgs']]]] = None):
         """
         :param pulumi.Input[int] response_code: The HTTP status code to return to the client.
+        :param pulumi.Input[str] custom_response_body_key: References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
         :param pulumi.Input[Sequence[pulumi.Input['WebAclRuleActionBlockCustomResponseResponseHeaderArgs']]] response_headers: The `response_header` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
         """
         pulumi.set(__self__, "response_code", response_code)
+        if custom_response_body_key is not None:
+            pulumi.set(__self__, "custom_response_body_key", custom_response_body_key)
         if response_headers is not None:
             pulumi.set(__self__, "response_headers", response_headers)
 
@@ -28435,6 +29401,18 @@ def response_code(self) -> pulumi.Input[int]:
     def response_code(self, value: pulumi.Input[int]):
         pulumi.set(self, "response_code", value)
 
+    @property
+    @pulumi.getter(name="customResponseBodyKey")
+    def custom_response_body_key(self) -> Optional[pulumi.Input[str]]:
+        """
+        References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        """
+        return pulumi.get(self, "custom_response_body_key")
+
+    @custom_response_body_key.setter
+    def custom_response_body_key(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "custom_response_body_key", value)
+
     @property
     @pulumi.getter(name="responseHeaders")
     def response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['WebAclRuleActionBlockCustomResponseResponseHeaderArgs']]]]:
@@ -28454,7 +29432,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  value: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[str] value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -28464,7 +29442,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -28536,7 +29514,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  value: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[str] value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -28546,7 +29524,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> pulumi.Input[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -28618,6 +29596,28 @@ def __init__(__self__):
         pass
 
 
+@pulumi.input_type
+class WebAclRuleRuleLabelArgs:
+    def __init__(__self__, *,
+                 name: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] name: The label string.
+        """
+        pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter
+    def name(self) -> pulumi.Input[str]:
+        """
+        The label string.
+        """
+        return pulumi.get(self, "name")
+
+    @name.setter
+    def name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "name", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementArgs:
     def __init__(__self__, *,
@@ -28625,6 +29625,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementLabelMatchStatementArgs']] = None,
                  managed_rule_group_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementArgs']] = None,
@@ -28639,6 +29640,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementArgs'] managed_rule_group_statement: A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -28657,6 +29659,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if managed_rule_group_statement is not None:
             pulumi.set(__self__, "managed_rule_group_statement", managed_rule_group_statement)
         if not_statement is not None:
@@ -28724,6 +29728,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="managedRuleGroupStatement")
     def managed_rule_group_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementArgs']]:
@@ -28862,6 +29878,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -28873,6 +29890,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -28888,6 +29906,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -28949,6 +29969,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementArgs']]:
@@ -29051,6 +30083,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -29062,6 +30095,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -29077,6 +30111,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -29138,6 +30174,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementArgs']]:
@@ -29239,6 +30287,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -29247,6 +30296,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -29258,6 +30308,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -29303,6 +30355,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -29815,6 +30879,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -31304,95 +32405,132 @@ def header_name(self) -> pulumi.Input[str]:
     def header_name(self, value: pulumi.Input[str]):
         pulumi.set(self, "header_name", value)
 
-
-@pulumi.input_type
-class WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs:
-    def __init__(__self__, *,
-                 arn: pulumi.Input[str],
-                 ip_set_forwarded_ip_config: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']] = None):
-        """
-        :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
-        :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs'] ip_set_forwarded_ip_config: The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
-        """
-        pulumi.set(__self__, "arn", arn)
-        if ip_set_forwarded_ip_config is not None:
-            pulumi.set(__self__, "ip_set_forwarded_ip_config", ip_set_forwarded_ip_config)
-
+
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs:
+    def __init__(__self__, *,
+                 arn: pulumi.Input[str],
+                 ip_set_forwarded_ip_config: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']] = None):
+        """
+        :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs'] ip_set_forwarded_ip_config: The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        """
+        pulumi.set(__self__, "arn", arn)
+        if ip_set_forwarded_ip_config is not None:
+            pulumi.set(__self__, "ip_set_forwarded_ip_config", ip_set_forwarded_ip_config)
+
+    @property
+    @pulumi.getter
+    def arn(self) -> pulumi.Input[str]:
+        """
+        The Amazon Resource Name (ARN) of the IP Set that this statement references.
+        """
+        return pulumi.get(self, "arn")
+
+    @arn.setter
+    def arn(self, value: pulumi.Input[str]):
+        pulumi.set(self, "arn", value)
+
+    @property
+    @pulumi.getter(name="ipSetForwardedIpConfig")
+    def ip_set_forwarded_ip_config(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]:
+        """
+        The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        """
+        return pulumi.get(self, "ip_set_forwarded_ip_config")
+
+    @ip_set_forwarded_ip_config.setter
+    def ip_set_forwarded_ip_config(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]):
+        pulumi.set(self, "ip_set_forwarded_ip_config", value)
+
+
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs:
+    def __init__(__self__, *,
+                 fallback_behavior: pulumi.Input[str],
+                 header_name: pulumi.Input[str],
+                 position: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] fallback_behavior: - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        :param pulumi.Input[str] header_name: - The name of the HTTP header to use for the IP address.
+        :param pulumi.Input[str] position: - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        """
+        pulumi.set(__self__, "fallback_behavior", fallback_behavior)
+        pulumi.set(__self__, "header_name", header_name)
+        pulumi.set(__self__, "position", position)
+
+    @property
+    @pulumi.getter(name="fallbackBehavior")
+    def fallback_behavior(self) -> pulumi.Input[str]:
+        """
+        - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        """
+        return pulumi.get(self, "fallback_behavior")
+
+    @fallback_behavior.setter
+    def fallback_behavior(self, value: pulumi.Input[str]):
+        pulumi.set(self, "fallback_behavior", value)
+
+    @property
+    @pulumi.getter(name="headerName")
+    def header_name(self) -> pulumi.Input[str]:
+        """
+        - The name of the HTTP header to use for the IP address.
+        """
+        return pulumi.get(self, "header_name")
+
+    @header_name.setter
+    def header_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "header_name", value)
+
     @property
     @pulumi.getter
-    def arn(self) -> pulumi.Input[str]:
-        """
-        The Amazon Resource Name (ARN) of the IP Set that this statement references.
-        """
-        return pulumi.get(self, "arn")
-
-    @arn.setter
-    def arn(self, value: pulumi.Input[str]):
-        pulumi.set(self, "arn", value)
-
-    @property
-    @pulumi.getter(name="ipSetForwardedIpConfig")
-    def ip_set_forwarded_ip_config(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]:
+    def position(self) -> pulumi.Input[str]:
         """
-        The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
         """
-        return pulumi.get(self, "ip_set_forwarded_ip_config")
+        return pulumi.get(self, "position")
 
-    @ip_set_forwarded_ip_config.setter
-    def ip_set_forwarded_ip_config(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]):
-        pulumi.set(self, "ip_set_forwarded_ip_config", value)
+    @position.setter
+    def position(self, value: pulumi.Input[str]):
+        pulumi.set(self, "position", value)
 
 
 @pulumi.input_type
-class WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs:
+class WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs:
     def __init__(__self__, *,
-                 fallback_behavior: pulumi.Input[str],
-                 header_name: pulumi.Input[str],
-                 position: pulumi.Input[str]):
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] fallback_behavior: - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
-        :param pulumi.Input[str] header_name: - The name of the HTTP header to use for the IP address.
-        :param pulumi.Input[str] position: - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
         """
-        pulumi.set(__self__, "fallback_behavior", fallback_behavior)
-        pulumi.set(__self__, "header_name", header_name)
-        pulumi.set(__self__, "position", position)
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
 
     @property
-    @pulumi.getter(name="fallbackBehavior")
-    def fallback_behavior(self) -> pulumi.Input[str]:
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
         """
-        - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        The string to match against.
         """
-        return pulumi.get(self, "fallback_behavior")
+        return pulumi.get(self, "key")
 
-    @fallback_behavior.setter
-    def fallback_behavior(self, value: pulumi.Input[str]):
-        pulumi.set(self, "fallback_behavior", value)
-
-    @property
-    @pulumi.getter(name="headerName")
-    def header_name(self) -> pulumi.Input[str]:
-        """
-        - The name of the HTTP header to use for the IP address.
-        """
-        return pulumi.get(self, "header_name")
-
-    @header_name.setter
-    def header_name(self, value: pulumi.Input[str]):
-        pulumi.set(self, "header_name", value)
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
 
     @property
     @pulumi.getter
-    def position(self) -> pulumi.Input[str]:
+    def scope(self) -> pulumi.Input[str]:
         """
-        - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
         """
-        return pulumi.get(self, "position")
+        return pulumi.get(self, "scope")
 
-    @position.setter
-    def position(self, value: pulumi.Input[str]):
-        pulumi.set(self, "position", value)
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
 
 
 @pulumi.input_type
@@ -31423,6 +32561,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -31431,6 +32570,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -31442,6 +32582,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -31487,6 +32629,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -31999,6 +33153,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -33144,6 +34335,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -33152,6 +34344,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -33163,6 +34356,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -33208,6 +34403,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -33720,6 +34927,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -36417,6 +37661,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -36446,6 +37727,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -36457,6 +37739,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -36472,6 +37755,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -36533,6 +37818,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementArgs']]:
@@ -36634,6 +37931,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -36642,6 +37940,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -36653,6 +37952,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -36698,6 +37999,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -37210,6 +38523,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -38790,6 +40140,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -38818,6 +40205,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -38826,6 +40214,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -38837,6 +40226,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -38882,6 +40273,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -39394,6 +40797,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -40539,6 +41979,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -40547,6 +41988,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -40558,6 +42000,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -40603,6 +42047,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -41115,6 +42571,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -43378,6 +44871,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -43389,6 +44883,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -43404,6 +44899,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -43465,6 +44962,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementArgs']]:
@@ -43566,6 +45075,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -43574,6 +45084,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -43585,6 +45096,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -43630,6 +45143,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -44142,6 +45667,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -45722,6 +47284,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -45750,6 +47349,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -45758,6 +47358,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -45769,6 +47370,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -45814,6 +47417,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -46326,6 +47941,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -47471,6 +49123,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -47479,6 +49132,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -47490,6 +49144,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -47535,6 +49191,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -48047,6 +49715,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -51861,6 +53566,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementArgs:
     def __init__(__self__, *,
@@ -51959,6 +53701,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -51970,6 +53713,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -51985,6 +53729,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -52046,6 +53792,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementArgs']]:
@@ -52148,6 +53906,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -52159,6 +53918,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -52174,6 +53934,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -52235,6 +53997,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementArgs']]:
@@ -52336,6 +54110,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -52344,6 +54119,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -52355,6 +54131,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -52400,6 +54178,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -52912,6 +54702,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -54492,6 +56319,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -54520,6 +56384,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -54528,6 +56393,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -54539,6 +56405,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -54584,6 +56452,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -55096,6 +56976,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -56241,6 +58158,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -56249,6 +58167,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -56260,6 +58179,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -56305,6 +58226,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -56817,6 +58750,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -59423,95 +61393,132 @@ def header_name(self) -> pulumi.Input[str]:
     def header_name(self, value: pulumi.Input[str]):
         pulumi.set(self, "header_name", value)
 
-
-@pulumi.input_type
-class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs:
-    def __init__(__self__, *,
-                 arn: pulumi.Input[str],
-                 ip_set_forwarded_ip_config: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']] = None):
-        """
-        :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
-        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs'] ip_set_forwarded_ip_config: The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
-        """
-        pulumi.set(__self__, "arn", arn)
-        if ip_set_forwarded_ip_config is not None:
-            pulumi.set(__self__, "ip_set_forwarded_ip_config", ip_set_forwarded_ip_config)
-
+
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs:
+    def __init__(__self__, *,
+                 arn: pulumi.Input[str],
+                 ip_set_forwarded_ip_config: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']] = None):
+        """
+        :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs'] ip_set_forwarded_ip_config: The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        """
+        pulumi.set(__self__, "arn", arn)
+        if ip_set_forwarded_ip_config is not None:
+            pulumi.set(__self__, "ip_set_forwarded_ip_config", ip_set_forwarded_ip_config)
+
+    @property
+    @pulumi.getter
+    def arn(self) -> pulumi.Input[str]:
+        """
+        The Amazon Resource Name (ARN) of the IP Set that this statement references.
+        """
+        return pulumi.get(self, "arn")
+
+    @arn.setter
+    def arn(self, value: pulumi.Input[str]):
+        pulumi.set(self, "arn", value)
+
+    @property
+    @pulumi.getter(name="ipSetForwardedIpConfig")
+    def ip_set_forwarded_ip_config(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]:
+        """
+        The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        """
+        return pulumi.get(self, "ip_set_forwarded_ip_config")
+
+    @ip_set_forwarded_ip_config.setter
+    def ip_set_forwarded_ip_config(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]):
+        pulumi.set(self, "ip_set_forwarded_ip_config", value)
+
+
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs:
+    def __init__(__self__, *,
+                 fallback_behavior: pulumi.Input[str],
+                 header_name: pulumi.Input[str],
+                 position: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] fallback_behavior: - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        :param pulumi.Input[str] header_name: - The name of the HTTP header to use for the IP address.
+        :param pulumi.Input[str] position: - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        """
+        pulumi.set(__self__, "fallback_behavior", fallback_behavior)
+        pulumi.set(__self__, "header_name", header_name)
+        pulumi.set(__self__, "position", position)
+
+    @property
+    @pulumi.getter(name="fallbackBehavior")
+    def fallback_behavior(self) -> pulumi.Input[str]:
+        """
+        - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        """
+        return pulumi.get(self, "fallback_behavior")
+
+    @fallback_behavior.setter
+    def fallback_behavior(self, value: pulumi.Input[str]):
+        pulumi.set(self, "fallback_behavior", value)
+
+    @property
+    @pulumi.getter(name="headerName")
+    def header_name(self) -> pulumi.Input[str]:
+        """
+        - The name of the HTTP header to use for the IP address.
+        """
+        return pulumi.get(self, "header_name")
+
+    @header_name.setter
+    def header_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "header_name", value)
+
     @property
     @pulumi.getter
-    def arn(self) -> pulumi.Input[str]:
-        """
-        The Amazon Resource Name (ARN) of the IP Set that this statement references.
-        """
-        return pulumi.get(self, "arn")
-
-    @arn.setter
-    def arn(self, value: pulumi.Input[str]):
-        pulumi.set(self, "arn", value)
-
-    @property
-    @pulumi.getter(name="ipSetForwardedIpConfig")
-    def ip_set_forwarded_ip_config(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]:
+    def position(self) -> pulumi.Input[str]:
         """
-        The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
         """
-        return pulumi.get(self, "ip_set_forwarded_ip_config")
+        return pulumi.get(self, "position")
 
-    @ip_set_forwarded_ip_config.setter
-    def ip_set_forwarded_ip_config(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]):
-        pulumi.set(self, "ip_set_forwarded_ip_config", value)
+    @position.setter
+    def position(self, value: pulumi.Input[str]):
+        pulumi.set(self, "position", value)
 
 
 @pulumi.input_type
-class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs:
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs:
     def __init__(__self__, *,
-                 fallback_behavior: pulumi.Input[str],
-                 header_name: pulumi.Input[str],
-                 position: pulumi.Input[str]):
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] fallback_behavior: - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
-        :param pulumi.Input[str] header_name: - The name of the HTTP header to use for the IP address.
-        :param pulumi.Input[str] position: - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
         """
-        pulumi.set(__self__, "fallback_behavior", fallback_behavior)
-        pulumi.set(__self__, "header_name", header_name)
-        pulumi.set(__self__, "position", position)
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
 
     @property
-    @pulumi.getter(name="fallbackBehavior")
-    def fallback_behavior(self) -> pulumi.Input[str]:
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
         """
-        - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        The string to match against.
         """
-        return pulumi.get(self, "fallback_behavior")
+        return pulumi.get(self, "key")
 
-    @fallback_behavior.setter
-    def fallback_behavior(self, value: pulumi.Input[str]):
-        pulumi.set(self, "fallback_behavior", value)
-
-    @property
-    @pulumi.getter(name="headerName")
-    def header_name(self) -> pulumi.Input[str]:
-        """
-        - The name of the HTTP header to use for the IP address.
-        """
-        return pulumi.get(self, "header_name")
-
-    @header_name.setter
-    def header_name(self, value: pulumi.Input[str]):
-        pulumi.set(self, "header_name", value)
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
 
     @property
     @pulumi.getter
-    def position(self) -> pulumi.Input[str]:
+    def scope(self) -> pulumi.Input[str]:
         """
-        - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
         """
-        return pulumi.get(self, "position")
+        return pulumi.get(self, "scope")
 
-    @position.setter
-    def position(self, value: pulumi.Input[str]):
-        pulumi.set(self, "position", value)
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
 
 
 @pulumi.input_type
@@ -59543,6 +61550,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -59554,6 +61562,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -59569,6 +61578,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -59630,6 +61641,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementArgs']]:
@@ -59731,6 +61754,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -59739,6 +61763,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -59750,6 +61775,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -59795,6 +61822,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -60307,6 +62346,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -61887,6 +63963,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -61915,6 +64028,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -61923,6 +64037,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -61934,6 +64049,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -61979,6 +64096,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -62491,6 +64620,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -63636,6 +65802,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -63644,6 +65811,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -63655,6 +65823,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -63700,6 +65870,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -64212,6 +66394,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -66475,6 +68694,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -66486,6 +68706,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -66501,6 +68722,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -66562,6 +68785,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementArgs']]:
@@ -66663,6 +68898,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -66671,6 +68907,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -66682,6 +68919,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -66727,6 +68966,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -67239,6 +69490,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -68819,6 +71107,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -68847,6 +71172,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -68855,6 +71181,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -68866,6 +71193,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -68911,6 +71240,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -69423,6 +71764,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -70568,6 +72946,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -70576,6 +72955,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -70587,6 +72967,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -70632,6 +73014,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -71144,6 +73538,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -74524,6 +76955,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -74535,6 +76967,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -74550,6 +76983,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -74611,6 +77046,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementArgs']]:
@@ -74713,6 +77160,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -74724,6 +77172,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -74739,6 +77188,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -74800,6 +77251,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementArgs']]:
@@ -74901,6 +77364,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -74909,6 +77373,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -74920,6 +77385,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -74965,6 +77432,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -75477,6 +77956,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -77057,6 +79573,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -77085,6 +79638,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -77093,6 +79647,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -77104,6 +79659,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -77149,6 +79706,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -77661,6 +80230,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -78806,6 +81412,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -78814,6 +81421,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -78825,6 +81433,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -78870,6 +81480,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -79382,6 +82004,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -82079,6 +84738,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -82108,6 +84804,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -82119,6 +84816,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -82134,6 +84832,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -82195,6 +84895,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementArgs']]:
@@ -82296,6 +85008,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -82304,6 +85017,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -82315,6 +85029,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -82360,6 +85076,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -82872,6 +85600,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -84452,6 +87217,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -84480,6 +87282,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -84488,6 +87291,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -84499,6 +87303,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -84544,6 +87350,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -85056,6 +87874,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -86201,6 +89056,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -86209,6 +89065,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -86220,6 +89077,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -86265,6 +89124,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -86777,6 +89648,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -89040,6 +91948,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -89051,6 +91960,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -89066,6 +91976,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -89127,6 +92039,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementArgs']]:
@@ -89228,6 +92152,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -89236,6 +92161,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -89247,6 +92173,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -89292,6 +92220,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -89804,6 +92744,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -91384,6 +94361,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -91412,6 +94426,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -91420,6 +94435,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -91431,6 +94447,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -91476,6 +94494,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -91988,6 +95018,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -93133,6 +96200,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -93141,6 +96209,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -93152,6 +96221,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -93197,6 +96268,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -93709,6 +96792,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -97089,6 +100209,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -97100,6 +100221,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -97115,6 +100237,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -97176,6 +100300,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementArgs']]:
@@ -97278,6 +100414,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -97289,6 +100426,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -97304,6 +100442,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -97365,6 +100505,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementArgs']]:
@@ -97466,6 +100618,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -97474,6 +100627,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -97485,6 +100639,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -97530,6 +100686,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -98042,6 +101210,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -99622,6 +102827,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -99650,6 +102892,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -99658,6 +102901,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -99669,6 +102913,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -99714,6 +102960,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -100226,6 +103484,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -101371,6 +104666,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -101379,6 +104675,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -101390,6 +104687,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -101435,6 +104734,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -101947,6 +105258,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -104644,6 +107992,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -104673,6 +108058,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -104684,6 +108070,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -104699,6 +108086,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -104760,6 +108149,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementArgs']]:
@@ -104861,6 +108262,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -104869,6 +108271,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -104880,6 +108283,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -104925,6 +108330,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -105437,6 +108854,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -107017,6 +110471,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -107045,6 +110536,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -107053,6 +110545,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -107064,6 +110557,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -107109,6 +110604,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -107621,6 +111128,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -108766,6 +112310,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -108774,6 +112319,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -108785,6 +112331,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -108830,6 +112378,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -109342,6 +112902,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -111605,6 +115202,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -111616,6 +115214,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -111631,6 +115230,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -111692,6 +115293,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementArgs']]:
@@ -111793,6 +115406,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -111801,6 +115415,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -111812,6 +115427,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -111857,6 +115474,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -112369,6 +115998,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -113949,6 +117615,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -113977,6 +117680,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -113985,6 +117689,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -113996,6 +117701,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -114041,6 +117748,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -114553,6 +118272,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -115698,6 +119454,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -115706,6 +119463,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -115717,6 +119475,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -115762,6 +119522,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -116274,6 +120046,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -119739,6 +123548,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -119750,6 +123560,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -119765,6 +123576,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -119826,6 +123639,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementArgs']]:
@@ -119928,6 +123753,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -119939,6 +123765,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -119954,6 +123781,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -120015,6 +123844,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementArgs']]:
@@ -120116,6 +123957,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -120124,6 +123966,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -120135,6 +123978,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -120180,6 +124025,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -120692,6 +124549,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -122272,6 +126166,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -122300,6 +126231,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -122308,6 +126240,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -122319,6 +126252,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -122364,6 +126299,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -122876,6 +126823,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -124021,6 +128005,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -124029,6 +128014,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -124040,6 +128026,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -124085,6 +128073,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -124597,6 +128597,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -127203,95 +131240,132 @@ def header_name(self) -> pulumi.Input[str]:
     def header_name(self, value: pulumi.Input[str]):
         pulumi.set(self, "header_name", value)
 
-
-@pulumi.input_type
-class WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs:
-    def __init__(__self__, *,
-                 arn: pulumi.Input[str],
-                 ip_set_forwarded_ip_config: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']] = None):
-        """
-        :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
-        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs'] ip_set_forwarded_ip_config: The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
-        """
-        pulumi.set(__self__, "arn", arn)
-        if ip_set_forwarded_ip_config is not None:
-            pulumi.set(__self__, "ip_set_forwarded_ip_config", ip_set_forwarded_ip_config)
-
+
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs:
+    def __init__(__self__, *,
+                 arn: pulumi.Input[str],
+                 ip_set_forwarded_ip_config: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']] = None):
+        """
+        :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs'] ip_set_forwarded_ip_config: The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        """
+        pulumi.set(__self__, "arn", arn)
+        if ip_set_forwarded_ip_config is not None:
+            pulumi.set(__self__, "ip_set_forwarded_ip_config", ip_set_forwarded_ip_config)
+
+    @property
+    @pulumi.getter
+    def arn(self) -> pulumi.Input[str]:
+        """
+        The Amazon Resource Name (ARN) of the IP Set that this statement references.
+        """
+        return pulumi.get(self, "arn")
+
+    @arn.setter
+    def arn(self, value: pulumi.Input[str]):
+        pulumi.set(self, "arn", value)
+
+    @property
+    @pulumi.getter(name="ipSetForwardedIpConfig")
+    def ip_set_forwarded_ip_config(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]:
+        """
+        The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        """
+        return pulumi.get(self, "ip_set_forwarded_ip_config")
+
+    @ip_set_forwarded_ip_config.setter
+    def ip_set_forwarded_ip_config(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]):
+        pulumi.set(self, "ip_set_forwarded_ip_config", value)
+
+
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs:
+    def __init__(__self__, *,
+                 fallback_behavior: pulumi.Input[str],
+                 header_name: pulumi.Input[str],
+                 position: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] fallback_behavior: - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        :param pulumi.Input[str] header_name: - The name of the HTTP header to use for the IP address.
+        :param pulumi.Input[str] position: - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        """
+        pulumi.set(__self__, "fallback_behavior", fallback_behavior)
+        pulumi.set(__self__, "header_name", header_name)
+        pulumi.set(__self__, "position", position)
+
+    @property
+    @pulumi.getter(name="fallbackBehavior")
+    def fallback_behavior(self) -> pulumi.Input[str]:
+        """
+        - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        """
+        return pulumi.get(self, "fallback_behavior")
+
+    @fallback_behavior.setter
+    def fallback_behavior(self, value: pulumi.Input[str]):
+        pulumi.set(self, "fallback_behavior", value)
+
+    @property
+    @pulumi.getter(name="headerName")
+    def header_name(self) -> pulumi.Input[str]:
+        """
+        - The name of the HTTP header to use for the IP address.
+        """
+        return pulumi.get(self, "header_name")
+
+    @header_name.setter
+    def header_name(self, value: pulumi.Input[str]):
+        pulumi.set(self, "header_name", value)
+
     @property
     @pulumi.getter
-    def arn(self) -> pulumi.Input[str]:
-        """
-        The Amazon Resource Name (ARN) of the IP Set that this statement references.
-        """
-        return pulumi.get(self, "arn")
-
-    @arn.setter
-    def arn(self, value: pulumi.Input[str]):
-        pulumi.set(self, "arn", value)
-
-    @property
-    @pulumi.getter(name="ipSetForwardedIpConfig")
-    def ip_set_forwarded_ip_config(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]:
+    def position(self) -> pulumi.Input[str]:
         """
-        The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See IPSet Forwarded IP Config below for more details.
+        - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
         """
-        return pulumi.get(self, "ip_set_forwarded_ip_config")
+        return pulumi.get(self, "position")
 
-    @ip_set_forwarded_ip_config.setter
-    def ip_set_forwarded_ip_config(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs']]):
-        pulumi.set(self, "ip_set_forwarded_ip_config", value)
+    @position.setter
+    def position(self, value: pulumi.Input[str]):
+        pulumi.set(self, "position", value)
 
 
 @pulumi.input_type
-class WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfigArgs:
+class WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs:
     def __init__(__self__, *,
-                 fallback_behavior: pulumi.Input[str],
-                 header_name: pulumi.Input[str],
-                 position: pulumi.Input[str]):
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
         """
-        :param pulumi.Input[str] fallback_behavior: - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
-        :param pulumi.Input[str] header_name: - The name of the HTTP header to use for the IP address.
-        :param pulumi.Input[str] position: - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
         """
-        pulumi.set(__self__, "fallback_behavior", fallback_behavior)
-        pulumi.set(__self__, "header_name", header_name)
-        pulumi.set(__self__, "position", position)
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
 
     @property
-    @pulumi.getter(name="fallbackBehavior")
-    def fallback_behavior(self) -> pulumi.Input[str]:
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
         """
-        - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+        The string to match against.
         """
-        return pulumi.get(self, "fallback_behavior")
+        return pulumi.get(self, "key")
 
-    @fallback_behavior.setter
-    def fallback_behavior(self, value: pulumi.Input[str]):
-        pulumi.set(self, "fallback_behavior", value)
-
-    @property
-    @pulumi.getter(name="headerName")
-    def header_name(self) -> pulumi.Input[str]:
-        """
-        - The name of the HTTP header to use for the IP address.
-        """
-        return pulumi.get(self, "header_name")
-
-    @header_name.setter
-    def header_name(self, value: pulumi.Input[str]):
-        pulumi.set(self, "header_name", value)
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
 
     @property
     @pulumi.getter
-    def position(self) -> pulumi.Input[str]:
+    def scope(self) -> pulumi.Input[str]:
         """
-        - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
         """
-        return pulumi.get(self, "position")
+        return pulumi.get(self, "scope")
 
-    @position.setter
-    def position(self, value: pulumi.Input[str]):
-        pulumi.set(self, "position", value)
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
 
 
 @pulumi.input_type
@@ -127323,6 +131397,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -127334,6 +131409,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -127349,6 +131425,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -127410,6 +131488,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementArgs']]:
@@ -127511,6 +131601,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -127519,6 +131610,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -127530,6 +131622,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -127575,6 +131669,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -128087,6 +132193,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -129667,6 +133810,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -129695,6 +133875,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -129703,6 +133884,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -129714,6 +133896,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -129759,6 +133943,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -130271,6 +134467,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -131416,6 +135649,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -131424,6 +135658,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -131435,6 +135670,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -131480,6 +135717,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -131992,6 +136241,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -134255,6 +138541,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  not_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementArgs']] = None,
                  or_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
@@ -134266,6 +138553,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementArgs'] not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementArgs'] or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -134281,6 +138569,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -134342,6 +138632,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementArgs']]:
@@ -134443,6 +138745,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs']] = None,
@@ -134451,6 +138754,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -134462,6 +138766,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -134507,6 +138813,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -135019,6 +139337,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -136599,6 +140954,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementArgs:
     def __init__(__self__, *,
@@ -136627,6 +141019,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs']] = None,
@@ -136635,6 +141028,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -136646,6 +141040,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -136691,6 +141087,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -137203,6 +141611,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
@@ -138348,6 +142793,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs']] = None,
                  geo_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs']] = None,
                  ip_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']] = None,
+                 label_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']] = None,
                  regex_pattern_set_reference_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']] = None,
                  size_constraint_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs']] = None,
                  sqli_match_statement: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs']] = None,
@@ -138356,6 +142802,7 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs'] byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs'] geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs'] ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs'] label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs'] regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs'] size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs'] sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -138367,6 +142814,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -138412,6 +142861,18 @@ def ip_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStateme
     def ip_set_reference_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs']]):
         pulumi.set(self, "ip_set_reference_statement", value)
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
+    @label_match_statement.setter
+    def label_match_statement(self, value: Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs']]):
+        pulumi.set(self, "label_match_statement", value)
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional[pulumi.Input['WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs']]:
@@ -138924,6 +143385,43 @@ def position(self, value: pulumi.Input[str]):
         pulumi.set(self, "position", value)
 
 
+@pulumi.input_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[str],
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] key: The string to match against.
+        :param pulumi.Input[str] scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[str]:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @key.setter
+    def key(self, value: pulumi.Input[str]):
+        pulumi.set(self, "key", value)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
+
 @pulumi.input_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs:
     def __init__(__self__, *,
diff --git a/sdk/python/pulumi_aws/wafv2/outputs.py b/sdk/python/pulumi_aws/wafv2/outputs.py
index c58d881783c..062ef671288 100644
--- a/sdk/python/pulumi_aws/wafv2/outputs.py
+++ b/sdk/python/pulumi_aws/wafv2/outputs.py
@@ -11,6 +11,7 @@
 
 __all__ = [
     'RegexPatternSetRegularExpression',
+    'RuleGroupCustomResponseBody',
     'RuleGroupRule',
     'RuleGroupRuleAction',
     'RuleGroupRuleActionAllow',
@@ -22,6 +23,7 @@
     'RuleGroupRuleActionCount',
     'RuleGroupRuleActionCountCustomRequestHandling',
     'RuleGroupRuleActionCountCustomRequestHandlingInsertHeader',
+    'RuleGroupRuleRuleLabel',
     'RuleGroupRuleStatement',
     'RuleGroupRuleStatementAndStatement',
     'RuleGroupRuleStatementAndStatementStatement',
@@ -41,6 +43,7 @@
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -95,6 +98,7 @@
     'RuleGroupRuleStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementAndStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementAndStatementStatementNotStatement',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatement',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementByteMatchStatement',
@@ -111,6 +115,7 @@
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -167,6 +172,7 @@
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -261,6 +267,7 @@
     'RuleGroupRuleStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementLabelMatchStatement',
     'RuleGroupRuleStatementNotStatement',
     'RuleGroupRuleStatementNotStatementStatement',
     'RuleGroupRuleStatementNotStatementStatementAndStatement',
@@ -279,6 +286,7 @@
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -333,6 +341,7 @@
     'RuleGroupRuleStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementNotStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementNotStatementStatementNotStatement',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatement',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementByteMatchStatement',
@@ -349,6 +358,7 @@
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -405,6 +415,7 @@
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -503,6 +514,7 @@
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -557,6 +569,7 @@
     'RuleGroupRuleStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementOrStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementOrStatementStatementNotStatement',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatement',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementByteMatchStatement',
@@ -573,6 +586,7 @@
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -629,6 +643,7 @@
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -751,6 +766,7 @@
     'RuleGroupRuleStatementXssMatchStatementTextTransformation',
     'RuleGroupRuleVisibilityConfig',
     'RuleGroupVisibilityConfig',
+    'WebAclCustomResponseBody',
     'WebAclDefaultAction',
     'WebAclDefaultActionAllow',
     'WebAclDefaultActionAllowCustomRequestHandling',
@@ -785,6 +801,7 @@
     'WebAclRuleOverrideAction',
     'WebAclRuleOverrideActionCount',
     'WebAclRuleOverrideActionNone',
+    'WebAclRuleRuleLabel',
     'WebAclRuleStatement',
     'WebAclRuleStatementAndStatement',
     'WebAclRuleStatementAndStatementStatement',
@@ -806,6 +823,7 @@
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -860,6 +878,7 @@
     'WebAclRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementByteMatchStatement',
@@ -876,6 +895,7 @@
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -932,6 +952,7 @@
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1026,6 +1047,7 @@
     'WebAclRuleStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementNotStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatement',
@@ -1044,6 +1066,7 @@
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1098,6 +1121,7 @@
     'WebAclRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementByteMatchStatement',
@@ -1114,6 +1138,7 @@
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1170,6 +1195,7 @@
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1268,6 +1294,7 @@
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1322,6 +1349,7 @@
     'WebAclRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementByteMatchStatement',
@@ -1338,6 +1366,7 @@
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1394,6 +1423,7 @@
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1528,6 +1558,7 @@
     'WebAclRuleStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementIpSetReferenceStatement',
     'WebAclRuleStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatement',
     'WebAclRuleStatementManagedRuleGroupStatementExcludedRule',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement',
@@ -1549,6 +1580,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1603,6 +1635,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatement',
@@ -1619,6 +1652,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1675,6 +1709,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1769,6 +1804,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatement',
@@ -1787,6 +1823,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1841,6 +1878,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatement',
@@ -1857,6 +1895,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -1913,6 +1952,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2011,6 +2051,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2065,6 +2106,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatement',
@@ -2081,6 +2123,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2137,6 +2180,7 @@
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2277,6 +2321,7 @@
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2331,6 +2376,7 @@
     'WebAclRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementByteMatchStatement',
@@ -2347,6 +2393,7 @@
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2403,6 +2450,7 @@
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2497,6 +2545,7 @@
     'WebAclRuleStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementNotStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatement',
@@ -2515,6 +2564,7 @@
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2569,6 +2619,7 @@
     'WebAclRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementByteMatchStatement',
@@ -2585,6 +2636,7 @@
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2641,6 +2693,7 @@
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2739,6 +2792,7 @@
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2793,6 +2847,7 @@
     'WebAclRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementByteMatchStatement',
@@ -2809,6 +2864,7 @@
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -2865,6 +2921,7 @@
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3005,6 +3062,7 @@
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3059,6 +3117,7 @@
     'WebAclRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementByteMatchStatement',
@@ -3075,6 +3134,7 @@
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3131,6 +3191,7 @@
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3225,6 +3286,7 @@
     'WebAclRuleStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementNotStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatement',
@@ -3243,6 +3305,7 @@
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3297,6 +3360,7 @@
     'WebAclRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementByteMatchStatement',
@@ -3313,6 +3377,7 @@
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3369,6 +3434,7 @@
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3467,6 +3533,7 @@
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3521,6 +3588,7 @@
     'WebAclRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementByteMatchStatement',
@@ -3537,6 +3605,7 @@
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3593,6 +3662,7 @@
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3734,6 +3804,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3788,6 +3859,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatement',
@@ -3804,6 +3876,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3860,6 +3933,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -3954,6 +4028,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatement',
@@ -3972,6 +4047,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -4026,6 +4102,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatement',
@@ -4042,6 +4119,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -4098,6 +4176,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -4196,6 +4275,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -4250,6 +4330,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatement',
@@ -4266,6 +4347,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -4322,6 +4404,7 @@
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementForwardedIpConfig',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementIpSetForwardedIpConfig',
+    'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch',
     'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchAllQueryArguments',
@@ -4524,6 +4607,63 @@ def regex_string(self) -> str:
         return pulumi.get(self, "regex_string")
 
 
+@pulumi.output_type
+class RuleGroupCustomResponseBody(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "contentType":
+            suggest = "content_type"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in RuleGroupCustomResponseBody. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        RuleGroupCustomResponseBody.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        RuleGroupCustomResponseBody.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 content: str,
+                 content_type: str,
+                 key: str):
+        """
+        :param str content: The payload of the custom response.
+        :param str content_type: The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        :param str key: A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        """
+        pulumi.set(__self__, "content", content)
+        pulumi.set(__self__, "content_type", content_type)
+        pulumi.set(__self__, "key", key)
+
+    @property
+    @pulumi.getter
+    def content(self) -> str:
+        """
+        The payload of the custom response.
+        """
+        return pulumi.get(self, "content")
+
+    @property
+    @pulumi.getter(name="contentType")
+    def content_type(self) -> str:
+        """
+        The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        """
+        return pulumi.get(self, "content_type")
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        """
+        return pulumi.get(self, "key")
+
+
 @pulumi.output_type
 class RuleGroupRule(dict):
     @staticmethod
@@ -4531,6 +4671,8 @@ def __key_warning(key: str):
         suggest = None
         if key == "visibilityConfig":
             suggest = "visibility_config"
+        elif key == "ruleLabels":
+            suggest = "rule_labels"
 
         if suggest:
             pulumi.log.warn(f"Key '{key}' not found in RuleGroupRule. Access the value via the '{suggest}' property getter instead.")
@@ -4548,19 +4690,23 @@ def __init__(__self__, *,
                  name: str,
                  priority: int,
                  statement: 'outputs.RuleGroupRuleStatement',
-                 visibility_config: 'outputs.RuleGroupRuleVisibilityConfig'):
+                 visibility_config: 'outputs.RuleGroupRuleVisibilityConfig',
+                 rule_labels: Optional[Sequence['outputs.RuleGroupRuleRuleLabel']] = None):
         """
         :param 'RuleGroupRuleActionArgs' action: The action that AWS WAF should take on a web request when it matches the rule's statement. Settings at the `wafv2.WebAcl` level can override the rule action setting. See Action below for details.
         :param str name: A friendly name of the rule.
         :param int priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
         :param 'RuleGroupRuleStatementArgs' statement: The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See Statement below for details.
         :param 'RuleGroupRuleVisibilityConfigArgs' visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
+        :param Sequence['RuleGroupRuleRuleLabelArgs'] rule_labels: Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
         """
         pulumi.set(__self__, "action", action)
         pulumi.set(__self__, "name", name)
         pulumi.set(__self__, "priority", priority)
         pulumi.set(__self__, "statement", statement)
         pulumi.set(__self__, "visibility_config", visibility_config)
+        if rule_labels is not None:
+            pulumi.set(__self__, "rule_labels", rule_labels)
 
     @property
     @pulumi.getter
@@ -4602,6 +4748,14 @@ def visibility_config(self) -> 'outputs.RuleGroupRuleVisibilityConfig':
         """
         return pulumi.get(self, "visibility_config")
 
+    @property
+    @pulumi.getter(name="ruleLabels")
+    def rule_labels(self) -> Optional[Sequence['outputs.RuleGroupRuleRuleLabel']]:
+        """
+        Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        """
+        return pulumi.get(self, "rule_labels")
+
 
 @pulumi.output_type
 class RuleGroupRuleAction(dict):
@@ -4723,7 +4877,7 @@ def __init__(__self__, *,
                  name: str,
                  value: str):
         """
-        :param str name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param str name: The label string.
         :param str value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -4733,7 +4887,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -4789,6 +4943,8 @@ def __key_warning(key: str):
         suggest = None
         if key == "responseCode":
             suggest = "response_code"
+        elif key == "customResponseBodyKey":
+            suggest = "custom_response_body_key"
         elif key == "responseHeaders":
             suggest = "response_headers"
 
@@ -4805,12 +4961,16 @@ def get(self, key: str, default = None) -> Any:
 
     def __init__(__self__, *,
                  response_code: int,
+                 custom_response_body_key: Optional[str] = None,
                  response_headers: Optional[Sequence['outputs.RuleGroupRuleActionBlockCustomResponseResponseHeader']] = None):
         """
         :param int response_code: The HTTP status code to return to the client.
+        :param str custom_response_body_key: References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
         :param Sequence['RuleGroupRuleActionBlockCustomResponseResponseHeaderArgs'] response_headers: The `response_header` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
         """
         pulumi.set(__self__, "response_code", response_code)
+        if custom_response_body_key is not None:
+            pulumi.set(__self__, "custom_response_body_key", custom_response_body_key)
         if response_headers is not None:
             pulumi.set(__self__, "response_headers", response_headers)
 
@@ -4822,6 +4982,14 @@ def response_code(self) -> int:
         """
         return pulumi.get(self, "response_code")
 
+    @property
+    @pulumi.getter(name="customResponseBodyKey")
+    def custom_response_body_key(self) -> Optional[str]:
+        """
+        References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        """
+        return pulumi.get(self, "custom_response_body_key")
+
     @property
     @pulumi.getter(name="responseHeaders")
     def response_headers(self) -> Optional[Sequence['outputs.RuleGroupRuleActionBlockCustomResponseResponseHeader']]:
@@ -4837,7 +5005,7 @@ def __init__(__self__, *,
                  name: str,
                  value: str):
         """
-        :param str name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param str name: The label string.
         :param str value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -4847,7 +5015,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -4937,7 +5105,7 @@ def __init__(__self__, *,
                  name: str,
                  value: str):
         """
-        :param str name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param str name: The label string.
         :param str value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -4947,7 +5115,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -4960,6 +5128,24 @@ def value(self) -> str:
         return pulumi.get(self, "value")
 
 
+@pulumi.output_type
+class RuleGroupRuleRuleLabel(dict):
+    def __init__(__self__, *,
+                 name: str):
+        """
+        :param str name: The label string.
+        """
+        pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        """
+        The label string.
+        """
+        return pulumi.get(self, "name")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatement(dict):
     @staticmethod
@@ -4973,6 +5159,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -5002,6 +5190,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.RuleGroupRuleStatementNotStatement'] = None,
                  or_statement: Optional['outputs.RuleGroupRuleStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementRegexPatternSetReferenceStatement'] = None,
@@ -5013,6 +5202,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'RuleGroupRuleStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -5028,6 +5218,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -5073,6 +5265,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatement']:
@@ -5153,6 +5353,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -5182,6 +5384,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -5193,6 +5396,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -5208,6 +5412,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -5253,6 +5459,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatement']:
@@ -5331,6 +5545,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -5355,6 +5571,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -5363,6 +5580,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -5374,6 +5592,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -5407,6 +5627,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -5929,6 +6157,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -7493,6 +7750,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementAndStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -7522,6 +7808,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -7546,6 +7834,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -7554,6 +7843,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -7565,6 +7855,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -7598,6 +7890,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -8120,6 +8420,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -9224,6 +9553,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -9248,6 +9579,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -9256,6 +9588,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -9267,6 +9600,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -9300,6 +9635,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -9822,6 +10165,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -12461,6 +12833,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -12492,6 +12893,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -12521,6 +12924,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -12532,6 +12936,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -12547,6 +12952,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -12592,6 +12999,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatement']:
@@ -12670,6 +13085,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -12694,6 +13111,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -12702,6 +13120,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -12713,6 +13132,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -12746,6 +13167,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -13268,6 +13697,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -14832,6 +15290,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementNotStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -14861,6 +15348,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -14885,6 +15374,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -14893,6 +15383,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -14904,6 +15395,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -14937,6 +15430,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -15459,6 +15960,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -16563,6 +17093,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -16587,6 +17119,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -16595,6 +17128,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -16606,6 +17140,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -16639,6 +17175,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -17161,6 +17705,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -19342,6 +19915,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -19371,6 +19946,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -19382,6 +19958,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -19397,6 +19974,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -19442,6 +20021,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatement']:
@@ -19520,6 +20107,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -19544,6 +20133,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -19552,6 +20142,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -19563,6 +20154,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -19596,6 +20189,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -20118,6 +20719,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -21682,6 +22312,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementOrStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -21711,6 +22370,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -21735,6 +22396,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -21743,6 +22405,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -21754,6 +22417,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -21787,6 +22452,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -22309,6 +22982,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -23413,6 +24115,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -23437,6 +24141,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -23445,6 +24150,7 @@ def __init__(__self__, *,
         :param 'RuleGroupRuleStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'RuleGroupRuleStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'RuleGroupRuleStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -23456,6 +24162,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -23489,6 +24197,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatement
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -24011,6 +24727,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -27358,6 +28103,63 @@ def sampled_requests_enabled(self) -> bool:
         return pulumi.get(self, "sampled_requests_enabled")
 
 
+@pulumi.output_type
+class WebAclCustomResponseBody(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "contentType":
+            suggest = "content_type"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in WebAclCustomResponseBody. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        WebAclCustomResponseBody.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        WebAclCustomResponseBody.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 content: str,
+                 content_type: str,
+                 key: str):
+        """
+        :param str content: The payload of the custom response.
+        :param str content_type: The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        :param str key: A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        """
+        pulumi.set(__self__, "content", content)
+        pulumi.set(__self__, "content_type", content_type)
+        pulumi.set(__self__, "key", key)
+
+    @property
+    @pulumi.getter
+    def content(self) -> str:
+        """
+        The payload of the custom response.
+        """
+        return pulumi.get(self, "content")
+
+    @property
+    @pulumi.getter(name="contentType")
+    def content_type(self) -> str:
+        """
+        The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+        """
+        return pulumi.get(self, "content_type")
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the Custom Response block.
+        """
+        return pulumi.get(self, "key")
+
+
 @pulumi.output_type
 class WebAclDefaultAction(dict):
     def __init__(__self__, *,
@@ -27466,7 +28268,7 @@ def __init__(__self__, *,
                  name: str,
                  value: str):
         """
-        :param str name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param str name: The label string.
         :param str value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -27476,7 +28278,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -27532,6 +28334,8 @@ def __key_warning(key: str):
         suggest = None
         if key == "responseCode":
             suggest = "response_code"
+        elif key == "customResponseBodyKey":
+            suggest = "custom_response_body_key"
         elif key == "responseHeaders":
             suggest = "response_headers"
 
@@ -27548,12 +28352,16 @@ def get(self, key: str, default = None) -> Any:
 
     def __init__(__self__, *,
                  response_code: int,
+                 custom_response_body_key: Optional[str] = None,
                  response_headers: Optional[Sequence['outputs.WebAclDefaultActionBlockCustomResponseResponseHeader']] = None):
         """
         :param int response_code: The HTTP status code to return to the client.
+        :param str custom_response_body_key: References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
         :param Sequence['WebAclDefaultActionBlockCustomResponseResponseHeaderArgs'] response_headers: The `response_header` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
         """
         pulumi.set(__self__, "response_code", response_code)
+        if custom_response_body_key is not None:
+            pulumi.set(__self__, "custom_response_body_key", custom_response_body_key)
         if response_headers is not None:
             pulumi.set(__self__, "response_headers", response_headers)
 
@@ -27565,6 +28373,14 @@ def response_code(self) -> int:
         """
         return pulumi.get(self, "response_code")
 
+    @property
+    @pulumi.getter(name="customResponseBodyKey")
+    def custom_response_body_key(self) -> Optional[str]:
+        """
+        References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        """
+        return pulumi.get(self, "custom_response_body_key")
+
     @property
     @pulumi.getter(name="responseHeaders")
     def response_headers(self) -> Optional[Sequence['outputs.WebAclDefaultActionBlockCustomResponseResponseHeader']]:
@@ -27580,7 +28396,7 @@ def __init__(__self__, *,
                  name: str,
                  value: str):
         """
-        :param str name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param str name: The label string.
         :param str value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -27590,7 +28406,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -27983,6 +28799,8 @@ def __key_warning(key: str):
             suggest = "visibility_config"
         elif key == "overrideAction":
             suggest = "override_action"
+        elif key == "ruleLabels":
+            suggest = "rule_labels"
 
         if suggest:
             pulumi.log.warn(f"Key '{key}' not found in WebAclRule. Access the value via the '{suggest}' property getter instead.")
@@ -28001,7 +28819,8 @@ def __init__(__self__, *,
                  statement: 'outputs.WebAclRuleStatement',
                  visibility_config: 'outputs.WebAclRuleVisibilityConfig',
                  action: Optional['outputs.WebAclRuleAction'] = None,
-                 override_action: Optional['outputs.WebAclRuleOverrideAction'] = None):
+                 override_action: Optional['outputs.WebAclRuleOverrideAction'] = None,
+                 rule_labels: Optional[Sequence['outputs.WebAclRuleRuleLabel']] = None):
         """
         :param str name: A friendly name of the rule.
         :param int priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
@@ -28009,6 +28828,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleVisibilityConfigArgs' visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
         :param 'WebAclRuleActionArgs' action: The action that AWS WAF should take on a web request when it matches the rule's statement. This is used only for rules whose **statements do not reference a rule group**. See Action below for details.
         :param 'WebAclRuleOverrideActionArgs' override_action: The override action to apply to the rules in a rule group. Used only for rule **statements that reference a rule group**, like `rule_group_reference_statement` and `managed_rule_group_statement`. See Override Action below for details.
+        :param Sequence['WebAclRuleRuleLabelArgs'] rule_labels: Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
         """
         pulumi.set(__self__, "name", name)
         pulumi.set(__self__, "priority", priority)
@@ -28018,6 +28838,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "action", action)
         if override_action is not None:
             pulumi.set(__self__, "override_action", override_action)
+        if rule_labels is not None:
+            pulumi.set(__self__, "rule_labels", rule_labels)
 
     @property
     @pulumi.getter
@@ -28067,6 +28889,14 @@ def override_action(self) -> Optional['outputs.WebAclRuleOverrideAction']:
         """
         return pulumi.get(self, "override_action")
 
+    @property
+    @pulumi.getter(name="ruleLabels")
+    def rule_labels(self) -> Optional[Sequence['outputs.WebAclRuleRuleLabel']]:
+        """
+        Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+        """
+        return pulumi.get(self, "rule_labels")
+
 
 @pulumi.output_type
 class WebAclRuleAction(dict):
@@ -28188,7 +29018,7 @@ def __init__(__self__, *,
                  name: str,
                  value: str):
         """
-        :param str name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param str name: The label string.
         :param str value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -28198,7 +29028,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -28254,6 +29084,8 @@ def __key_warning(key: str):
         suggest = None
         if key == "responseCode":
             suggest = "response_code"
+        elif key == "customResponseBodyKey":
+            suggest = "custom_response_body_key"
         elif key == "responseHeaders":
             suggest = "response_headers"
 
@@ -28270,12 +29102,16 @@ def get(self, key: str, default = None) -> Any:
 
     def __init__(__self__, *,
                  response_code: int,
+                 custom_response_body_key: Optional[str] = None,
                  response_headers: Optional[Sequence['outputs.WebAclRuleActionBlockCustomResponseResponseHeader']] = None):
         """
         :param int response_code: The HTTP status code to return to the client.
+        :param str custom_response_body_key: References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
         :param Sequence['WebAclRuleActionBlockCustomResponseResponseHeaderArgs'] response_headers: The `response_header` blocks used to define the HTTP response headers added to the response. See Custom HTTP Header below for details.
         """
         pulumi.set(__self__, "response_code", response_code)
+        if custom_response_body_key is not None:
+            pulumi.set(__self__, "custom_response_body_key", custom_response_body_key)
         if response_headers is not None:
             pulumi.set(__self__, "response_headers", response_headers)
 
@@ -28287,6 +29123,14 @@ def response_code(self) -> int:
         """
         return pulumi.get(self, "response_code")
 
+    @property
+    @pulumi.getter(name="customResponseBodyKey")
+    def custom_response_body_key(self) -> Optional[str]:
+        """
+        References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+        """
+        return pulumi.get(self, "custom_response_body_key")
+
     @property
     @pulumi.getter(name="responseHeaders")
     def response_headers(self) -> Optional[Sequence['outputs.WebAclRuleActionBlockCustomResponseResponseHeader']]:
@@ -28302,7 +29146,7 @@ def __init__(__self__, *,
                  name: str,
                  value: str):
         """
-        :param str name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param str name: The label string.
         :param str value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -28312,7 +29156,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -28402,7 +29246,7 @@ def __init__(__self__, *,
                  name: str,
                  value: str):
         """
-        :param str name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param str name: The label string.
         :param str value: The value of the custom header.
         """
         pulumi.set(__self__, "name", name)
@@ -28412,7 +29256,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> str:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -28468,6 +29312,24 @@ def __init__(__self__):
         pass
 
 
+@pulumi.output_type
+class WebAclRuleRuleLabel(dict):
+    def __init__(__self__, *,
+                 name: str):
+        """
+        :param str name: The label string.
+        """
+        pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        """
+        The label string.
+        """
+        return pulumi.get(self, "name")
+
+
 @pulumi.output_type
 class WebAclRuleStatement(dict):
     @staticmethod
@@ -28481,6 +29343,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "managedRuleGroupStatement":
             suggest = "managed_rule_group_statement"
         elif key == "notStatement":
@@ -28516,6 +29380,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementLabelMatchStatement'] = None,
                  managed_rule_group_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementOrStatement'] = None,
@@ -28530,6 +29395,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementArgs' managed_rule_group_statement: A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
         :param 'WebAclRuleStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
@@ -28548,6 +29414,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if managed_rule_group_statement is not None:
             pulumi.set(__self__, "managed_rule_group_statement", managed_rule_group_statement)
         if not_statement is not None:
@@ -28599,6 +29467,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementIpS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="managedRuleGroupStatement")
     def managed_rule_group_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatement']:
@@ -28703,6 +29579,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -28732,6 +29610,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -28743,6 +29622,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -28758,6 +29638,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -28803,6 +29685,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatement']:
@@ -28883,6 +29773,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -28912,6 +29804,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -28923,6 +29816,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -28938,6 +29832,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -28983,6 +29879,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement']:
@@ -29061,6 +29965,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -29085,6 +29991,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -29093,6 +30000,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -29104,6 +30012,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -29137,6 +30047,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -29659,6 +30577,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -31223,6 +32170,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -31252,6 +32228,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -31276,6 +32254,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -31284,6 +32263,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -31295,6 +32275,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -31328,6 +32310,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -31850,6 +32840,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -32954,6 +33973,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -32978,6 +33999,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -32986,6 +34008,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -32997,6 +34020,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -33030,6 +34055,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -33552,6 +34585,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -36191,6 +37253,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -36222,6 +37313,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -36251,6 +37344,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -36262,6 +37356,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -36277,6 +37372,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -36322,6 +37419,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement']:
@@ -36400,6 +37505,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -36424,6 +37531,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -36432,6 +37540,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -36443,6 +37552,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -36476,6 +37587,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -36998,6 +38117,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -38562,6 +39710,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -38591,6 +39768,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -38615,6 +39794,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -38623,6 +39803,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -38634,6 +39815,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -38667,6 +39850,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -39189,6 +40380,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -40293,6 +41513,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -40317,6 +41539,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -40325,6 +41548,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -40336,6 +41560,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -40369,6 +41595,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -40891,6 +42125,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -43072,6 +44335,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -43101,6 +44366,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -43112,6 +44378,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -43127,6 +44394,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -43172,6 +44441,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement']:
@@ -43250,6 +44527,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -43274,6 +44553,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -43282,6 +44562,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -43293,6 +44574,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -43326,6 +44609,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -43848,6 +45139,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -45412,6 +46732,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -45441,6 +46790,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -45465,6 +46816,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -45473,6 +46825,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -45484,6 +46837,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -45517,6 +46872,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -46039,6 +47402,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -47143,6 +48535,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -47167,6 +48561,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -47175,6 +48570,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -47186,6 +48582,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -47219,6 +48617,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAnd
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -47741,6 +49147,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -51455,6 +52890,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatement(dict):
     @staticmethod
@@ -51560,6 +53024,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -51589,6 +53055,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementRegexPatternSetReferenceStatement'] = None,
@@ -51600,6 +53067,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -51615,6 +53083,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -51660,6 +53130,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement']:
@@ -51740,6 +53218,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -51769,6 +53249,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -51780,6 +53261,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -51795,6 +53277,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -51840,6 +53324,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement']:
@@ -51918,6 +53410,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -51942,6 +53436,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -51950,6 +53445,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -51961,6 +53457,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -51994,6 +53492,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -52516,6 +54022,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -54080,6 +55615,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -54109,6 +55673,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -54133,6 +55699,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -54141,6 +55708,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -54152,6 +55720,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -54185,6 +55755,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -54707,6 +56285,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -55811,6 +57418,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -55835,6 +57444,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -55843,6 +57453,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -55854,6 +57465,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -55887,6 +57500,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -56409,6 +58030,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -59048,6 +60698,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -59079,6 +60758,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -59108,6 +60789,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -59119,6 +60801,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -59134,6 +60817,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -59179,6 +60864,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement']:
@@ -59257,6 +60950,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -59281,6 +60976,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -59289,6 +60985,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -59300,6 +60997,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -59333,6 +61032,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -59855,6 +61562,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -61419,6 +63155,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -61448,6 +63213,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -61472,6 +63239,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -61480,6 +63248,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -61491,6 +63260,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -61524,6 +63295,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -62046,6 +63825,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -63150,6 +64958,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -63174,6 +64984,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -63182,6 +64993,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -63193,6 +65005,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -63226,6 +65040,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -63748,6 +65570,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -65929,6 +67780,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -65958,6 +67811,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -65969,6 +67823,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -65984,6 +67839,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -66029,6 +67886,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement']:
@@ -66107,6 +67972,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -66131,6 +67998,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -66139,6 +68007,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -66150,6 +68019,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -66183,6 +68054,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -66705,6 +68584,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -68269,6 +70177,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -68298,6 +70235,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -68322,6 +70261,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -68330,6 +70270,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -68341,6 +70282,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -68374,6 +70317,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -68896,6 +70847,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -70000,6 +71980,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -70024,6 +72006,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -70032,6 +72015,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -70043,6 +72027,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -70076,6 +72062,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementMan
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -70598,6 +72592,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -73854,6 +75877,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -73883,6 +75908,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -73894,6 +75920,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -73909,6 +75936,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -73954,6 +75983,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatement']:
@@ -74034,6 +76071,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -74063,6 +76102,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -74074,6 +76114,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -74089,6 +76130,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -74134,6 +76177,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement']:
@@ -74212,6 +76263,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -74236,6 +76289,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -74244,6 +76298,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -74255,6 +76310,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -74288,6 +76345,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -74810,6 +76875,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -76374,6 +78468,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -76403,6 +78526,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -76427,6 +78552,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -76435,6 +78561,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -76446,6 +78573,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -76479,6 +78608,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -77001,6 +79138,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -78105,6 +80271,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -78129,6 +80297,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -78137,6 +80306,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -78148,6 +80318,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -78181,6 +80353,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -78703,6 +80883,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -81342,6 +83551,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -81373,6 +83611,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -81402,6 +83642,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -81413,6 +83654,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -81428,6 +83670,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -81473,6 +83717,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement']:
@@ -81551,6 +83803,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -81575,6 +83829,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -81583,6 +83838,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -81594,6 +83850,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -81627,6 +83885,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -82149,6 +84415,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -83713,6 +86008,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -83742,6 +86066,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -83766,6 +86092,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -83774,6 +86101,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -83785,6 +86113,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -83818,6 +86148,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -84340,6 +86678,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -85444,6 +87811,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -85468,6 +87837,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -85476,6 +87846,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -85487,6 +87858,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -85520,6 +87893,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -86042,6 +88423,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -88223,6 +90633,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -88252,6 +90664,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -88263,6 +90676,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -88278,6 +90692,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -88323,6 +90739,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement']:
@@ -88401,6 +90825,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -88425,6 +90851,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -88433,6 +90860,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -88444,6 +90872,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -88477,6 +90907,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -88999,6 +91437,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -90563,6 +93030,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -90592,6 +93088,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -90616,6 +93114,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -90624,6 +93123,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -90635,6 +93135,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -90668,6 +93170,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -91190,6 +93700,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -92294,6 +94833,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -92318,6 +94859,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -92326,6 +94868,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -92337,6 +94880,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -92370,6 +94915,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNot
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -92892,6 +95445,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -96148,6 +98730,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -96177,6 +98761,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -96188,6 +98773,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -96203,6 +98789,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -96248,6 +98836,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatement']:
@@ -96328,6 +98924,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -96357,6 +98955,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -96368,6 +98967,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -96383,6 +98983,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -96428,6 +99030,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement']:
@@ -96506,6 +99116,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -96530,6 +99142,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -96538,6 +99151,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -96549,6 +99163,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -96582,6 +99198,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -97104,6 +99728,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -98668,6 +101321,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -98697,6 +101379,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -98721,6 +101405,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -98729,6 +101414,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -98740,6 +101426,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -98773,6 +101461,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -99295,6 +101991,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -100399,6 +103124,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -100423,6 +103150,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -100431,6 +103159,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -100442,6 +103171,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -100475,6 +103206,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -100997,6 +103736,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -103636,6 +106404,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -103667,6 +106464,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -103696,6 +106495,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -103707,6 +106507,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -103722,6 +106523,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -103767,6 +106570,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement']:
@@ -103845,6 +106656,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -103869,6 +106682,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -103877,6 +106691,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -103888,6 +106703,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -103921,6 +106738,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -104443,6 +107268,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -106007,6 +108861,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -106036,6 +108919,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -106060,6 +108945,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -106068,6 +108954,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -106079,6 +108966,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -106112,6 +109001,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -106634,6 +109531,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -107738,6 +110664,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -107762,6 +110690,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -107770,6 +110699,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -107781,6 +110711,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -107814,6 +110746,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -108336,6 +111276,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -110517,6 +113486,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -110546,6 +113517,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -110557,6 +113529,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -110572,6 +113545,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -110617,6 +113592,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement']:
@@ -110695,6 +113678,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -110719,6 +113704,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -110727,6 +113713,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -110738,6 +113725,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -110771,6 +113760,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -111293,6 +114290,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -112857,6 +115883,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -112886,6 +115941,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -112910,6 +115967,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -112918,6 +115976,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -112929,6 +115988,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -112962,6 +116023,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -113484,6 +116553,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -114588,6 +117686,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -114612,6 +117712,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -114620,6 +117721,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -114631,6 +117733,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -114664,6 +117768,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrS
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -115186,6 +118298,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -118547,6 +121688,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -118576,6 +121719,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementRegexPatternSetReferenceStatement'] = None,
@@ -118587,6 +121731,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -118602,6 +121747,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -118647,6 +121794,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement']:
@@ -118727,6 +121882,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -118756,6 +121913,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -118767,6 +121925,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -118782,6 +121941,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -118827,6 +121988,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement']:
@@ -118905,6 +122074,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -118929,6 +122100,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -118937,6 +122109,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -118948,6 +122121,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -118981,6 +122156,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -119503,6 +122686,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -121067,6 +124279,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -121096,6 +124337,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -121120,6 +124363,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -121128,6 +124372,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -121139,6 +124384,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -121172,6 +124419,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -121694,6 +124949,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -122798,6 +126082,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -122822,6 +126108,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -122830,6 +126117,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -122841,6 +126129,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -122874,6 +126164,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -123396,6 +126694,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -126035,6 +129362,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -126066,6 +129422,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -126095,6 +129453,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -126106,6 +129465,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -126121,6 +129481,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -126166,6 +129528,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement']:
@@ -126244,6 +129614,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -126268,6 +129640,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -126276,6 +129649,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -126287,6 +129661,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -126320,6 +129696,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -126842,6 +130226,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -128406,6 +131819,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -128435,6 +131877,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -128459,6 +131903,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -128467,6 +131912,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -128478,6 +131924,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -128511,6 +131959,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -129033,6 +132489,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -130137,6 +133622,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -130161,6 +133648,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -130169,6 +133657,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -130180,6 +133669,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -130213,6 +133704,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -130735,6 +134234,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -132916,6 +136444,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "notStatement":
             suggest = "not_statement"
         elif key == "orStatement":
@@ -132945,6 +136475,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement'] = None,
                  not_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement'] = None,
                  or_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
@@ -132956,6 +136487,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementArgs' not_statement: A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementArgs' or_statement: A logical rule statement used to combine other rule statements with OR logic. See OR Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
@@ -132971,6 +136503,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if not_statement is not None:
             pulumi.set(__self__, "not_statement", not_statement)
         if or_statement is not None:
@@ -133016,6 +136550,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="notStatement")
     def not_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement']:
@@ -133094,6 +136636,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -133118,6 +136662,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSqliMatchStatement'] = None,
@@ -133126,6 +136671,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -133137,6 +136683,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -133170,6 +136718,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement']:
@@ -133692,6 +137248,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -135256,6 +138841,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement(dict):
     def __init__(__self__, *,
@@ -135285,6 +138899,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -135309,6 +138925,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSqliMatchStatement'] = None,
@@ -135317,6 +138934,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -135328,6 +138946,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -135361,6 +138981,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement']:
@@ -135883,6 +139511,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
@@ -136987,6 +140644,8 @@ def __key_warning(key: str):
             suggest = "geo_match_statement"
         elif key == "ipSetReferenceStatement":
             suggest = "ip_set_reference_statement"
+        elif key == "labelMatchStatement":
+            suggest = "label_match_statement"
         elif key == "regexPatternSetReferenceStatement":
             suggest = "regex_pattern_set_reference_statement"
         elif key == "sizeConstraintStatement":
@@ -137011,6 +140670,7 @@ def __init__(__self__, *,
                  byte_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementByteMatchStatement'] = None,
                  geo_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatement'] = None,
                  ip_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement'] = None,
+                 label_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement'] = None,
                  regex_pattern_set_reference_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement'] = None,
                  size_constraint_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatement'] = None,
                  sqli_match_statement: Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSqliMatchStatement'] = None,
@@ -137019,6 +140679,7 @@ def __init__(__self__, *,
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementByteMatchStatementArgs' byte_match_statement: A rule statement that defines a string match search for AWS WAF to apply to web requests. See Byte Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementGeoMatchStatementArgs' geo_match_statement: A rule statement used to identify web requests based on country of origin. See GEO Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatementArgs' ip_set_reference_statement: A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
+        :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatementArgs' label_match_statement: A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatementArgs' regex_pattern_set_reference_statement: A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSizeConstraintStatementArgs' size_constraint_statement: A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See Size Constraint Statement below for more details.
         :param 'WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementSqliMatchStatementArgs' sqli_match_statement: An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See SQL Injection Match Statement below for details.
@@ -137030,6 +140691,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "geo_match_statement", geo_match_statement)
         if ip_set_reference_statement is not None:
             pulumi.set(__self__, "ip_set_reference_statement", ip_set_reference_statement)
+        if label_match_statement is not None:
+            pulumi.set(__self__, "label_match_statement", label_match_statement)
         if regex_pattern_set_reference_statement is not None:
             pulumi.set(__self__, "regex_pattern_set_reference_statement", regex_pattern_set_reference_statement)
         if size_constraint_statement is not None:
@@ -137063,6 +140726,14 @@ def ip_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRat
         """
         return pulumi.get(self, "ip_set_reference_statement")
 
+    @property
+    @pulumi.getter(name="labelMatchStatement")
+    def label_match_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement']:
+        """
+        A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+        """
+        return pulumi.get(self, "label_match_statement")
+
     @property
     @pulumi.getter(name="regexPatternSetReferenceStatement")
     def regex_pattern_set_reference_statement(self) -> Optional['outputs.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement']:
@@ -137585,6 +141256,35 @@ def position(self) -> str:
         return pulumi.get(self, "position")
 
 
+@pulumi.output_type
+class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement(dict):
+    def __init__(__self__, *,
+                 key: str,
+                 scope: str):
+        """
+        :param str key: The string to match against.
+        :param str scope: Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def key(self) -> str:
+        """
+        The string to match against.
+        """
+        return pulumi.get(self, "key")
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement(dict):
     @staticmethod
diff --git a/sdk/python/pulumi_aws/wafv2/rule_group.py b/sdk/python/pulumi_aws/wafv2/rule_group.py
index 8a9cd9d2988..fb40b3f372f 100644
--- a/sdk/python/pulumi_aws/wafv2/rule_group.py
+++ b/sdk/python/pulumi_aws/wafv2/rule_group.py
@@ -18,6 +18,7 @@ def __init__(__self__, *,
                  capacity: pulumi.Input[int],
                  scope: pulumi.Input[str],
                  visibility_config: pulumi.Input['RuleGroupVisibilityConfigArgs'],
+                 custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupCustomResponseBodyArgs']]]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  rules: Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleArgs']]]] = None,
@@ -28,8 +29,9 @@ def __init__(__self__, *,
         :param pulumi.Input[int] capacity: The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
         :param pulumi.Input[str] scope: Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
         :param pulumi.Input['RuleGroupVisibilityConfigArgs'] visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
+        :param pulumi.Input[Sequence[pulumi.Input['RuleGroupCustomResponseBodyArgs']]] custom_response_bodies: Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
         :param pulumi.Input[str] description: A friendly description of the rule group.
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleArgs']]] rules: The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: An array of key:value pairs to associate with the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
@@ -37,6 +39,8 @@ def __init__(__self__, *,
         pulumi.set(__self__, "capacity", capacity)
         pulumi.set(__self__, "scope", scope)
         pulumi.set(__self__, "visibility_config", visibility_config)
+        if custom_response_bodies is not None:
+            pulumi.set(__self__, "custom_response_bodies", custom_response_bodies)
         if description is not None:
             pulumi.set(__self__, "description", description)
         if name is not None:
@@ -84,6 +88,18 @@ def visibility_config(self) -> pulumi.Input['RuleGroupVisibilityConfigArgs']:
     def visibility_config(self, value: pulumi.Input['RuleGroupVisibilityConfigArgs']):
         pulumi.set(self, "visibility_config", value)
 
+    @property
+    @pulumi.getter(name="customResponseBodies")
+    def custom_response_bodies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupCustomResponseBodyArgs']]]]:
+        """
+        Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        """
+        return pulumi.get(self, "custom_response_bodies")
+
+    @custom_response_bodies.setter
+    def custom_response_bodies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupCustomResponseBodyArgs']]]]):
+        pulumi.set(self, "custom_response_bodies", value)
+
     @property
     @pulumi.getter
     def description(self) -> Optional[pulumi.Input[str]]:
@@ -100,7 +116,7 @@ def description(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -150,6 +166,7 @@ class _RuleGroupState:
     def __init__(__self__, *,
                  arn: Optional[pulumi.Input[str]] = None,
                  capacity: Optional[pulumi.Input[int]] = None,
+                 custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupCustomResponseBodyArgs']]]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  lock_token: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -162,8 +179,9 @@ def __init__(__self__, *,
         Input properties used for looking up and filtering RuleGroup resources.
         :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
         :param pulumi.Input[int] capacity: The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
+        :param pulumi.Input[Sequence[pulumi.Input['RuleGroupCustomResponseBodyArgs']]] custom_response_bodies: Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
         :param pulumi.Input[str] description: A friendly description of the rule group.
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[Sequence[pulumi.Input['RuleGroupRuleArgs']]] rules: The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
         :param pulumi.Input[str] scope: Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: An array of key:value pairs to associate with the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
@@ -174,6 +192,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "arn", arn)
         if capacity is not None:
             pulumi.set(__self__, "capacity", capacity)
+        if custom_response_bodies is not None:
+            pulumi.set(__self__, "custom_response_bodies", custom_response_bodies)
         if description is not None:
             pulumi.set(__self__, "description", description)
         if lock_token is not None:
@@ -215,6 +235,18 @@ def capacity(self) -> Optional[pulumi.Input[int]]:
     def capacity(self, value: Optional[pulumi.Input[int]]):
         pulumi.set(self, "capacity", value)
 
+    @property
+    @pulumi.getter(name="customResponseBodies")
+    def custom_response_bodies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupCustomResponseBodyArgs']]]]:
+        """
+        Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        """
+        return pulumi.get(self, "custom_response_bodies")
+
+    @custom_response_bodies.setter
+    def custom_response_bodies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['RuleGroupCustomResponseBodyArgs']]]]):
+        pulumi.set(self, "custom_response_bodies", value)
+
     @property
     @pulumi.getter
     def description(self) -> Optional[pulumi.Input[str]]:
@@ -240,7 +272,7 @@ def lock_token(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -315,6 +347,7 @@ def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  capacity: Optional[pulumi.Input[int]] = None,
+                 custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupCustomResponseBodyArgs']]]]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  rules: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupRuleArgs']]]]] = None,
@@ -568,8 +601,9 @@ def __init__(__self__,
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[int] capacity: The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupCustomResponseBodyArgs']]]] custom_response_bodies: Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
         :param pulumi.Input[str] description: A friendly description of the rule group.
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupRuleArgs']]]] rules: The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
         :param pulumi.Input[str] scope: Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: An array of key:value pairs to associate with the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
@@ -840,6 +874,7 @@ def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  capacity: Optional[pulumi.Input[int]] = None,
+                 custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupCustomResponseBodyArgs']]]]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  rules: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupRuleArgs']]]]] = None,
@@ -862,6 +897,7 @@ def _internal_init(__self__,
             if capacity is None and not opts.urn:
                 raise TypeError("Missing required property 'capacity'")
             __props__.__dict__["capacity"] = capacity
+            __props__.__dict__["custom_response_bodies"] = custom_response_bodies
             __props__.__dict__["description"] = description
             __props__.__dict__["name"] = name
             __props__.__dict__["rules"] = rules
@@ -887,6 +923,7 @@ def get(resource_name: str,
             opts: Optional[pulumi.ResourceOptions] = None,
             arn: Optional[pulumi.Input[str]] = None,
             capacity: Optional[pulumi.Input[int]] = None,
+            custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupCustomResponseBodyArgs']]]]] = None,
             description: Optional[pulumi.Input[str]] = None,
             lock_token: Optional[pulumi.Input[str]] = None,
             name: Optional[pulumi.Input[str]] = None,
@@ -904,8 +941,9 @@ def get(resource_name: str,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
         :param pulumi.Input[int] capacity: The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupCustomResponseBodyArgs']]]] custom_response_bodies: Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
         :param pulumi.Input[str] description: A friendly description of the rule group.
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleGroupRuleArgs']]]] rules: The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
         :param pulumi.Input[str] scope: Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: An array of key:value pairs to associate with the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
@@ -918,6 +956,7 @@ def get(resource_name: str,
 
         __props__.__dict__["arn"] = arn
         __props__.__dict__["capacity"] = capacity
+        __props__.__dict__["custom_response_bodies"] = custom_response_bodies
         __props__.__dict__["description"] = description
         __props__.__dict__["lock_token"] = lock_token
         __props__.__dict__["name"] = name
@@ -944,6 +983,14 @@ def capacity(self) -> pulumi.Output[int]:
         """
         return pulumi.get(self, "capacity")
 
+    @property
+    @pulumi.getter(name="customResponseBodies")
+    def custom_response_bodies(self) -> pulumi.Output[Optional[Sequence['outputs.RuleGroupCustomResponseBody']]]:
+        """
+        Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        """
+        return pulumi.get(self, "custom_response_bodies")
+
     @property
     @pulumi.getter
     def description(self) -> pulumi.Output[Optional[str]]:
@@ -961,7 +1008,7 @@ def lock_token(self) -> pulumi.Output[str]:
     @pulumi.getter
     def name(self) -> pulumi.Output[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
diff --git a/sdk/python/pulumi_aws/wafv2/web_acl.py b/sdk/python/pulumi_aws/wafv2/web_acl.py
index 7852a2fd5f6..e897b7fdbe8 100644
--- a/sdk/python/pulumi_aws/wafv2/web_acl.py
+++ b/sdk/python/pulumi_aws/wafv2/web_acl.py
@@ -18,6 +18,7 @@ def __init__(__self__, *,
                  default_action: pulumi.Input['WebAclDefaultActionArgs'],
                  scope: pulumi.Input[str],
                  visibility_config: pulumi.Input['WebAclVisibilityConfigArgs'],
+                 custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclCustomResponseBodyArgs']]]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  rules: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclRuleArgs']]]] = None,
@@ -28,8 +29,9 @@ def __init__(__self__, *,
         :param pulumi.Input['WebAclDefaultActionArgs'] default_action: The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
         :param pulumi.Input[str] scope: Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
         :param pulumi.Input['WebAclVisibilityConfigArgs'] visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. See Visibility Configuration below for details.
+        :param pulumi.Input[Sequence[pulumi.Input['WebAclCustomResponseBodyArgs']]] custom_response_bodies: Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
         :param pulumi.Input[str] description: A friendly description of the WebACL.
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[Sequence[pulumi.Input['WebAclRuleArgs']]] rules: The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: An map of key:value pairs to associate with the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags_all: A map of tags assigned to the resource, including those inherited from the provider .
@@ -37,6 +39,8 @@ def __init__(__self__, *,
         pulumi.set(__self__, "default_action", default_action)
         pulumi.set(__self__, "scope", scope)
         pulumi.set(__self__, "visibility_config", visibility_config)
+        if custom_response_bodies is not None:
+            pulumi.set(__self__, "custom_response_bodies", custom_response_bodies)
         if description is not None:
             pulumi.set(__self__, "description", description)
         if name is not None:
@@ -84,6 +88,18 @@ def visibility_config(self) -> pulumi.Input['WebAclVisibilityConfigArgs']:
     def visibility_config(self, value: pulumi.Input['WebAclVisibilityConfigArgs']):
         pulumi.set(self, "visibility_config", value)
 
+    @property
+    @pulumi.getter(name="customResponseBodies")
+    def custom_response_bodies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['WebAclCustomResponseBodyArgs']]]]:
+        """
+        Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        """
+        return pulumi.get(self, "custom_response_bodies")
+
+    @custom_response_bodies.setter
+    def custom_response_bodies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclCustomResponseBodyArgs']]]]):
+        pulumi.set(self, "custom_response_bodies", value)
+
     @property
     @pulumi.getter
     def description(self) -> Optional[pulumi.Input[str]]:
@@ -100,7 +116,7 @@ def description(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -150,6 +166,7 @@ class _WebAclState:
     def __init__(__self__, *,
                  arn: Optional[pulumi.Input[str]] = None,
                  capacity: Optional[pulumi.Input[int]] = None,
+                 custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclCustomResponseBodyArgs']]]] = None,
                  default_action: Optional[pulumi.Input['WebAclDefaultActionArgs']] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  lock_token: Optional[pulumi.Input[str]] = None,
@@ -163,9 +180,10 @@ def __init__(__self__, *,
         Input properties used for looking up and filtering WebAcl resources.
         :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
         :param pulumi.Input[int] capacity: The web ACL capacity units (WCUs) currently being used by this web ACL.
+        :param pulumi.Input[Sequence[pulumi.Input['WebAclCustomResponseBodyArgs']]] custom_response_bodies: Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
         :param pulumi.Input['WebAclDefaultActionArgs'] default_action: The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
         :param pulumi.Input[str] description: A friendly description of the WebACL.
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[Sequence[pulumi.Input['WebAclRuleArgs']]] rules: The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
         :param pulumi.Input[str] scope: Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: An map of key:value pairs to associate with the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
@@ -176,6 +194,8 @@ def __init__(__self__, *,
             pulumi.set(__self__, "arn", arn)
         if capacity is not None:
             pulumi.set(__self__, "capacity", capacity)
+        if custom_response_bodies is not None:
+            pulumi.set(__self__, "custom_response_bodies", custom_response_bodies)
         if default_action is not None:
             pulumi.set(__self__, "default_action", default_action)
         if description is not None:
@@ -219,6 +239,18 @@ def capacity(self) -> Optional[pulumi.Input[int]]:
     def capacity(self, value: Optional[pulumi.Input[int]]):
         pulumi.set(self, "capacity", value)
 
+    @property
+    @pulumi.getter(name="customResponseBodies")
+    def custom_response_bodies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['WebAclCustomResponseBodyArgs']]]]:
+        """
+        Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        """
+        return pulumi.get(self, "custom_response_bodies")
+
+    @custom_response_bodies.setter
+    def custom_response_bodies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['WebAclCustomResponseBodyArgs']]]]):
+        pulumi.set(self, "custom_response_bodies", value)
+
     @property
     @pulumi.getter(name="defaultAction")
     def default_action(self) -> Optional[pulumi.Input['WebAclDefaultActionArgs']]:
@@ -256,7 +288,7 @@ def lock_token(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")
 
@@ -330,6 +362,7 @@ class WebAcl(pulumi.CustomResource):
     def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
+                 custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['WebAclCustomResponseBodyArgs']]]]] = None,
                  default_action: Optional[pulumi.Input[pulumi.InputType['WebAclDefaultActionArgs']]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -402,6 +435,7 @@ def __init__(__self__,
             ))
         ```
         ### Rate Based
+        Rate-limit US and NL-based clients to 10,000 requests for every 5 minutes.
 
         ```python
         import pulumi
@@ -409,12 +443,12 @@ def __init__(__self__,
 
         example = aws.wafv2.WebAcl("example",
             default_action=aws.wafv2.WebAclDefaultActionArgs(
-                block=aws.wafv2.WebAclDefaultActionBlockArgs(),
+                allow=aws.wafv2.WebAclDefaultActionAllowArgs(),
             ),
-            description="Example of a rate based statement.",
+            description="Example of a Cloudfront rate based statement.",
             rules=[aws.wafv2.WebAclRuleArgs(
                 action=aws.wafv2.WebAclRuleActionArgs(
-                    count=aws.wafv2.WebAclRuleActionCountArgs(),
+                    block=aws.wafv2.WebAclRuleActionBlockArgs(),
                 ),
                 name="rule-1",
                 priority=1,
@@ -438,7 +472,7 @@ def __init__(__self__,
                     sampled_requests_enabled=False,
                 ),
             )],
-            scope="REGIONAL",
+            scope="CLOUDFRONT",
             tags={
                 "Tag1": "Value1",
                 "Tag2": "Value2",
@@ -567,9 +601,10 @@ def __init__(__self__,
 
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['WebAclCustomResponseBodyArgs']]]] custom_response_bodies: Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
         :param pulumi.Input[pulumi.InputType['WebAclDefaultActionArgs']] default_action: The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
         :param pulumi.Input[str] description: A friendly description of the WebACL.
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['WebAclRuleArgs']]]] rules: The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
         :param pulumi.Input[str] scope: Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: An map of key:value pairs to associate with the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
@@ -645,6 +680,7 @@ def __init__(__self__,
             ))
         ```
         ### Rate Based
+        Rate-limit US and NL-based clients to 10,000 requests for every 5 minutes.
 
         ```python
         import pulumi
@@ -652,12 +688,12 @@ def __init__(__self__,
 
         example = aws.wafv2.WebAcl("example",
             default_action=aws.wafv2.WebAclDefaultActionArgs(
-                block=aws.wafv2.WebAclDefaultActionBlockArgs(),
+                allow=aws.wafv2.WebAclDefaultActionAllowArgs(),
             ),
-            description="Example of a rate based statement.",
+            description="Example of a Cloudfront rate based statement.",
             rules=[aws.wafv2.WebAclRuleArgs(
                 action=aws.wafv2.WebAclRuleActionArgs(
-                    count=aws.wafv2.WebAclRuleActionCountArgs(),
+                    block=aws.wafv2.WebAclRuleActionBlockArgs(),
                 ),
                 name="rule-1",
                 priority=1,
@@ -681,7 +717,7 @@ def __init__(__self__,
                     sampled_requests_enabled=False,
                 ),
             )],
-            scope="REGIONAL",
+            scope="CLOUDFRONT",
             tags={
                 "Tag1": "Value1",
                 "Tag2": "Value2",
@@ -823,6 +859,7 @@ def __init__(__self__, resource_name: str, *args, **kwargs):
     def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
+                 custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['WebAclCustomResponseBodyArgs']]]]] = None,
                  default_action: Optional[pulumi.Input[pulumi.InputType['WebAclDefaultActionArgs']]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -843,6 +880,7 @@ def _internal_init(__self__,
                 raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
             __props__ = WebAclArgs.__new__(WebAclArgs)
 
+            __props__.__dict__["custom_response_bodies"] = custom_response_bodies
             if default_action is None and not opts.urn:
                 raise TypeError("Missing required property 'default_action'")
             __props__.__dict__["default_action"] = default_action
@@ -872,6 +910,7 @@ def get(resource_name: str,
             opts: Optional[pulumi.ResourceOptions] = None,
             arn: Optional[pulumi.Input[str]] = None,
             capacity: Optional[pulumi.Input[int]] = None,
+            custom_response_bodies: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['WebAclCustomResponseBodyArgs']]]]] = None,
             default_action: Optional[pulumi.Input[pulumi.InputType['WebAclDefaultActionArgs']]] = None,
             description: Optional[pulumi.Input[str]] = None,
             lock_token: Optional[pulumi.Input[str]] = None,
@@ -890,9 +929,10 @@ def get(resource_name: str,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) of the IP Set that this statement references.
         :param pulumi.Input[int] capacity: The web ACL capacity units (WCUs) currently being used by this web ACL.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['WebAclCustomResponseBodyArgs']]]] custom_response_bodies: Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
         :param pulumi.Input[pulumi.InputType['WebAclDefaultActionArgs']] default_action: The action to perform if none of the `rules` contained in the WebACL match. See Default Action below for details.
         :param pulumi.Input[str] description: A friendly description of the WebACL.
-        :param pulumi.Input[str] name: The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        :param pulumi.Input[str] name: The label string.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['WebAclRuleArgs']]]] rules: The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See Rules below for details.
         :param pulumi.Input[str] scope: Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: An map of key:value pairs to associate with the resource. .If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
@@ -905,6 +945,7 @@ def get(resource_name: str,
 
         __props__.__dict__["arn"] = arn
         __props__.__dict__["capacity"] = capacity
+        __props__.__dict__["custom_response_bodies"] = custom_response_bodies
         __props__.__dict__["default_action"] = default_action
         __props__.__dict__["description"] = description
         __props__.__dict__["lock_token"] = lock_token
@@ -932,6 +973,14 @@ def capacity(self) -> pulumi.Output[int]:
         """
         return pulumi.get(self, "capacity")
 
+    @property
+    @pulumi.getter(name="customResponseBodies")
+    def custom_response_bodies(self) -> pulumi.Output[Optional[Sequence['outputs.WebAclCustomResponseBody']]]:
+        """
+        Defines custom response bodies that can be referenced by `custom_response` actions. See Custom Response Body below for details.
+        """
+        return pulumi.get(self, "custom_response_bodies")
+
     @property
     @pulumi.getter(name="defaultAction")
     def default_action(self) -> pulumi.Output['outputs.WebAclDefaultAction']:
@@ -957,7 +1006,7 @@ def lock_token(self) -> pulumi.Output[str]:
     @pulumi.getter
     def name(self) -> pulumi.Output[str]:
         """
-        The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+        The label string.
         """
         return pulumi.get(self, "name")