Source file values.ml

(* generated by: awso-codegen generate-all --botocore-data vendor/botocore/botocore/data -o aws --runtime-dir lib/runtime/awso --cli-dir awso-cli *)
open Awso
open! Import
[@@@warning "-32"]
let service = Service.guardduty
let apiVersion = "2017-11-28"
let endpointPrefix = "guardduty"
let serviceFullName = "Amazon GuardDuty"
let signatureVersion = "v4"
let protocol = "rest_json"
let globalEndpoint = endpointPrefix ^ ".amazonaws.com"
let simple_to_json to_value x =
  Botodata.Json.value_to_json_scalar (to_value x)
let composed_to_json to_value x = Botodata.Json.value_to_json (to_value x)
let to_query to_value x = Client.Query.of_value (to_value x)
let structure_to_value_aux st ~f =
  let filter = function | (k, Some v) -> Some (k, v) | _ -> None in
  let pair k v = (k, v) in
  let defer_value (k, dv) = pair k dv in
  ((List.filter_map st ~f:filter) |> (List.map ~f:defer_value)) |>
    (fun x -> `Structure (f x))
let structure_to_value = structure_to_value_aux ~f:Fn.id
let structure_to_wrapped_value ~wrapper ~response =
  structure_to_value_aux
    ~f:(fun x -> [(wrapper, (`Structure x)); (response, (`Structure []))])
module String_ =
  struct
    type nonrec t = string
    let context_ = "String"
    let make i = i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"String" j
    let to_json = simple_to_json to_value
  end
module SensitiveString =
  struct
    type nonrec t = string
    let context_ = "SensitiveString"
    let make i = i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"SensitiveString" j
    let to_json = simple_to_json to_value
  end
module ObservationTexts =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"ObservationTexts" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module Ec2InstanceUid =
  struct
    type nonrec t = string
    let context_ = "Ec2InstanceUid"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:256) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"Ec2InstanceUid" j
    let to_json = simple_to_json to_value
  end
module ProductCode =
  struct
    type nonrec t =
      {
      code: String_.t option [@ocaml.doc "The product code information."];
      productType: String_.t option [@ocaml.doc "The product code type."]}
    let make ?code = fun ?productType -> fun () -> { code; productType }
    let to_value x =
      structure_to_value
        [("productCodeId", (Option.map x.code ~f:String_.to_value));
        ("productCodeType", (Option.map x.productType ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let productType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "productCodeType") in
      let code =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "productCodeId") in
      make ?productType ?code ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let productType = field_map json__ "ProductType" String_.of_json in
      let code = field_map json__ "Code" String_.of_json in
      make ?productType ?code ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the product code for the EC2 instance."]
module PrivateIpAddressDetails =
  struct
    type nonrec t =
      {
      privateDnsName: String_.t option
        [@ocaml.doc "The private DNS name of the EC2 instance."];
      privateIpAddress: SensitiveString.t option
        [@ocaml.doc "The private IP address of the EC2 instance."]}
    let make ?privateDnsName =
      fun ?privateIpAddress -> fun () -> { privateDnsName; privateIpAddress }
    let to_value x =
      structure_to_value
        [("privateDnsName",
           (Option.map x.privateDnsName ~f:String_.to_value));
        ("privateIpAddress",
          (Option.map x.privateIpAddress ~f:SensitiveString.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let privateIpAddress =
        (Option.map ~f:SensitiveString.of_xml)
          (Xml.child xml_arg0 "privateIpAddress") in
      let privateDnsName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "privateDnsName") in
      make ?privateIpAddress ?privateDnsName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let privateIpAddress =
        field_map json__ "PrivateIpAddress" SensitiveString.of_json in
      let privateDnsName = field_map json__ "PrivateDnsName" String_.of_json in
      make ?privateIpAddress ?privateDnsName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains other private IP address information of the EC2 instance."]
module SecurityGroup =
  struct
    type nonrec t =
      {
      groupId: String_.t option
        [@ocaml.doc "The security group ID of the EC2 instance."];
      groupName: String_.t option
        [@ocaml.doc "The security group name of the EC2 instance."]}
    let make ?groupId = fun ?groupName -> fun () -> { groupId; groupName }
    let to_value x =
      structure_to_value
        [("groupId", (Option.map x.groupId ~f:String_.to_value));
        ("groupName", (Option.map x.groupName ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let groupName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "groupName") in
      let groupId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "groupId") in
      make ?groupName ?groupId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let groupName = field_map json__ "GroupName" String_.of_json in
      let groupId = field_map json__ "GroupId" String_.of_json in
      make ?groupName ?groupId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the security groups associated with the EC2 instance."]
module ContainerUid =
  struct
    type nonrec t = string
    let context_ = "ContainerUid"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:256) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"ContainerUid" j
    let to_json = simple_to_json to_value
  end
module PublicAccessStatus =
  struct
    type nonrec t =
      | BLOCKED 
      | ALLOWED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | BLOCKED -> "BLOCKED"
      | ALLOWED -> "ALLOWED"
      | Non_static_id s -> s
    let of_string =
      function
      | "BLOCKED" -> BLOCKED
      | "ALLOWED" -> ALLOWED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration PublicAccessStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"PublicAccessStatus" j)
    let to_json = simple_to_json to_value
  end
module PublicAclIgnoreBehavior =
  struct
    type nonrec t =
      | IGNORED 
      | NOT_IGNORED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | IGNORED -> "IGNORED"
      | NOT_IGNORED -> "NOT_IGNORED"
      | Non_static_id s -> s
    let of_string =
      function
      | "IGNORED" -> IGNORED
      | "NOT_IGNORED" -> NOT_IGNORED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration PublicAclIgnoreBehavior" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"PublicAclIgnoreBehavior" j)
    let to_json = simple_to_json to_value
  end
module PublicBucketRestrictBehavior =
  struct
    type nonrec t =
      | RESTRICTED 
      | NOT_RESTRICTED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | RESTRICTED -> "RESTRICTED"
      | NOT_RESTRICTED -> "NOT_RESTRICTED"
      | Non_static_id s -> s
    let of_string =
      function
      | "RESTRICTED" -> RESTRICTED
      | "NOT_RESTRICTED" -> NOT_RESTRICTED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration PublicBucketRestrictBehavior"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"PublicBucketRestrictBehavior" j)
    let to_json = simple_to_json to_value
  end
module IndicatorValueString =
  struct
    type nonrec t = string
    let context_ = "IndicatorValueString"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:256) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"IndicatorValueString" j
    let to_json = simple_to_json to_value
  end
module Boolean =
  struct
    type nonrec t = bool
    let make i = i
    let of_string = Bool.of_string
    let to_value x = `Boolean x
    let to_query v = to_query to_value v
    let to_header x = Bool.to_string x
    let of_xml xml_arg0 =
      Bool.of_string (string_of_xml ~kind:"a boolean" xml_arg0)
    let of_json = bool_of_json
    let to_json = simple_to_json to_value
  end
module Double =
  struct
    type nonrec t = float
    let make i = i
    let of_string = Float.of_string
    let to_value x = `Double x
    let to_query v = to_query to_value v
    let to_header x = Stdlib.Float.to_string x
    let of_xml xml_arg0 =
      Float.of_string (string_of_xml ~kind:"a double" xml_arg0)
    let of_json j = float_of_json ~kind:"a double" j
    let to_json = simple_to_json to_value
  end
module Observations =
  struct
    type nonrec t =
      {
      text: ObservationTexts.t option
        [@ocaml.doc "The text that was unusual."]}
    let make ?text = fun () -> { text }
    let to_value x =
      structure_to_value
        [("text", (Option.map x.text ~f:ObservationTexts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let text =
        (Option.map ~f:ObservationTexts.of_xml) (Xml.child xml_arg0 "text") in
      make ?text ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let text = field_map json__ "Text" ObservationTexts.of_json in
      make ?text ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the observed behavior."]
module ProfileSubtype =
  struct
    type nonrec t =
      | FREQUENT 
      | INFREQUENT 
      | UNSEEN 
      | RARE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | FREQUENT -> "FREQUENT"
      | INFREQUENT -> "INFREQUENT"
      | UNSEEN -> "UNSEEN"
      | RARE -> "RARE"
      | Non_static_id s -> s
    let of_string =
      function
      | "FREQUENT" -> FREQUENT
      | "INFREQUENT" -> INFREQUENT
      | "UNSEEN" -> UNSEEN
      | "RARE" -> RARE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ProfileSubtype" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ProfileSubtype" j)
    let to_json = simple_to_json to_value
  end
module ProfileType =
  struct
    type nonrec t =
      | FREQUENCY 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function | FREQUENCY -> "FREQUENCY" | Non_static_id s -> s
    let of_string =
      function | "FREQUENCY" -> FREQUENCY | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ProfileType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ProfileType" j)
    let to_json = simple_to_json to_value
  end
module Ec2InstanceUids =
  struct
    type nonrec t = Ec2InstanceUid.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:25) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Ec2InstanceUid.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Ec2InstanceUid.of_xml)
    let of_json j =
      list_of_json ~kind:"Ec2InstanceUids" ~of_json:Ec2InstanceUid.of_json j
    let to_json v = composed_to_json to_value v
  end
module ContainerImageUid =
  struct
    type nonrec t = string
    let context_ = "ContainerImageUid"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:1024) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"ContainerImageUid" j
    let to_json = simple_to_json to_value
  end
module Ec2NetworkInterfaceUids =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"Ec2NetworkInterfaceUids" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module IamInstanceProfile =
  struct
    type nonrec t =
      {
      arn: String_.t option
        [@ocaml.doc "The profile ARN of the EC2 instance."];
      id: String_.t option [@ocaml.doc "The profile ID of the EC2 instance."]}
    let make ?arn = fun ?id -> fun () -> { arn; id }
    let to_value x =
      structure_to_value
        [("arn", (Option.map x.arn ~f:String_.to_value));
        ("id", (Option.map x.id ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let id = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "id") in
      let arn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "arn") in
      make ?id ?arn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let id = field_map json__ "Id" String_.of_json in
      let arn = field_map json__ "Arn" String_.of_json in make ?id ?arn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the EC2 instance profile."]
module ProductCodes =
  struct
    type nonrec t = ProductCode.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ProductCode.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ProductCode.of_xml)
    let of_json j =
      list_of_json ~kind:"ProductCodes" ~of_json:ProductCode.of_json j
    let to_json v = composed_to_json to_value v
  end
module LaunchTemplateVersion =
  struct
    type nonrec t = string
    let context_ = "LaunchTemplateVersion"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:256) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"LaunchTemplateVersion" j
    let to_json = simple_to_json to_value
  end
module Ipv6Addresses =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"Ipv6Addresses" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module PrivateIpAddresses =
  struct
    type nonrec t = PrivateIpAddressDetails.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:PrivateIpAddressDetails.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:PrivateIpAddressDetails.of_xml)
    let of_json j =
      list_of_json ~kind:"PrivateIpAddresses"
        ~of_json:PrivateIpAddressDetails.of_json j
    let to_json v = composed_to_json to_value v
  end
module SecurityGroups =
  struct
    type nonrec t = SecurityGroup.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:SecurityGroup.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:SecurityGroup.of_xml)
    let of_json j =
      list_of_json ~kind:"SecurityGroups" ~of_json:SecurityGroup.of_json j
    let to_json v = composed_to_json to_value v
  end
module EcsClusterStatus =
  struct
    type nonrec t =
      | ACTIVE 
      | PROVISIONING 
      | DEPROVISIONING 
      | FAILED 
      | INACTIVE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ACTIVE -> "ACTIVE"
      | PROVISIONING -> "PROVISIONING"
      | DEPROVISIONING -> "DEPROVISIONING"
      | FAILED -> "FAILED"
      | INACTIVE -> "INACTIVE"
      | Non_static_id s -> s
    let of_string =
      function
      | "ACTIVE" -> ACTIVE
      | "PROVISIONING" -> PROVISIONING
      | "DEPROVISIONING" -> DEPROVISIONING
      | "FAILED" -> FAILED
      | "INACTIVE" -> INACTIVE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration EcsClusterStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"EcsClusterStatus" j)
    let to_json = simple_to_json to_value
  end
module ContainerUids =
  struct
    type nonrec t = ContainerUid.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ContainerUid.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ContainerUid.of_xml)
    let of_json j =
      list_of_json ~kind:"ContainerUids" ~of_json:ContainerUid.of_json j
    let to_json v = composed_to_json to_value v
  end
module EcsLaunchType =
  struct
    type nonrec t =
      | FARGATE 
      | EC2 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function | FARGATE -> "FARGATE" | EC2 -> "EC2" | Non_static_id s -> s
    let of_string =
      function | "FARGATE" -> FARGATE | "EC2" -> EC2 | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration EcsLaunchType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"EcsLaunchType" j)
    let to_json = simple_to_json to_value
  end
module Timestamp =
  struct
    type nonrec t = string
    let make i = i
    let of_string x = x
    let to_value x = `Timestamp x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = string_of_xml ~kind:"a timestamp"
    let of_json = timestamp_of_json
    let to_json = simple_to_json to_value
  end
module ClusterStatus =
  struct
    type nonrec t =
      | CREATING 
      | ACTIVE 
      | DELETING 
      | FAILED 
      | UPDATING 
      | PENDING 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | CREATING -> "CREATING"
      | ACTIVE -> "ACTIVE"
      | DELETING -> "DELETING"
      | FAILED -> "FAILED"
      | UPDATING -> "UPDATING"
      | PENDING -> "PENDING"
      | Non_static_id s -> s
    let of_string =
      function
      | "CREATING" -> CREATING
      | "ACTIVE" -> ACTIVE
      | "DELETING" -> DELETING
      | "FAILED" -> FAILED
      | "UPDATING" -> UPDATING
      | "PENDING" -> PENDING
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ClusterStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ClusterStatus" j)
    let to_json = simple_to_json to_value
  end
module KubernetesResourcesTypes =
  struct
    type nonrec t =
      | PODS 
      | JOBS 
      | CRONJOBS 
      | DEPLOYMENTS 
      | DAEMONSETS 
      | STATEFULSETS 
      | REPLICASETS 
      | REPLICATIONCONTROLLERS 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | PODS -> "PODS"
      | JOBS -> "JOBS"
      | CRONJOBS -> "CRONJOBS"
      | DEPLOYMENTS -> "DEPLOYMENTS"
      | DAEMONSETS -> "DAEMONSETS"
      | STATEFULSETS -> "STATEFULSETS"
      | REPLICASETS -> "REPLICASETS"
      | REPLICATIONCONTROLLERS -> "REPLICATIONCONTROLLERS"
      | Non_static_id s -> s
    let of_string =
      function
      | "PODS" -> PODS
      | "JOBS" -> JOBS
      | "CRONJOBS" -> CRONJOBS
      | "DEPLOYMENTS" -> DEPLOYMENTS
      | "DAEMONSETS" -> DAEMONSETS
      | "STATEFULSETS" -> STATEFULSETS
      | "REPLICASETS" -> REPLICASETS
      | "REPLICATIONCONTROLLERS" -> REPLICATIONCONTROLLERS
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration KubernetesResourcesTypes" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"KubernetesResourcesTypes" j)
    let to_json = simple_to_json to_value
  end
module PublicAccessConfiguration =
  struct
    type nonrec t =
      {
      publicAclAccess: PublicAccessStatus.t option
        [@ocaml.doc
          "Indicates whether or not there is a setting that allows public access to the Amazon S3 buckets through access control lists (ACLs)."];
      publicPolicyAccess: PublicAccessStatus.t option
        [@ocaml.doc
          "Indicates whether or not there is a setting that allows public access to the Amazon S3 bucket policy."];
      publicAclIgnoreBehavior: PublicAclIgnoreBehavior.t option
        [@ocaml.doc
          "Indicates whether or not there is a setting that ignores all public access control lists (ACLs) on the Amazon S3 bucket and the objects that it contains."];
      publicBucketRestrictBehavior: PublicBucketRestrictBehavior.t option
        [@ocaml.doc
          "Indicates whether or not there is a setting that restricts access to the bucket with specified policies."]}
    let make ?publicAclAccess =
      fun ?publicPolicyAccess ->
        fun ?publicAclIgnoreBehavior ->
          fun ?publicBucketRestrictBehavior ->
            fun () ->
              {
                publicAclAccess;
                publicPolicyAccess;
                publicAclIgnoreBehavior;
                publicBucketRestrictBehavior
              }
    let to_value x =
      structure_to_value
        [("publicAclAccess",
           (Option.map x.publicAclAccess ~f:PublicAccessStatus.to_value));
        ("publicPolicyAccess",
          (Option.map x.publicPolicyAccess ~f:PublicAccessStatus.to_value));
        ("publicAclIgnoreBehavior",
          (Option.map x.publicAclIgnoreBehavior
             ~f:PublicAclIgnoreBehavior.to_value));
        ("publicBucketRestrictBehavior",
          (Option.map x.publicBucketRestrictBehavior
             ~f:PublicBucketRestrictBehavior.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let publicBucketRestrictBehavior =
        (Option.map ~f:PublicBucketRestrictBehavior.of_xml)
          (Xml.child xml_arg0 "publicBucketRestrictBehavior") in
      let publicAclIgnoreBehavior =
        (Option.map ~f:PublicAclIgnoreBehavior.of_xml)
          (Xml.child xml_arg0 "publicAclIgnoreBehavior") in
      let publicPolicyAccess =
        (Option.map ~f:PublicAccessStatus.of_xml)
          (Xml.child xml_arg0 "publicPolicyAccess") in
      let publicAclAccess =
        (Option.map ~f:PublicAccessStatus.of_xml)
          (Xml.child xml_arg0 "publicAclAccess") in
      make ?publicBucketRestrictBehavior ?publicAclIgnoreBehavior
        ?publicPolicyAccess ?publicAclAccess ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let publicBucketRestrictBehavior =
        field_map json__ "PublicBucketRestrictBehavior"
          PublicBucketRestrictBehavior.of_json in
      let publicAclIgnoreBehavior =
        field_map json__ "PublicAclIgnoreBehavior"
          PublicAclIgnoreBehavior.of_json in
      let publicPolicyAccess =
        field_map json__ "PublicPolicyAccess" PublicAccessStatus.of_json in
      let publicAclAccess =
        field_map json__ "PublicAclAccess" PublicAccessStatus.of_json in
      make ?publicBucketRestrictBehavior ?publicAclIgnoreBehavior
        ?publicPolicyAccess ?publicAclAccess ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes public access policies that apply to the Amazon S3 bucket. For information about each of the following settings, see Blocking public access to your Amazon S3 storage in the Amazon S3 User Guide."]
module S3ObjectUids =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"S3ObjectUids" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module IndicatorTitle =
  struct
    type nonrec t = string
    let context_ = "IndicatorTitle"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:256) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"IndicatorTitle" j
    let to_json = simple_to_json to_value
  end
module IndicatorType =
  struct
    type nonrec t =
      | SUSPICIOUS_USER_AGENT 
      | SUSPICIOUS_NETWORK 
      | MALICIOUS_IP 
      | TOR_IP 
      | ATTACK_TACTIC 
      | HIGH_RISK_API 
      | ATTACK_TECHNIQUE 
      | UNUSUAL_API_FOR_ACCOUNT 
      | UNUSUAL_ASN_FOR_ACCOUNT 
      | UNUSUAL_ASN_FOR_USER 
      | SUSPICIOUS_PROCESS 
      | MALICIOUS_DOMAIN 
      | MALICIOUS_PROCESS 
      | CRYPTOMINING_IP 
      | CRYPTOMINING_DOMAIN 
      | CRYPTOMINING_PROCESS 
      | MALICIOUS_FILE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | SUSPICIOUS_USER_AGENT -> "SUSPICIOUS_USER_AGENT"
      | SUSPICIOUS_NETWORK -> "SUSPICIOUS_NETWORK"
      | MALICIOUS_IP -> "MALICIOUS_IP"
      | TOR_IP -> "TOR_IP"
      | ATTACK_TACTIC -> "ATTACK_TACTIC"
      | HIGH_RISK_API -> "HIGH_RISK_API"
      | ATTACK_TECHNIQUE -> "ATTACK_TECHNIQUE"
      | UNUSUAL_API_FOR_ACCOUNT -> "UNUSUAL_API_FOR_ACCOUNT"
      | UNUSUAL_ASN_FOR_ACCOUNT -> "UNUSUAL_ASN_FOR_ACCOUNT"
      | UNUSUAL_ASN_FOR_USER -> "UNUSUAL_ASN_FOR_USER"
      | SUSPICIOUS_PROCESS -> "SUSPICIOUS_PROCESS"
      | MALICIOUS_DOMAIN -> "MALICIOUS_DOMAIN"
      | MALICIOUS_PROCESS -> "MALICIOUS_PROCESS"
      | CRYPTOMINING_IP -> "CRYPTOMINING_IP"
      | CRYPTOMINING_DOMAIN -> "CRYPTOMINING_DOMAIN"
      | CRYPTOMINING_PROCESS -> "CRYPTOMINING_PROCESS"
      | MALICIOUS_FILE -> "MALICIOUS_FILE"
      | Non_static_id s -> s
    let of_string =
      function
      | "SUSPICIOUS_USER_AGENT" -> SUSPICIOUS_USER_AGENT
      | "SUSPICIOUS_NETWORK" -> SUSPICIOUS_NETWORK
      | "MALICIOUS_IP" -> MALICIOUS_IP
      | "TOR_IP" -> TOR_IP
      | "ATTACK_TACTIC" -> ATTACK_TACTIC
      | "HIGH_RISK_API" -> HIGH_RISK_API
      | "ATTACK_TECHNIQUE" -> ATTACK_TECHNIQUE
      | "UNUSUAL_API_FOR_ACCOUNT" -> UNUSUAL_API_FOR_ACCOUNT
      | "UNUSUAL_ASN_FOR_ACCOUNT" -> UNUSUAL_ASN_FOR_ACCOUNT
      | "UNUSUAL_ASN_FOR_USER" -> UNUSUAL_ASN_FOR_USER
      | "SUSPICIOUS_PROCESS" -> SUSPICIOUS_PROCESS
      | "MALICIOUS_DOMAIN" -> MALICIOUS_DOMAIN
      | "MALICIOUS_PROCESS" -> MALICIOUS_PROCESS
      | "CRYPTOMINING_IP" -> CRYPTOMINING_IP
      | "CRYPTOMINING_DOMAIN" -> CRYPTOMINING_DOMAIN
      | "CRYPTOMINING_PROCESS" -> CRYPTOMINING_PROCESS
      | "MALICIOUS_FILE" -> MALICIOUS_FILE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration IndicatorType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"IndicatorType" j)
    let to_json = simple_to_json to_value
  end
module IndicatorValues =
  struct
    type nonrec t = IndicatorValueString.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:400) >>=
             (fun () -> check_list_min i ~min:1));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:IndicatorValueString.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:IndicatorValueString.of_xml)
    let of_json j =
      list_of_json ~kind:"IndicatorValues"
        ~of_json:IndicatorValueString.of_json j
    let to_json v = composed_to_json to_value v
  end
module ScanFilePath =
  struct
    type nonrec t =
      {
      filePath: String_.t option
        [@ocaml.doc "The file path of the infected file."];
      volumeArn: String_.t option
        [@ocaml.doc "EBS volume ARN details of the infected file."];
      hash: String_.t option
        [@ocaml.doc "The hash value of the infected file."];
      fileName: String_.t option
        [@ocaml.doc "File name of the infected file."]}
    let make ?filePath =
      fun ?volumeArn ->
        fun ?hash ->
          fun ?fileName -> fun () -> { filePath; volumeArn; hash; fileName }
    let to_value x =
      structure_to_value
        [("filePath", (Option.map x.filePath ~f:String_.to_value));
        ("volumeArn", (Option.map x.volumeArn ~f:String_.to_value));
        ("hash", (Option.map x.hash ~f:String_.to_value));
        ("fileName", (Option.map x.fileName ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let fileName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "fileName") in
      let hash = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "hash") in
      let volumeArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "volumeArn") in
      let filePath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "filePath") in
      make ?fileName ?hash ?volumeArn ?filePath ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let fileName = field_map json__ "FileName" String_.of_json in
      let hash = field_map json__ "Hash" String_.of_json in
      let volumeArn = field_map json__ "VolumeArn" String_.of_json in
      let filePath = field_map json__ "FilePath" String_.of_json in
      make ?fileName ?hash ?volumeArn ?filePath ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains details of infected file including name, file path and hash."]
module NonEmptyString =
  struct
    type nonrec t = string
    let context_ = "NonEmptyString"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:200) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"NonEmptyString" j
    let to_json = simple_to_json to_value
  end
module VolumeMount =
  struct
    type nonrec t =
      {
      name: String_.t option [@ocaml.doc "Volume mount name."];
      mountPath: String_.t option [@ocaml.doc "Volume mount path."]}
    let make ?name = fun ?mountPath -> fun () -> { name; mountPath }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("mountPath", (Option.map x.mountPath ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let mountPath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "mountPath") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?mountPath ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let mountPath = field_map json__ "MountPath" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?mountPath ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Container volume mount."]
module BlockPublicAccess =
  struct
    type nonrec t =
      {
      ignorePublicAcls: Boolean.t option
        [@ocaml.doc
          "Indicates if S3 Block Public Access is set to IgnorePublicAcls."];
      restrictPublicBuckets: Boolean.t option
        [@ocaml.doc
          "Indicates if S3 Block Public Access is set to RestrictPublicBuckets."];
      blockPublicAcls: Boolean.t option
        [@ocaml.doc
          "Indicates if S3 Block Public Access is set to BlockPublicAcls."];
      blockPublicPolicy: Boolean.t option
        [@ocaml.doc
          "Indicates if S3 Block Public Access is set to BlockPublicPolicy."]}
    let make ?ignorePublicAcls =
      fun ?restrictPublicBuckets ->
        fun ?blockPublicAcls ->
          fun ?blockPublicPolicy ->
            fun () ->
              {
                ignorePublicAcls;
                restrictPublicBuckets;
                blockPublicAcls;
                blockPublicPolicy
              }
    let to_value x =
      structure_to_value
        [("ignorePublicAcls",
           (Option.map x.ignorePublicAcls ~f:Boolean.to_value));
        ("restrictPublicBuckets",
          (Option.map x.restrictPublicBuckets ~f:Boolean.to_value));
        ("blockPublicAcls",
          (Option.map x.blockPublicAcls ~f:Boolean.to_value));
        ("blockPublicPolicy",
          (Option.map x.blockPublicPolicy ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let blockPublicPolicy =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "blockPublicPolicy") in
      let blockPublicAcls =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "blockPublicAcls") in
      let restrictPublicBuckets =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "restrictPublicBuckets") in
      let ignorePublicAcls =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "ignorePublicAcls") in
      make ?blockPublicPolicy ?blockPublicAcls ?restrictPublicBuckets
        ?ignorePublicAcls ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let blockPublicPolicy =
        field_map json__ "BlockPublicPolicy" Boolean.of_json in
      let blockPublicAcls =
        field_map json__ "BlockPublicAcls" Boolean.of_json in
      let restrictPublicBuckets =
        field_map json__ "RestrictPublicBuckets" Boolean.of_json in
      let ignorePublicAcls =
        field_map json__ "IgnorePublicAcls" Boolean.of_json in
      make ?blockPublicPolicy ?blockPublicAcls ?restrictPublicBuckets
        ?ignorePublicAcls ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on how the bucker owner's S3 Block Public Access settings are being applied to the S3 bucket. See S3 Block Public Access for more information."]
module AccessControlList =
  struct
    type nonrec t =
      {
      allowsPublicReadAccess: Boolean.t option
        [@ocaml.doc
          "A value that indicates whether public read access for the bucket is enabled through an Access Control List (ACL)."];
      allowsPublicWriteAccess: Boolean.t option
        [@ocaml.doc
          "A value that indicates whether public write access for the bucket is enabled through an Access Control List (ACL)."]}
    let make ?allowsPublicReadAccess =
      fun ?allowsPublicWriteAccess ->
        fun () -> { allowsPublicReadAccess; allowsPublicWriteAccess }
    let to_value x =
      structure_to_value
        [("allowsPublicReadAccess",
           (Option.map x.allowsPublicReadAccess ~f:Boolean.to_value));
        ("allowsPublicWriteAccess",
          (Option.map x.allowsPublicWriteAccess ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let allowsPublicWriteAccess =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "allowsPublicWriteAccess") in
      let allowsPublicReadAccess =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "allowsPublicReadAccess") in
      make ?allowsPublicWriteAccess ?allowsPublicReadAccess ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let allowsPublicWriteAccess =
        field_map json__ "AllowsPublicWriteAccess" Boolean.of_json in
      let allowsPublicReadAccess =
        field_map json__ "AllowsPublicReadAccess" Boolean.of_json in
      make ?allowsPublicWriteAccess ?allowsPublicReadAccess ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the current access control policies for the bucket."]
module BucketPolicy =
  struct
    type nonrec t =
      {
      allowsPublicReadAccess: Boolean.t option
        [@ocaml.doc
          "A value that indicates whether public read access for the bucket is enabled through a bucket policy."];
      allowsPublicWriteAccess: Boolean.t option
        [@ocaml.doc
          "A value that indicates whether public write access for the bucket is enabled through a bucket policy."]}
    let make ?allowsPublicReadAccess =
      fun ?allowsPublicWriteAccess ->
        fun () -> { allowsPublicReadAccess; allowsPublicWriteAccess }
    let to_value x =
      structure_to_value
        [("allowsPublicReadAccess",
           (Option.map x.allowsPublicReadAccess ~f:Boolean.to_value));
        ("allowsPublicWriteAccess",
          (Option.map x.allowsPublicWriteAccess ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let allowsPublicWriteAccess =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "allowsPublicWriteAccess") in
      let allowsPublicReadAccess =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "allowsPublicReadAccess") in
      make ?allowsPublicWriteAccess ?allowsPublicReadAccess ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let allowsPublicWriteAccess =
        field_map json__ "AllowsPublicWriteAccess" Boolean.of_json in
      let allowsPublicReadAccess =
        field_map json__ "AllowsPublicReadAccess" Boolean.of_json in
      make ?allowsPublicWriteAccess ?allowsPublicReadAccess ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the current bucket policies for the S3 bucket."]
module Integer =
  struct
    type nonrec t = int
    let make i = i
    let of_string = Int.of_string
    let to_value x = `Integer x
    let to_query v = to_query to_value v
    let to_header x = Int.to_string x
    let of_xml xml_arg0 =
      Int.of_string (string_of_xml ~kind:"an integer for Integer" xml_arg0)
    let of_json j = Int.of_float (float_of_json ~kind:"an integer" j)
    let to_json = simple_to_json to_value
  end
module City =
  struct
    type nonrec t =
      {
      cityName: String_.t option
        [@ocaml.doc "The city name of the remote IP address."]}
    let make ?cityName = fun () -> { cityName }
    let to_value x =
      structure_to_value
        [("cityName", (Option.map x.cityName ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let cityName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "cityName") in
      make ?cityName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let cityName = field_map json__ "CityName" String_.of_json in
      make ?cityName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the city associated with the IP address."]
module Country =
  struct
    type nonrec t =
      {
      countryCode: String_.t option
        [@ocaml.doc "The country code of the remote IP address."];
      countryName: String_.t option
        [@ocaml.doc "The country name of the remote IP address."]}
    let make ?countryCode =
      fun ?countryName -> fun () -> { countryCode; countryName }
    let to_value x =
      structure_to_value
        [("countryCode", (Option.map x.countryCode ~f:String_.to_value));
        ("countryName", (Option.map x.countryName ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let countryName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "countryName") in
      let countryCode =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "countryCode") in
      make ?countryName ?countryCode ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let countryName = field_map json__ "CountryName" String_.of_json in
      let countryCode = field_map json__ "CountryCode" String_.of_json in
      make ?countryName ?countryCode ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the country where the remote IP address is located."]
module GeoLocation =
  struct
    type nonrec t =
      {
      lat: Double.t option
        [@ocaml.doc "The latitude information of the remote IP address."];
      lon: Double.t option
        [@ocaml.doc "The longitude information of the remote IP address."]}
    let make ?lat = fun ?lon -> fun () -> { lat; lon }
    let to_value x =
      structure_to_value
        [("lat", (Option.map x.lat ~f:Double.to_value));
        ("lon", (Option.map x.lon ~f:Double.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let lon = (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "lon") in
      let lat = (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "lat") in
      make ?lon ?lat ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let lon = field_map json__ "Lon" Double.of_json in
      let lat = field_map json__ "Lat" Double.of_json in make ?lon ?lat ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the location of the remote IP address. By default, GuardDuty returns Geolocation with Lat and Lon as 0.0."]
module Organization =
  struct
    type nonrec t =
      {
      asn: String_.t option
        [@ocaml.doc
          "The Autonomous System Number (ASN) of the internet provider of the remote IP address."];
      asnOrg: String_.t option
        [@ocaml.doc "The organization that registered this ASN."];
      isp: String_.t option
        [@ocaml.doc "The ISP information for the internet provider."];
      org: String_.t option [@ocaml.doc "The name of the internet provider."]}
    let make ?asn =
      fun ?asnOrg ->
        fun ?isp -> fun ?org -> fun () -> { asn; asnOrg; isp; org }
    let to_value x =
      structure_to_value
        [("asn", (Option.map x.asn ~f:String_.to_value));
        ("asnOrg", (Option.map x.asnOrg ~f:String_.to_value));
        ("isp", (Option.map x.isp ~f:String_.to_value));
        ("org", (Option.map x.org ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let org = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "org") in
      let isp = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "isp") in
      let asnOrg =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "asnOrg") in
      let asn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "asn") in
      make ?org ?isp ?asnOrg ?asn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let org = field_map json__ "Org" String_.of_json in
      let isp = field_map json__ "Isp" String_.of_json in
      let asnOrg = field_map json__ "AsnOrg" String_.of_json in
      let asn = field_map json__ "Asn" String_.of_json in
      make ?org ?isp ?asnOrg ?asn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the ISP organization of the remote IP address."]
module AnomalyObject =
  struct
    type nonrec t =
      {
      profileType: ProfileType.t option
        [@ocaml.doc "The type of behavior of the profile."];
      profileSubtype: ProfileSubtype.t option
        [@ocaml.doc "The frequency of the anomaly."];
      observations: Observations.t option [@ocaml.doc "The recorded value."]}
    let make ?profileType =
      fun ?profileSubtype ->
        fun ?observations ->
          fun () -> { profileType; profileSubtype; observations }
    let to_value x =
      structure_to_value
        [("profileType", (Option.map x.profileType ~f:ProfileType.to_value));
        ("profileSubtype",
          (Option.map x.profileSubtype ~f:ProfileSubtype.to_value));
        ("observations",
          (Option.map x.observations ~f:Observations.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let observations =
        (Option.map ~f:Observations.of_xml)
          (Xml.child xml_arg0 "observations") in
      let profileSubtype =
        (Option.map ~f:ProfileSubtype.of_xml)
          (Xml.child xml_arg0 "profileSubtype") in
      let profileType =
        (Option.map ~f:ProfileType.of_xml) (Xml.child xml_arg0 "profileType") in
      make ?observations ?profileSubtype ?profileType ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let observations = field_map json__ "Observations" Observations.of_json in
      let profileSubtype =
        field_map json__ "ProfileSubtype" ProfileSubtype.of_json in
      let profileType = field_map json__ "ProfileType" ProfileType.of_json in
      make ?observations ?profileSubtype ?profileType ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the unusual anomalies."]
module ProcessName =
  struct
    type nonrec t = string
    let context_ = "ProcessName"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:4096) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"ProcessName" j
    let to_json = simple_to_json to_value
  end
module ProcessPath =
  struct
    type nonrec t = string
    let context_ = "ProcessPath"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:4096) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"ProcessPath" j
    let to_json = simple_to_json to_value
  end
module ProcessSha256 =
  struct
    type nonrec t = string
    let context_ = "ProcessSha256"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:1024) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"ProcessSha256" j
    let to_json = simple_to_json to_value
  end
module MfaStatus =
  struct
    type nonrec t =
      | ENABLED 
      | DISABLED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ENABLED -> "ENABLED"
      | DISABLED -> "DISABLED"
      | Non_static_id s -> s
    let of_string =
      function
      | "ENABLED" -> ENABLED
      | "DISABLED" -> DISABLED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration MfaStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"MfaStatus" j)
    let to_json = simple_to_json to_value
  end
module Account =
  struct
    type nonrec t =
      {
      uid: String_.t option
        [@ocaml.doc
          "The Amazon Web Services account ID within which the activity took place. This may differ from the account that owns the user identity."];
      name: String_.t option
        [@ocaml.doc "Name of the member's Amazon Web Services account."]}
    let make ?uid = fun ?name -> fun () -> { uid; name }
    let to_value x =
      structure_to_value
        [("uid", (Option.map x.uid ~f:String_.to_value));
        ("account", (Option.map x.name ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let name =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "account") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      make ?name ?uid ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let name = field_map json__ "Name" String_.of_json in
      let uid = field_map json__ "Uid" String_.of_json in make ?name ?uid ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon Web Services account within which the activity took place."]
module NetworkDirection =
  struct
    type nonrec t =
      | INBOUND 
      | OUTBOUND 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | INBOUND -> "INBOUND"
      | OUTBOUND -> "OUTBOUND"
      | Non_static_id s -> s
    let of_string =
      function
      | "INBOUND" -> INBOUND
      | "OUTBOUND" -> OUTBOUND
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration NetworkDirection" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"NetworkDirection" j)
    let to_json = simple_to_json to_value
  end
module AccessKey =
  struct
    type nonrec t =
      {
      principalId: String_.t option [@ocaml.doc "Principal ID of the user."];
      userName: String_.t option [@ocaml.doc "Name of the user."];
      userType: String_.t option [@ocaml.doc "Type of the user."]}
    let make ?principalId =
      fun ?userName ->
        fun ?userType -> fun () -> { principalId; userName; userType }
    let to_value x =
      structure_to_value
        [("principalId", (Option.map x.principalId ~f:String_.to_value));
        ("userName", (Option.map x.userName ~f:String_.to_value));
        ("userType", (Option.map x.userType ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let userType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "userType") in
      let userName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "userName") in
      let principalId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "principalId") in
      make ?userType ?userName ?principalId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let userType = field_map json__ "UserType" String_.of_json in
      let userName = field_map json__ "UserName" String_.of_json in
      let principalId = field_map json__ "PrincipalId" String_.of_json in
      make ?userType ?userName ?principalId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the access keys."]
module AutoscalingAutoScalingGroup =
  struct
    type nonrec t =
      {
      ec2InstanceUids: Ec2InstanceUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the compromised Amazon EC2 instances that are part of the same Auto Scaling Group."]}
    let make ?ec2InstanceUids = fun () -> { ec2InstanceUids }
    let to_value x =
      structure_to_value
        [("ec2InstanceUids",
           (Option.map x.ec2InstanceUids ~f:Ec2InstanceUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ec2InstanceUids =
        (Option.map ~f:Ec2InstanceUids.of_xml)
          (Xml.child xml_arg0 "ec2InstanceUids") in
      make ?ec2InstanceUids ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ec2InstanceUids =
        field_map json__ "Ec2InstanceUids" Ec2InstanceUids.of_json in
      make ?ec2InstanceUids ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Auto Scaling Group involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances."]
module CloudformationStack =
  struct
    type nonrec t =
      {
      ec2InstanceUids: Ec2InstanceUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the compromised Amazon EC2 instances that were created as part of the same CloudFormation stack."]}
    let make ?ec2InstanceUids = fun () -> { ec2InstanceUids }
    let to_value x =
      structure_to_value
        [("ec2InstanceUids",
           (Option.map x.ec2InstanceUids ~f:Ec2InstanceUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ec2InstanceUids =
        (Option.map ~f:Ec2InstanceUids.of_xml)
          (Xml.child xml_arg0 "ec2InstanceUids") in
      make ?ec2InstanceUids ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ec2InstanceUids =
        field_map json__ "Ec2InstanceUids" Ec2InstanceUids.of_json in
      make ?ec2InstanceUids ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the CloudFormation stack involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances."]
module ContainerFindingResource =
  struct
    type nonrec t =
      {
      image: String_.t option
        [@ocaml.doc
          "The container image information, including the image name and tag used to run the container that was involved in the finding."];
      imageUid: ContainerImageUid.t option
        [@ocaml.doc "The unique ID associated with the container image."]}
    let make ?image = fun ?imageUid -> fun () -> { image; imageUid }
    let to_value x =
      structure_to_value
        [("image", (Option.map x.image ~f:String_.to_value));
        ("imageUid", (Option.map x.imageUid ~f:ContainerImageUid.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let imageUid =
        (Option.map ~f:ContainerImageUid.of_xml)
          (Xml.child xml_arg0 "imageUid") in
      let image = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "image") in
      make ?imageUid ?image ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let imageUid = field_map json__ "ImageUid" ContainerImageUid.of_json in
      let image = field_map json__ "Image" String_.of_json in
      make ?imageUid ?image ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about container resources involved in a GuardDuty finding. This structure provides details about containers that were identified as part of suspicious or malicious activity."]
module Ec2Image =
  struct
    type nonrec t =
      {
      ec2InstanceUids: Ec2InstanceUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the compromised Amazon EC2 instances that were launched with the same Amazon Machine Image (AMI)."]}
    let make ?ec2InstanceUids = fun () -> { ec2InstanceUids }
    let to_value x =
      structure_to_value
        [("ec2InstanceUids",
           (Option.map x.ec2InstanceUids ~f:Ec2InstanceUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ec2InstanceUids =
        (Option.map ~f:Ec2InstanceUids.of_xml)
          (Xml.child xml_arg0 "ec2InstanceUids") in
      make ?ec2InstanceUids ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ec2InstanceUids =
        field_map json__ "Ec2InstanceUids" Ec2InstanceUids.of_json in
      make ?ec2InstanceUids ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon EC2 Image involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances."]
module Ec2Instance =
  struct
    type nonrec t =
      {
      availabilityZone: String_.t option
        [@ocaml.doc
          "The availability zone of the Amazon EC2 instance. For more information, see Availability zones in the Amazon EC2 User Guide."];
      imageDescription: String_.t option
        [@ocaml.doc "The image description of the Amazon EC2 instance."];
      instanceState: String_.t option
        [@ocaml.doc
          "The state of the Amazon EC2 instance. For more information, see Amazon EC2 instance state changes in the Amazon EC2 User Guide."];
      iamInstanceProfile: IamInstanceProfile.t option ;
      instanceType: String_.t option
        [@ocaml.doc "Type of the Amazon EC2 instance."];
      outpostArn: String_.t option
        [@ocaml.doc
          "The Amazon Resource Name (ARN) of the Amazon Web Services Outpost. This shows applicable Amazon Web Services Outposts instances."];
      platform: String_.t option
        [@ocaml.doc "The platform of the Amazon EC2 instance."];
      productCodes: ProductCodes.t option
        [@ocaml.doc "The product code of the Amazon EC2 instance."];
      ec2NetworkInterfaceUids: Ec2NetworkInterfaceUids.t option
        [@ocaml.doc "The ID of the network interface."]}
    let make ?availabilityZone =
      fun ?imageDescription ->
        fun ?instanceState ->
          fun ?iamInstanceProfile ->
            fun ?instanceType ->
              fun ?outpostArn ->
                fun ?platform ->
                  fun ?productCodes ->
                    fun ?ec2NetworkInterfaceUids ->
                      fun () ->
                        {
                          availabilityZone;
                          imageDescription;
                          instanceState;
                          iamInstanceProfile;
                          instanceType;
                          outpostArn;
                          platform;
                          productCodes;
                          ec2NetworkInterfaceUids
                        }
    let to_value x =
      structure_to_value
        [("availabilityZone",
           (Option.map x.availabilityZone ~f:String_.to_value));
        ("imageDescription",
          (Option.map x.imageDescription ~f:String_.to_value));
        ("instanceState", (Option.map x.instanceState ~f:String_.to_value));
        ("IamInstanceProfile",
          (Option.map x.iamInstanceProfile ~f:IamInstanceProfile.to_value));
        ("instanceType", (Option.map x.instanceType ~f:String_.to_value));
        ("outpostArn", (Option.map x.outpostArn ~f:String_.to_value));
        ("platform", (Option.map x.platform ~f:String_.to_value));
        ("productCodes",
          (Option.map x.productCodes ~f:ProductCodes.to_value));
        ("ec2NetworkInterfaceUids",
          (Option.map x.ec2NetworkInterfaceUids
             ~f:Ec2NetworkInterfaceUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ec2NetworkInterfaceUids =
        (Option.map ~f:Ec2NetworkInterfaceUids.of_xml)
          (Xml.child xml_arg0 "ec2NetworkInterfaceUids") in
      let productCodes =
        (Option.map ~f:ProductCodes.of_xml)
          (Xml.child xml_arg0 "productCodes") in
      let platform =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "platform") in
      let outpostArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "outpostArn") in
      let instanceType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "instanceType") in
      let iamInstanceProfile =
        (Option.map ~f:IamInstanceProfile.of_xml)
          (Xml.child xml_arg0 "IamInstanceProfile") in
      let instanceState =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "instanceState") in
      let imageDescription =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "imageDescription") in
      let availabilityZone =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "availabilityZone") in
      make ?ec2NetworkInterfaceUids ?productCodes ?platform ?outpostArn
        ?instanceType ?iamInstanceProfile ?instanceState ?imageDescription
        ?availabilityZone ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ec2NetworkInterfaceUids =
        field_map json__ "Ec2NetworkInterfaceUids"
          Ec2NetworkInterfaceUids.of_json in
      let productCodes = field_map json__ "ProductCodes" ProductCodes.of_json in
      let platform = field_map json__ "Platform" String_.of_json in
      let outpostArn = field_map json__ "OutpostArn" String_.of_json in
      let instanceType = field_map json__ "InstanceType" String_.of_json in
      let iamInstanceProfile =
        field_map json__ "IamInstanceProfile" IamInstanceProfile.of_json in
      let instanceState = field_map json__ "InstanceState" String_.of_json in
      let imageDescription =
        field_map json__ "ImageDescription" String_.of_json in
      let availabilityZone =
        field_map json__ "AvailabilityZone" String_.of_json in
      make ?ec2NetworkInterfaceUids ?productCodes ?platform ?outpostArn
        ?instanceType ?iamInstanceProfile ?instanceState ?imageDescription
        ?availabilityZone ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Details about the potentially impacted Amazon EC2 instance resource."]
module Ec2LaunchTemplate =
  struct
    type nonrec t =
      {
      ec2InstanceUids: Ec2InstanceUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the compromised Amazon EC2 instances that share the same Amazon EC2 launch template."];
      version: LaunchTemplateVersion.t option
        [@ocaml.doc "Version of the EC2 launch template."]}
    let make ?ec2InstanceUids =
      fun ?version -> fun () -> { ec2InstanceUids; version }
    let to_value x =
      structure_to_value
        [("ec2InstanceUids",
           (Option.map x.ec2InstanceUids ~f:Ec2InstanceUids.to_value));
        ("version", (Option.map x.version ~f:LaunchTemplateVersion.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let version =
        (Option.map ~f:LaunchTemplateVersion.of_xml)
          (Xml.child xml_arg0 "version") in
      let ec2InstanceUids =
        (Option.map ~f:Ec2InstanceUids.of_xml)
          (Xml.child xml_arg0 "ec2InstanceUids") in
      make ?version ?ec2InstanceUids ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let version = field_map json__ "Version" LaunchTemplateVersion.of_json in
      let ec2InstanceUids =
        field_map json__ "Ec2InstanceUids" Ec2InstanceUids.of_json in
      make ?version ?ec2InstanceUids ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon EC2 launch template involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances."]
module Ec2NetworkInterface =
  struct
    type nonrec t =
      {
      ipv6Addresses: Ipv6Addresses.t option
        [@ocaml.doc "A list of IPv6 addresses for the Amazon EC2 instance."];
      privateIpAddresses: PrivateIpAddresses.t option
        [@ocaml.doc
          "Other private IP address information of the Amazon EC2 instance."];
      publicIp: String_.t option
        [@ocaml.doc "The public IP address of the Amazon EC2 instance."];
      securityGroups: SecurityGroups.t option
        [@ocaml.doc
          "The security groups associated with the Amazon EC2 instance."];
      subNetId: String_.t option
        [@ocaml.doc "The subnet ID of the Amazon EC2 instance."];
      vpcId: String_.t option
        [@ocaml.doc "The VPC ID of the Amazon EC2 instance."]}
    let make ?ipv6Addresses =
      fun ?privateIpAddresses ->
        fun ?publicIp ->
          fun ?securityGroups ->
            fun ?subNetId ->
              fun ?vpcId ->
                fun () ->
                  {
                    ipv6Addresses;
                    privateIpAddresses;
                    publicIp;
                    securityGroups;
                    subNetId;
                    vpcId
                  }
    let to_value x =
      structure_to_value
        [("ipv6Addresses",
           (Option.map x.ipv6Addresses ~f:Ipv6Addresses.to_value));
        ("privateIpAddresses",
          (Option.map x.privateIpAddresses ~f:PrivateIpAddresses.to_value));
        ("publicIp", (Option.map x.publicIp ~f:String_.to_value));
        ("securityGroups",
          (Option.map x.securityGroups ~f:SecurityGroups.to_value));
        ("subNetId", (Option.map x.subNetId ~f:String_.to_value));
        ("vpcId", (Option.map x.vpcId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let vpcId = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "vpcId") in
      let subNetId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "subNetId") in
      let securityGroups =
        (Option.map ~f:SecurityGroups.of_xml)
          (Xml.child xml_arg0 "securityGroups") in
      let publicIp =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "publicIp") in
      let privateIpAddresses =
        (Option.map ~f:PrivateIpAddresses.of_xml)
          (Xml.child xml_arg0 "privateIpAddresses") in
      let ipv6Addresses =
        (Option.map ~f:Ipv6Addresses.of_xml)
          (Xml.child xml_arg0 "ipv6Addresses") in
      make ?vpcId ?subNetId ?securityGroups ?publicIp ?privateIpAddresses
        ?ipv6Addresses ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let vpcId = field_map json__ "VpcId" String_.of_json in
      let subNetId = field_map json__ "SubNetId" String_.of_json in
      let securityGroups =
        field_map json__ "SecurityGroups" SecurityGroups.of_json in
      let publicIp = field_map json__ "PublicIp" String_.of_json in
      let privateIpAddresses =
        field_map json__ "PrivateIpAddresses" PrivateIpAddresses.of_json in
      let ipv6Addresses =
        field_map json__ "Ipv6Addresses" Ipv6Addresses.of_json in
      make ?vpcId ?subNetId ?securityGroups ?publicIp ?privateIpAddresses
        ?ipv6Addresses ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the elastic network interface of the Amazon EC2 instance."]
module Ec2Vpc =
  struct
    type nonrec t =
      {
      ec2InstanceUids: Ec2InstanceUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the compromised Amazon EC2 instances that were launched within the same Virtual Private Cloud (VPC)."]}
    let make ?ec2InstanceUids = fun () -> { ec2InstanceUids }
    let to_value x =
      structure_to_value
        [("ec2InstanceUids",
           (Option.map x.ec2InstanceUids ~f:Ec2InstanceUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ec2InstanceUids =
        (Option.map ~f:Ec2InstanceUids.of_xml)
          (Xml.child xml_arg0 "ec2InstanceUids") in
      make ?ec2InstanceUids ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ec2InstanceUids =
        field_map json__ "Ec2InstanceUids" Ec2InstanceUids.of_json in
      make ?ec2InstanceUids ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon EC2 VPC involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances."]
module EcsCluster =
  struct
    type nonrec t =
      {
      status: EcsClusterStatus.t option
        [@ocaml.doc "The current status of the Amazon ECS cluster."];
      ec2InstanceUids: Ec2InstanceUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the Amazon EC2 instances that serve as container instances in the Amazon ECS cluster."]}
    let make ?status =
      fun ?ec2InstanceUids -> fun () -> { status; ec2InstanceUids }
    let to_value x =
      structure_to_value
        [("status", (Option.map x.status ~f:EcsClusterStatus.to_value));
        ("ec2InstanceUids",
          (Option.map x.ec2InstanceUids ~f:Ec2InstanceUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ec2InstanceUids =
        (Option.map ~f:Ec2InstanceUids.of_xml)
          (Xml.child xml_arg0 "ec2InstanceUids") in
      let status =
        (Option.map ~f:EcsClusterStatus.of_xml) (Xml.child xml_arg0 "status") in
      make ?ec2InstanceUids ?status ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ec2InstanceUids =
        field_map json__ "Ec2InstanceUids" Ec2InstanceUids.of_json in
      let status = field_map json__ "Status" EcsClusterStatus.of_json in
      make ?ec2InstanceUids ?status ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon ECS cluster involved in a GuardDuty finding, including cluster identification and status."]
module EcsTask =
  struct
    type nonrec t =
      {
      createdAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp indicating when the Amazon ECS task was created, in UTC format."];
      taskDefinitionArn: String_.t option
        [@ocaml.doc
          "The ARN of task definition which describes the container and volume definitions of the Amazon ECS task."];
      launchType: EcsLaunchType.t option
        [@ocaml.doc
          "The infrastructure type on which the Amazon ECS task runs."];
      containerUids: ContainerUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the containers associated with the Amazon ECS task."]}
    let make ?createdAt =
      fun ?taskDefinitionArn ->
        fun ?launchType ->
          fun ?containerUids ->
            fun () ->
              { createdAt; taskDefinitionArn; launchType; containerUids }
    let to_value x =
      structure_to_value
        [("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value));
        ("taskDefinitionArn",
          (Option.map x.taskDefinitionArn ~f:String_.to_value));
        ("launchType", (Option.map x.launchType ~f:EcsLaunchType.to_value));
        ("containerUids",
          (Option.map x.containerUids ~f:ContainerUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let containerUids =
        (Option.map ~f:ContainerUids.of_xml)
          (Xml.child xml_arg0 "containerUids") in
      let launchType =
        (Option.map ~f:EcsLaunchType.of_xml)
          (Xml.child xml_arg0 "launchType") in
      let taskDefinitionArn =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "taskDefinitionArn") in
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      make ?containerUids ?launchType ?taskDefinitionArn ?createdAt ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let containerUids =
        field_map json__ "ContainerUids" ContainerUids.of_json in
      let launchType = field_map json__ "LaunchType" EcsLaunchType.of_json in
      let taskDefinitionArn =
        field_map json__ "TaskDefinitionArn" String_.of_json in
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      make ?containerUids ?launchType ?taskDefinitionArn ?createdAt ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about Amazon ECS task involved in a GuardDuty finding, including task definition and container identifiers."]
module EksCluster =
  struct
    type nonrec t =
      {
      arn: String_.t option
        [@ocaml.doc
          "The Amazon Resource Name (ARN) that uniquely identifies the Amazon EKS cluster involved in the finding."];
      createdAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp indicating when the Amazon EKS cluster was created, in UTC format."];
      status: ClusterStatus.t option
        [@ocaml.doc "The current status of the Amazon EKS cluster."];
      vpcId: String_.t option
        [@ocaml.doc
          "The ID of the Amazon Virtual Private Cloud (Amazon VPC) associated with the Amazon EKS cluster."];
      ec2InstanceUids: Ec2InstanceUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the Amazon EC2 instances that serve as worker nodes in the Amazon EKS cluster."]}
    let make ?arn =
      fun ?createdAt ->
        fun ?status ->
          fun ?vpcId ->
            fun ?ec2InstanceUids ->
              fun () -> { arn; createdAt; status; vpcId; ec2InstanceUids }
    let to_value x =
      structure_to_value
        [("arn", (Option.map x.arn ~f:String_.to_value));
        ("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value));
        ("status", (Option.map x.status ~f:ClusterStatus.to_value));
        ("vpcId", (Option.map x.vpcId ~f:String_.to_value));
        ("ec2InstanceUids",
          (Option.map x.ec2InstanceUids ~f:Ec2InstanceUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ec2InstanceUids =
        (Option.map ~f:Ec2InstanceUids.of_xml)
          (Xml.child xml_arg0 "ec2InstanceUids") in
      let vpcId = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "vpcId") in
      let status =
        (Option.map ~f:ClusterStatus.of_xml) (Xml.child xml_arg0 "status") in
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let arn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "arn") in
      make ?ec2InstanceUids ?vpcId ?status ?createdAt ?arn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ec2InstanceUids =
        field_map json__ "Ec2InstanceUids" Ec2InstanceUids.of_json in
      let vpcId = field_map json__ "VpcId" String_.of_json in
      let status = field_map json__ "Status" ClusterStatus.of_json in
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      let arn = field_map json__ "Arn" String_.of_json in
      make ?ec2InstanceUids ?vpcId ?status ?createdAt ?arn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon EKS cluster involved in a GuardDuty finding, including cluster identification, status, and network configuration."]
module IamInstanceProfileV2 =
  struct
    type nonrec t =
      {
      ec2InstanceUids: Ec2InstanceUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the compromised Amazon EC2 instances that share the same IAM instance profile."]}
    let make ?ec2InstanceUids = fun () -> { ec2InstanceUids }
    let to_value x =
      structure_to_value
        [("ec2InstanceUids",
           (Option.map x.ec2InstanceUids ~f:Ec2InstanceUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ec2InstanceUids =
        (Option.map ~f:Ec2InstanceUids.of_xml)
          (Xml.child xml_arg0 "ec2InstanceUids") in
      make ?ec2InstanceUids ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ec2InstanceUids =
        field_map json__ "Ec2InstanceUids" Ec2InstanceUids.of_json in
      make ?ec2InstanceUids ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the IAM instance profile involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances."]
module KubernetesWorkload =
  struct
    type nonrec t =
      {
      containerUids: ContainerUids.t option
        [@ocaml.doc
          "A list of unique identifiers for the containers that are part of the Kubernetes workload."];
      namespace: String_.t option
        [@ocaml.doc
          "The Kubernetes namespace in which the workload is running, providing logical isolation within the cluster."];
      kubernetesResourcesTypes: KubernetesResourcesTypes.t option
        [@ocaml.doc
          "The types of Kubernetes resources involved in the workload."]}
    let make ?containerUids =
      fun ?namespace ->
        fun ?kubernetesResourcesTypes ->
          fun () -> { containerUids; namespace; kubernetesResourcesTypes }
    let to_value x =
      structure_to_value
        [("containerUids",
           (Option.map x.containerUids ~f:ContainerUids.to_value));
        ("namespace", (Option.map x.namespace ~f:String_.to_value));
        ("type",
          (Option.map x.kubernetesResourcesTypes
             ~f:KubernetesResourcesTypes.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let kubernetesResourcesTypes =
        (Option.map ~f:KubernetesResourcesTypes.of_xml)
          (Xml.child xml_arg0 "type") in
      let namespace =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "namespace") in
      let containerUids =
        (Option.map ~f:ContainerUids.of_xml)
          (Xml.child xml_arg0 "containerUids") in
      make ?kubernetesResourcesTypes ?namespace ?containerUids ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let kubernetesResourcesTypes =
        field_map json__ "KubernetesResourcesTypes"
          KubernetesResourcesTypes.of_json in
      let namespace = field_map json__ "Namespace" String_.of_json in
      let containerUids =
        field_map json__ "ContainerUids" ContainerUids.of_json in
      make ?kubernetesResourcesTypes ?namespace ?containerUids ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about Kubernetes workloads involved in a GuardDuty finding, including pods, deployments, and other Kubernetes resources."]
module S3Bucket =
  struct
    type nonrec t =
      {
      ownerId: String_.t option
        [@ocaml.doc "The owner ID of the associated S3Amazon S3bucket."];
      createdAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the Amazon S3 bucket was created."];
      encryptionType: String_.t option
        [@ocaml.doc
          "The type of encryption used for the Amazon S3 buckets and its objects. For more information, see Protecting data with server-side encryption in the Amazon S3 User Guide."];
      encryptionKeyArn: String_.t option
        [@ocaml.doc
          "The Amazon Resource Name (ARN) of the encryption key that is used to encrypt the Amazon S3 bucket and its objects."];
      effectivePermission: String_.t option
        [@ocaml.doc
          "Describes the effective permissions on this S3 bucket, after factoring all the attached policies."];
      publicReadAccess: PublicAccessStatus.t option
        [@ocaml.doc
          "Indicates whether or not the public read access is allowed for an Amazon S3 bucket."];
      publicWriteAccess: PublicAccessStatus.t option
        [@ocaml.doc
          "Indicates whether or not the public write access is allowed for an Amazon S3 bucket."];
      accountPublicAccess: PublicAccessConfiguration.t option
        [@ocaml.doc
          "Contains information about the public access policies that apply to the Amazon S3 bucket at the account level."];
      bucketPublicAccess: PublicAccessConfiguration.t option
        [@ocaml.doc
          "Contains information about public access policies that apply to the Amazon S3 bucket."];
      s3ObjectUids: S3ObjectUids.t option
        [@ocaml.doc "Represents a list of Amazon S3 object identifiers."]}
    let make ?ownerId =
      fun ?createdAt ->
        fun ?encryptionType ->
          fun ?encryptionKeyArn ->
            fun ?effectivePermission ->
              fun ?publicReadAccess ->
                fun ?publicWriteAccess ->
                  fun ?accountPublicAccess ->
                    fun ?bucketPublicAccess ->
                      fun ?s3ObjectUids ->
                        fun () ->
                          {
                            ownerId;
                            createdAt;
                            encryptionType;
                            encryptionKeyArn;
                            effectivePermission;
                            publicReadAccess;
                            publicWriteAccess;
                            accountPublicAccess;
                            bucketPublicAccess;
                            s3ObjectUids
                          }
    let to_value x =
      structure_to_value
        [("ownerId", (Option.map x.ownerId ~f:String_.to_value));
        ("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value));
        ("encryptionType", (Option.map x.encryptionType ~f:String_.to_value));
        ("encryptionKeyArn",
          (Option.map x.encryptionKeyArn ~f:String_.to_value));
        ("effectivePermission",
          (Option.map x.effectivePermission ~f:String_.to_value));
        ("publicReadAccess",
          (Option.map x.publicReadAccess ~f:PublicAccessStatus.to_value));
        ("publicWriteAccess",
          (Option.map x.publicWriteAccess ~f:PublicAccessStatus.to_value));
        ("accountPublicAccess",
          (Option.map x.accountPublicAccess
             ~f:PublicAccessConfiguration.to_value));
        ("bucketPublicAccess",
          (Option.map x.bucketPublicAccess
             ~f:PublicAccessConfiguration.to_value));
        ("s3ObjectUids",
          (Option.map x.s3ObjectUids ~f:S3ObjectUids.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let s3ObjectUids =
        (Option.map ~f:S3ObjectUids.of_xml)
          (Xml.child xml_arg0 "s3ObjectUids") in
      let bucketPublicAccess =
        (Option.map ~f:PublicAccessConfiguration.of_xml)
          (Xml.child xml_arg0 "bucketPublicAccess") in
      let accountPublicAccess =
        (Option.map ~f:PublicAccessConfiguration.of_xml)
          (Xml.child xml_arg0 "accountPublicAccess") in
      let publicWriteAccess =
        (Option.map ~f:PublicAccessStatus.of_xml)
          (Xml.child xml_arg0 "publicWriteAccess") in
      let publicReadAccess =
        (Option.map ~f:PublicAccessStatus.of_xml)
          (Xml.child xml_arg0 "publicReadAccess") in
      let effectivePermission =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "effectivePermission") in
      let encryptionKeyArn =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "encryptionKeyArn") in
      let encryptionType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "encryptionType") in
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let ownerId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "ownerId") in
      make ?s3ObjectUids ?bucketPublicAccess ?accountPublicAccess
        ?publicWriteAccess ?publicReadAccess ?effectivePermission
        ?encryptionKeyArn ?encryptionType ?createdAt ?ownerId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let s3ObjectUids = field_map json__ "S3ObjectUids" S3ObjectUids.of_json in
      let bucketPublicAccess =
        field_map json__ "BucketPublicAccess"
          PublicAccessConfiguration.of_json in
      let accountPublicAccess =
        field_map json__ "AccountPublicAccess"
          PublicAccessConfiguration.of_json in
      let publicWriteAccess =
        field_map json__ "PublicWriteAccess" PublicAccessStatus.of_json in
      let publicReadAccess =
        field_map json__ "PublicReadAccess" PublicAccessStatus.of_json in
      let effectivePermission =
        field_map json__ "EffectivePermission" String_.of_json in
      let encryptionKeyArn =
        field_map json__ "EncryptionKeyArn" String_.of_json in
      let encryptionType = field_map json__ "EncryptionType" String_.of_json in
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      let ownerId = field_map json__ "OwnerId" String_.of_json in
      make ?s3ObjectUids ?bucketPublicAccess ?accountPublicAccess
        ?publicWriteAccess ?publicReadAccess ?effectivePermission
        ?encryptionKeyArn ?encryptionType ?createdAt ?ownerId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon S3 bucket policies and encryption."]
module S3Object =
  struct
    type nonrec t =
      {
      eTag: String_.t option
        [@ocaml.doc
          "The entity tag is a hash of the Amazon S3 object. The ETag reflects changes only to the contents of an object, and not its metadata."];
      key: String_.t option [@ocaml.doc "The key of the Amazon S3 object."];
      versionId: String_.t option
        [@ocaml.doc "The version Id of the Amazon S3 object."]}
    let make ?eTag =
      fun ?key -> fun ?versionId -> fun () -> { eTag; key; versionId }
    let to_value x =
      structure_to_value
        [("eTag", (Option.map x.eTag ~f:String_.to_value));
        ("key", (Option.map x.key ~f:String_.to_value));
        ("versionId", (Option.map x.versionId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let versionId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "versionId") in
      let key = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "key") in
      let eTag = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "eTag") in
      make ?versionId ?key ?eTag ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let versionId = field_map json__ "VersionId" String_.of_json in
      let key = field_map json__ "Key" String_.of_json in
      let eTag = field_map json__ "ETag" String_.of_json in
      make ?versionId ?key ?eTag ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the Amazon S3 object."]
module Tag =
  struct
    type nonrec t =
      {
      key: String_.t option
        [@ocaml.doc "Describes the key associated with the tag."];
      value: String_.t option
        [@ocaml.doc "Describes the value associated with the tag key."]}
    let make ?key = fun ?value -> fun () -> { key; value }
    let to_value x =
      structure_to_value
        [("key", (Option.map x.key ~f:String_.to_value));
        ("value", (Option.map x.value ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let value = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "value") in
      let key = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "key") in
      make ?value ?key ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let value = field_map json__ "Value" String_.of_json in
      let key = field_map json__ "Key" String_.of_json in make ?value ?key ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about a tag key-value pair."]
module Indicator =
  struct
    type nonrec t =
      {
      key: IndicatorType.t option
        [@ocaml.doc
          "Specific indicator keys observed in the attack sequence. For description of the valid values for key, see Attack sequence finding details in the Amazon GuardDuty User Guide."];
      values: IndicatorValues.t option
        [@ocaml.doc
          "Values associated with each indicator key. For example, if the indicator key is SUSPICIOUS_NETWORK, then the value will be the name of the network. If the indicator key is ATTACK_TACTIC, then the value will be one of the MITRE tactics."];
      title: IndicatorTitle.t option
        [@ocaml.doc "Title describing the indicator."]}
    let make ?key =
      fun ?values -> fun ?title -> fun () -> { key; values; title }
    let to_value x =
      structure_to_value
        [("key", (Option.map x.key ~f:IndicatorType.to_value));
        ("values", (Option.map x.values ~f:IndicatorValues.to_value));
        ("title", (Option.map x.title ~f:IndicatorTitle.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let title =
        (Option.map ~f:IndicatorTitle.of_xml) (Xml.child xml_arg0 "title") in
      let values =
        (Option.map ~f:IndicatorValues.of_xml) (Xml.child xml_arg0 "values") in
      let key =
        (Option.map ~f:IndicatorType.of_xml) (Xml.child xml_arg0 "key") in
      make ?title ?values ?key ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let title = field_map json__ "Title" IndicatorTitle.of_json in
      let values = field_map json__ "Values" IndicatorValues.of_json in
      let key = field_map json__ "Key" IndicatorType.of_json in
      make ?title ?values ?key ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the indicators that include a set of signals observed in an attack sequence."]
module FilePaths =
  struct
    type nonrec t = ScanFilePath.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ScanFilePath.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ScanFilePath.of_xml)
    let of_json j =
      list_of_json ~kind:"FilePaths" ~of_json:ScanFilePath.of_json j
    let to_json v = composed_to_json to_value v
  end
module AdditionalInfo =
  struct
    type nonrec t =
      {
      versionId: NonEmptyString.t option
        [@ocaml.doc "The version ID of the S3 object, if applicable."];
      deviceName: NonEmptyString.t option
        [@ocaml.doc "The device name of the EBS volume, if applicable."]}
    let make ?versionId =
      fun ?deviceName -> fun () -> { versionId; deviceName }
    let to_value x =
      structure_to_value
        [("versionId", (Option.map x.versionId ~f:NonEmptyString.to_value));
        ("deviceName", (Option.map x.deviceName ~f:NonEmptyString.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let deviceName =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "deviceName") in
      let versionId =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "versionId") in
      make ?deviceName ?versionId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let deviceName = field_map json__ "DeviceName" NonEmptyString.of_json in
      let versionId = field_map json__ "VersionId" NonEmptyString.of_json in
      make ?deviceName ?versionId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains additional information about the detected threat."]
module SecurityContext =
  struct
    type nonrec t =
      {
      privileged: Boolean.t option
        [@ocaml.doc "Whether the container is privileged."];
      allowPrivilegeEscalation: Boolean.t option
        [@ocaml.doc
          "Whether or not a container or a Kubernetes pod is allowed to gain more privileges than its parent process."]}
    let make ?privileged =
      fun ?allowPrivilegeEscalation ->
        fun () -> { privileged; allowPrivilegeEscalation }
    let to_value x =
      structure_to_value
        [("privileged", (Option.map x.privileged ~f:Boolean.to_value));
        ("allowPrivilegeEscalation",
          (Option.map x.allowPrivilegeEscalation ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let allowPrivilegeEscalation =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "allowPrivilegeEscalation") in
      let privileged =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "privileged") in
      make ?allowPrivilegeEscalation ?privileged ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let allowPrivilegeEscalation =
        field_map json__ "AllowPrivilegeEscalation" Boolean.of_json in
      let privileged = field_map json__ "Privileged" Boolean.of_json in
      make ?allowPrivilegeEscalation ?privileged ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Container security context."]
module VolumeMounts =
  struct
    type nonrec t = VolumeMount.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:VolumeMount.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:VolumeMount.of_xml)
    let of_json j =
      list_of_json ~kind:"VolumeMounts" ~of_json:VolumeMount.of_json j
    let to_json v = composed_to_json to_value v
  end
module HostPath =
  struct
    type nonrec t =
      {
      path: String_.t option
        [@ocaml.doc
          "Path of the file or directory on the host that the volume maps to."]}
    let make ?path = fun () -> { path }
    let to_value x =
      structure_to_value [("path", (Option.map x.path ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let path = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "path") in
      make ?path ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let path = field_map json__ "Path" String_.of_json in make ?path ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents a pre-existing file or directory on the host machine that the volume maps to."]
module AccountLevelPermissions =
  struct
    type nonrec t =
      {
      blockPublicAccess: BlockPublicAccess.t option
        [@ocaml.doc
          "Describes the S3 Block Public Access settings of the bucket's parent account."]}
    let make ?blockPublicAccess = fun () -> { blockPublicAccess }
    let to_value x =
      structure_to_value
        [("blockPublicAccess",
           (Option.map x.blockPublicAccess ~f:BlockPublicAccess.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let blockPublicAccess =
        (Option.map ~f:BlockPublicAccess.of_xml)
          (Xml.child xml_arg0 "blockPublicAccess") in
      make ?blockPublicAccess ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let blockPublicAccess =
        field_map json__ "BlockPublicAccess" BlockPublicAccess.of_json in
      make ?blockPublicAccess ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the account level permissions on the S3 bucket."]
module BucketLevelPermissions =
  struct
    type nonrec t =
      {
      accessControlList: AccessControlList.t option
        [@ocaml.doc
          "Contains information on how Access Control Policies are applied to the bucket."];
      bucketPolicy: BucketPolicy.t option
        [@ocaml.doc
          "Contains information on the bucket policies for the S3 bucket."];
      blockPublicAccess: BlockPublicAccess.t option
        [@ocaml.doc
          "Contains information on which account level S3 Block Public Access settings are applied to the S3 bucket."]}
    let make ?accessControlList =
      fun ?bucketPolicy ->
        fun ?blockPublicAccess ->
          fun () -> { accessControlList; bucketPolicy; blockPublicAccess }
    let to_value x =
      structure_to_value
        [("accessControlList",
           (Option.map x.accessControlList ~f:AccessControlList.to_value));
        ("bucketPolicy",
          (Option.map x.bucketPolicy ~f:BucketPolicy.to_value));
        ("blockPublicAccess",
          (Option.map x.blockPublicAccess ~f:BlockPublicAccess.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let blockPublicAccess =
        (Option.map ~f:BlockPublicAccess.of_xml)
          (Xml.child xml_arg0 "blockPublicAccess") in
      let bucketPolicy =
        (Option.map ~f:BucketPolicy.of_xml)
          (Xml.child xml_arg0 "bucketPolicy") in
      let accessControlList =
        (Option.map ~f:AccessControlList.of_xml)
          (Xml.child xml_arg0 "accessControlList") in
      make ?blockPublicAccess ?bucketPolicy ?accessControlList ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let blockPublicAccess =
        field_map json__ "BlockPublicAccess" BlockPublicAccess.of_json in
      let bucketPolicy = field_map json__ "BucketPolicy" BucketPolicy.of_json in
      let accessControlList =
        field_map json__ "AccessControlList" AccessControlList.of_json in
      make ?blockPublicAccess ?bucketPolicy ?accessControlList ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the bucket level permissions for the S3 bucket."]
module LocalIpDetails =
  struct
    type nonrec t =
      {
      ipAddressV4: SensitiveString.t option
        [@ocaml.doc "The IPv4 local address of the connection."];
      ipAddressV6: SensitiveString.t option
        [@ocaml.doc "The IPv6 local address of the connection."]}
    let make ?ipAddressV4 =
      fun ?ipAddressV6 -> fun () -> { ipAddressV4; ipAddressV6 }
    let to_value x =
      structure_to_value
        [("ipAddressV4",
           (Option.map x.ipAddressV4 ~f:SensitiveString.to_value));
        ("ipAddressV6",
          (Option.map x.ipAddressV6 ~f:SensitiveString.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ipAddressV6 =
        (Option.map ~f:SensitiveString.of_xml)
          (Xml.child xml_arg0 "ipAddressV6") in
      let ipAddressV4 =
        (Option.map ~f:SensitiveString.of_xml)
          (Xml.child xml_arg0 "ipAddressV4") in
      make ?ipAddressV6 ?ipAddressV4 ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ipAddressV6 =
        field_map json__ "IpAddressV6" SensitiveString.of_json in
      let ipAddressV4 =
        field_map json__ "IpAddressV4" SensitiveString.of_json in
      make ?ipAddressV6 ?ipAddressV4 ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the local IP address of the connection."]
module LocalPortDetails =
  struct
    type nonrec t =
      {
      port: Integer.t option
        [@ocaml.doc "The port number of the local connection."];
      portName: String_.t option
        [@ocaml.doc "The port name of the local connection."]}
    let make ?port = fun ?portName -> fun () -> { port; portName }
    let to_value x =
      structure_to_value
        [("port", (Option.map x.port ~f:Integer.to_value));
        ("portName", (Option.map x.portName ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let portName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "portName") in
      let port = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "port") in
      make ?portName ?port ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let portName = field_map json__ "PortName" String_.of_json in
      let port = field_map json__ "Port" Integer.of_json in
      make ?portName ?port ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the port for the local connection."]
module RemoteIpDetails =
  struct
    type nonrec t =
      {
      city: City.t option
        [@ocaml.doc "The city information of the remote IP address."];
      country: Country.t option
        [@ocaml.doc "The country code of the remote IP address."];
      geoLocation: GeoLocation.t option
        [@ocaml.doc "The location information of the remote IP address."];
      ipAddressV4: SensitiveString.t option
        [@ocaml.doc "The IPv4 remote address of the connection."];
      ipAddressV6: SensitiveString.t option
        [@ocaml.doc "The IPv6 remote address of the connection."];
      organization: Organization.t option
        [@ocaml.doc
          "The ISP organization information of the remote IP address."]}
    let make ?city =
      fun ?country ->
        fun ?geoLocation ->
          fun ?ipAddressV4 ->
            fun ?ipAddressV6 ->
              fun ?organization ->
                fun () ->
                  {
                    city;
                    country;
                    geoLocation;
                    ipAddressV4;
                    ipAddressV6;
                    organization
                  }
    let to_value x =
      structure_to_value
        [("city", (Option.map x.city ~f:City.to_value));
        ("country", (Option.map x.country ~f:Country.to_value));
        ("geoLocation", (Option.map x.geoLocation ~f:GeoLocation.to_value));
        ("ipAddressV4",
          (Option.map x.ipAddressV4 ~f:SensitiveString.to_value));
        ("ipAddressV6",
          (Option.map x.ipAddressV6 ~f:SensitiveString.to_value));
        ("organization",
          (Option.map x.organization ~f:Organization.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let organization =
        (Option.map ~f:Organization.of_xml)
          (Xml.child xml_arg0 "organization") in
      let ipAddressV6 =
        (Option.map ~f:SensitiveString.of_xml)
          (Xml.child xml_arg0 "ipAddressV6") in
      let ipAddressV4 =
        (Option.map ~f:SensitiveString.of_xml)
          (Xml.child xml_arg0 "ipAddressV4") in
      let geoLocation =
        (Option.map ~f:GeoLocation.of_xml) (Xml.child xml_arg0 "geoLocation") in
      let country =
        (Option.map ~f:Country.of_xml) (Xml.child xml_arg0 "country") in
      let city = (Option.map ~f:City.of_xml) (Xml.child xml_arg0 "city") in
      make ?organization ?ipAddressV6 ?ipAddressV4 ?geoLocation ?country
        ?city ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let organization = field_map json__ "Organization" Organization.of_json in
      let ipAddressV6 =
        field_map json__ "IpAddressV6" SensitiveString.of_json in
      let ipAddressV4 =
        field_map json__ "IpAddressV4" SensitiveString.of_json in
      let geoLocation = field_map json__ "GeoLocation" GeoLocation.of_json in
      let country = field_map json__ "Country" Country.of_json in
      let city = field_map json__ "City" City.of_json in
      make ?organization ?ipAddressV6 ?ipAddressV4 ?geoLocation ?country
        ?city ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the remote IP address of the connection."]
module AnomalyProfileFeatureObjects =
  struct
    type nonrec t = AnomalyObject.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:AnomalyObject.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:AnomalyObject.of_xml)
    let of_json j =
      list_of_json ~kind:"AnomalyProfileFeatureObjects"
        ~of_json:AnomalyObject.of_json j
    let to_json v = composed_to_json to_value v
  end
module AnomalyUnusualBehaviorFeature =
  struct
    type nonrec t = (String_.t * AnomalyObject.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            let (_ : string) = v in
                            let (_ : string) = chopped in
                            failwith
                              "no of_header for complex types String AnomalyObject"))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (String_.to_value x) |>
                    (fun x -> (AnomalyObject.to_value y) |> (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:String_.of_string
        ~of_json:AnomalyObject.of_json j
    let to_json v = composed_to_json to_value v
  end
module ActorProcess =
  struct
    type nonrec t =
      {
      name: ProcessName.t option
        [@ocaml.doc "The name of the process as it appears in the system."];
      path: ProcessPath.t option
        [@ocaml.doc
          "The full file path to the process executable on the system."];
      sha256: ProcessSha256.t option
        [@ocaml.doc
          "The SHA256 hash of the process executable file, which can be used for identification and verification purposes."]}
    let make ?name =
      fun ?path -> fun ?sha256 -> fun () -> { name; path; sha256 }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:ProcessName.to_value));
        ("path", (Option.map x.path ~f:ProcessPath.to_value));
        ("sha256", (Option.map x.sha256 ~f:ProcessSha256.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let sha256 =
        (Option.map ~f:ProcessSha256.of_xml) (Xml.child xml_arg0 "sha256") in
      let path =
        (Option.map ~f:ProcessPath.of_xml) (Xml.child xml_arg0 "path") in
      let name =
        (Option.map ~f:ProcessName.of_xml) (Xml.child xml_arg0 "name") in
      make ?sha256 ?path ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let sha256 = field_map json__ "Sha256" ProcessSha256.of_json in
      let path = field_map json__ "Path" ProcessPath.of_json in
      let name = field_map json__ "Name" ProcessName.of_json in
      make ?sha256 ?path ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about a process involved in a GuardDuty finding, including process identification, execution details, and file information."]
module Session =
  struct
    type nonrec t =
      {
      uid: String_.t option
        [@ocaml.doc "The unique identifier of the session."];
      mfaStatus: MfaStatus.t option
        [@ocaml.doc
          "Indicates whether or not multi-factor authencation (MFA) was used during authentication. In Amazon Web Services CloudTrail, you can find this value as userIdentity.sessionContext.attributes.mfaAuthenticated."];
      createdTime: Timestamp.t option
        [@ocaml.doc
          "The timestamp for when the session was created. In Amazon Web Services CloudTrail, you can find this value as userIdentity.sessionContext.attributes.creationDate."];
      issuer: String_.t option
        [@ocaml.doc
          "Identifier of the session issuer. In Amazon Web Services CloudTrail, you can find this value as userIdentity.sessionContext.sessionIssuer.arn."]}
    let make ?uid =
      fun ?mfaStatus ->
        fun ?createdTime ->
          fun ?issuer -> fun () -> { uid; mfaStatus; createdTime; issuer }
    let to_value x =
      structure_to_value
        [("uid", (Option.map x.uid ~f:String_.to_value));
        ("mfaStatus", (Option.map x.mfaStatus ~f:MfaStatus.to_value));
        ("createdTime", (Option.map x.createdTime ~f:Timestamp.to_value));
        ("issuer", (Option.map x.issuer ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let issuer =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "issuer") in
      let createdTime =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdTime") in
      let mfaStatus =
        (Option.map ~f:MfaStatus.of_xml) (Xml.child xml_arg0 "mfaStatus") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      make ?issuer ?createdTime ?mfaStatus ?uid ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let issuer = field_map json__ "Issuer" String_.of_json in
      let createdTime = field_map json__ "CreatedTime" Timestamp.of_json in
      let mfaStatus = field_map json__ "MfaStatus" MfaStatus.of_json in
      let uid = field_map json__ "Uid" String_.of_json in
      make ?issuer ?createdTime ?mfaStatus ?uid ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the authenticated session."]
module User =
  struct
    type nonrec t =
      {
      name: String_.t option [@ocaml.doc "The name of the user."];
      uid: String_.t option [@ocaml.doc "The unique identifier of the user."];
      type_: String_.t option [@ocaml.doc "The type of the user."];
      credentialUid: String_.t option
        [@ocaml.doc "The credentials of the user ID."];
      account: Account.t option
        [@ocaml.doc
          "Contains information about the Amazon Web Services account within which the activity took place. This is not necessarily the account that owns the user identity."]}
    let make ?name =
      fun ?uid ->
        fun ?type_ ->
          fun ?credentialUid ->
            fun ?account ->
              fun () -> { name; uid; type_; credentialUid; account }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("uid", (Option.map x.uid ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value));
        ("credentialUid", (Option.map x.credentialUid ~f:String_.to_value));
        ("account", (Option.map x.account ~f:Account.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let account =
        (Option.map ~f:Account.of_xml) (Xml.child xml_arg0 "account") in
      let credentialUid =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "credentialUid") in
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?account ?credentialUid ?type_ ?uid ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let account = field_map json__ "Account" Account.of_json in
      let credentialUid = field_map json__ "CredentialUid" String_.of_json in
      let type_ = field_map json__ "Type" String_.of_json in
      let uid = field_map json__ "Uid" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?account ?credentialUid ?type_ ?uid ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the user involved in the attack sequence."]
module AutonomousSystem =
  struct
    type nonrec t =
      {
      name: String_.t option
        [@ocaml.doc "Name associated with the Autonomous System (AS)."];
      number: Integer.t option
        [@ocaml.doc
          "The unique number that identifies the Autonomous System (AS)."]}
    let make ?name = fun ?number -> fun () -> { name; number }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("number", (Option.map x.number ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let number =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "number") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?number ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let number = field_map json__ "Number" Integer.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?number ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Autonomous System (AS) associated with the network endpoints involved in an attack sequence."]
module NetworkConnection =
  struct
    type nonrec t =
      {
      direction: NetworkDirection.t option
        [@ocaml.doc "The direction in which the network traffic is flowing."]}
    let make ?direction = fun () -> { direction }
    let to_value x =
      structure_to_value
        [("direction", (Option.map x.direction ~f:NetworkDirection.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let direction =
        (Option.map ~f:NetworkDirection.of_xml)
          (Xml.child xml_arg0 "direction") in
      make ?direction ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let direction = field_map json__ "Direction" NetworkDirection.of_json in
      make ?direction ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the network connection."]
module NetworkGeoLocation =
  struct
    type nonrec t =
      {
      city: String_.t option [@ocaml.doc "The name of the city."];
      country: String_.t option [@ocaml.doc "The name of the country."];
      latitude: Double.t option
        [@ocaml.doc "The latitude information of the endpoint location."];
      longitude: Double.t option
        [@ocaml.doc "The longitude information of the endpoint location."]}
    let make ?city =
      fun ?country ->
        fun ?latitude ->
          fun ?longitude -> fun () -> { city; country; latitude; longitude }
    let to_value x =
      structure_to_value
        [("city", (Option.map x.city ~f:String_.to_value));
        ("country", (Option.map x.country ~f:String_.to_value));
        ("lat", (Option.map x.latitude ~f:Double.to_value));
        ("lon", (Option.map x.longitude ~f:Double.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let longitude =
        (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "lon") in
      let latitude = (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "lat") in
      let country =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "country") in
      let city = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "city") in
      make ?longitude ?latitude ?country ?city ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let longitude = field_map json__ "Longitude" Double.of_json in
      let latitude = field_map json__ "Latitude" Double.of_json in
      let country = field_map json__ "Country" String_.of_json in
      let city = field_map json__ "City" String_.of_json in
      make ?longitude ?latitude ?country ?city ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about network endpoint location."]
module FindingResourceType =
  struct
    type nonrec t =
      | EC2_INSTANCE 
      | EC2_NETWORK_INTERFACE 
      | S3_BUCKET 
      | S3_OBJECT 
      | ACCESS_KEY 
      | EKS_CLUSTER 
      | KUBERNETES_WORKLOAD 
      | CONTAINER 
      | ECS_CLUSTER 
      | ECS_TASK 
      | AUTOSCALING_AUTO_SCALING_GROUP 
      | IAM_INSTANCE_PROFILE 
      | CLOUDFORMATION_STACK 
      | EC2_LAUNCH_TEMPLATE 
      | EC2_VPC 
      | EC2_IMAGE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | EC2_INSTANCE -> "EC2_INSTANCE"
      | EC2_NETWORK_INTERFACE -> "EC2_NETWORK_INTERFACE"
      | S3_BUCKET -> "S3_BUCKET"
      | S3_OBJECT -> "S3_OBJECT"
      | ACCESS_KEY -> "ACCESS_KEY"
      | EKS_CLUSTER -> "EKS_CLUSTER"
      | KUBERNETES_WORKLOAD -> "KUBERNETES_WORKLOAD"
      | CONTAINER -> "CONTAINER"
      | ECS_CLUSTER -> "ECS_CLUSTER"
      | ECS_TASK -> "ECS_TASK"
      | AUTOSCALING_AUTO_SCALING_GROUP -> "AUTOSCALING_AUTO_SCALING_GROUP"
      | IAM_INSTANCE_PROFILE -> "IAM_INSTANCE_PROFILE"
      | CLOUDFORMATION_STACK -> "CLOUDFORMATION_STACK"
      | EC2_LAUNCH_TEMPLATE -> "EC2_LAUNCH_TEMPLATE"
      | EC2_VPC -> "EC2_VPC"
      | EC2_IMAGE -> "EC2_IMAGE"
      | Non_static_id s -> s
    let of_string =
      function
      | "EC2_INSTANCE" -> EC2_INSTANCE
      | "EC2_NETWORK_INTERFACE" -> EC2_NETWORK_INTERFACE
      | "S3_BUCKET" -> S3_BUCKET
      | "S3_OBJECT" -> S3_OBJECT
      | "ACCESS_KEY" -> ACCESS_KEY
      | "EKS_CLUSTER" -> EKS_CLUSTER
      | "KUBERNETES_WORKLOAD" -> KUBERNETES_WORKLOAD
      | "CONTAINER" -> CONTAINER
      | "ECS_CLUSTER" -> ECS_CLUSTER
      | "ECS_TASK" -> ECS_TASK
      | "AUTOSCALING_AUTO_SCALING_GROUP" -> AUTOSCALING_AUTO_SCALING_GROUP
      | "IAM_INSTANCE_PROFILE" -> IAM_INSTANCE_PROFILE
      | "CLOUDFORMATION_STACK" -> CLOUDFORMATION_STACK
      | "EC2_LAUNCH_TEMPLATE" -> EC2_LAUNCH_TEMPLATE
      | "EC2_VPC" -> EC2_VPC
      | "EC2_IMAGE" -> EC2_IMAGE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration FindingResourceType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"FindingResourceType" j)
    let to_json = simple_to_json to_value
  end
module ResourceData =
  struct
    type nonrec t =
      {
      s3Bucket: S3Bucket.t option
        [@ocaml.doc "Contains information about the Amazon S3 bucket."];
      ec2Instance: Ec2Instance.t option
        [@ocaml.doc "Contains information about the Amazon EC2 instance."];
      accessKey: AccessKey.t option
        [@ocaml.doc
          "Contains information about the IAM access key details of a user that involved in the GuardDuty finding."];
      ec2NetworkInterface: Ec2NetworkInterface.t option
        [@ocaml.doc
          "Contains information about the elastic network interface of the Amazon EC2 instance."];
      s3Object: S3Object.t option
        [@ocaml.doc "Contains information about the Amazon S3 object."];
      eksCluster: EksCluster.t option
        [@ocaml.doc
          "Contains detailed information about the Amazon EKS cluster associated with the activity that prompted GuardDuty to generate a finding."];
      kubernetesWorkload: KubernetesWorkload.t option
        [@ocaml.doc
          "Contains detailed information about the Kubernetes workload associated with the activity that prompted GuardDuty to generate a finding."];
      container: ContainerFindingResource.t option
        [@ocaml.doc
          "Contains detailed information about the container associated with the activity that prompted GuardDuty to generate a finding."];
      ecsCluster: EcsCluster.t option
        [@ocaml.doc
          "Contains detailed information about the Amazon ECS cluster associated with the activity that prompted GuardDuty to generate a finding."];
      ecsTask: EcsTask.t option
        [@ocaml.doc
          "Contains detailed information about the Amazon ECS task associated with the activity that prompted GuardDuty to generate a finding."];
      iamInstanceProfile: IamInstanceProfileV2.t option
        [@ocaml.doc
          "Contains detailed information about the IAM instance profile associated with the activity that prompted GuardDuty to generate a finding."];
      autoscalingAutoScalingGroup: AutoscalingAutoScalingGroup.t option
        [@ocaml.doc
          "Contains detailed information about the Auto Scaling Group associated with the activity that prompted GuardDuty to generate a finding."];
      ec2LaunchTemplate: Ec2LaunchTemplate.t option
        [@ocaml.doc
          "Contains detailed information about the EC2 launch template associated with the activity that prompted GuardDuty to generate a finding."];
      ec2Vpc: Ec2Vpc.t option
        [@ocaml.doc
          "Contains detailed information about the EC2 VPC associated with the activity that prompted GuardDuty to generate a finding."];
      ec2Image: Ec2Image.t option
        [@ocaml.doc
          "Contains detailed information about the EC2 Image associated with the activity that prompted GuardDuty to generate a finding."];
      cloudformationStack: CloudformationStack.t option
        [@ocaml.doc
          "Contains detailed information about the CloudFormation stack associated with the activity that prompted GuardDuty to generate a finding."]}
    let make ?s3Bucket =
      fun ?ec2Instance ->
        fun ?accessKey ->
          fun ?ec2NetworkInterface ->
            fun ?s3Object ->
              fun ?eksCluster ->
                fun ?kubernetesWorkload ->
                  fun ?container ->
                    fun ?ecsCluster ->
                      fun ?ecsTask ->
                        fun ?iamInstanceProfile ->
                          fun ?autoscalingAutoScalingGroup ->
                            fun ?ec2LaunchTemplate ->
                              fun ?ec2Vpc ->
                                fun ?ec2Image ->
                                  fun ?cloudformationStack ->
                                    fun () ->
                                      {
                                        s3Bucket;
                                        ec2Instance;
                                        accessKey;
                                        ec2NetworkInterface;
                                        s3Object;
                                        eksCluster;
                                        kubernetesWorkload;
                                        container;
                                        ecsCluster;
                                        ecsTask;
                                        iamInstanceProfile;
                                        autoscalingAutoScalingGroup;
                                        ec2LaunchTemplate;
                                        ec2Vpc;
                                        ec2Image;
                                        cloudformationStack
                                      }
    let to_value x =
      structure_to_value
        [("s3Bucket", (Option.map x.s3Bucket ~f:S3Bucket.to_value));
        ("ec2Instance", (Option.map x.ec2Instance ~f:Ec2Instance.to_value));
        ("accessKey", (Option.map x.accessKey ~f:AccessKey.to_value));
        ("ec2NetworkInterface",
          (Option.map x.ec2NetworkInterface ~f:Ec2NetworkInterface.to_value));
        ("s3Object", (Option.map x.s3Object ~f:S3Object.to_value));
        ("eksCluster", (Option.map x.eksCluster ~f:EksCluster.to_value));
        ("kubernetesWorkload",
          (Option.map x.kubernetesWorkload ~f:KubernetesWorkload.to_value));
        ("container",
          (Option.map x.container ~f:ContainerFindingResource.to_value));
        ("ecsCluster", (Option.map x.ecsCluster ~f:EcsCluster.to_value));
        ("ecsTask", (Option.map x.ecsTask ~f:EcsTask.to_value));
        ("iamInstanceProfile",
          (Option.map x.iamInstanceProfile ~f:IamInstanceProfileV2.to_value));
        ("autoscalingAutoScalingGroup",
          (Option.map x.autoscalingAutoScalingGroup
             ~f:AutoscalingAutoScalingGroup.to_value));
        ("ec2LaunchTemplate",
          (Option.map x.ec2LaunchTemplate ~f:Ec2LaunchTemplate.to_value));
        ("ec2Vpc", (Option.map x.ec2Vpc ~f:Ec2Vpc.to_value));
        ("ec2Image", (Option.map x.ec2Image ~f:Ec2Image.to_value));
        ("cloudformationStack",
          (Option.map x.cloudformationStack ~f:CloudformationStack.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let cloudformationStack =
        (Option.map ~f:CloudformationStack.of_xml)
          (Xml.child xml_arg0 "cloudformationStack") in
      let ec2Image =
        (Option.map ~f:Ec2Image.of_xml) (Xml.child xml_arg0 "ec2Image") in
      let ec2Vpc =
        (Option.map ~f:Ec2Vpc.of_xml) (Xml.child xml_arg0 "ec2Vpc") in
      let ec2LaunchTemplate =
        (Option.map ~f:Ec2LaunchTemplate.of_xml)
          (Xml.child xml_arg0 "ec2LaunchTemplate") in
      let autoscalingAutoScalingGroup =
        (Option.map ~f:AutoscalingAutoScalingGroup.of_xml)
          (Xml.child xml_arg0 "autoscalingAutoScalingGroup") in
      let iamInstanceProfile =
        (Option.map ~f:IamInstanceProfileV2.of_xml)
          (Xml.child xml_arg0 "iamInstanceProfile") in
      let ecsTask =
        (Option.map ~f:EcsTask.of_xml) (Xml.child xml_arg0 "ecsTask") in
      let ecsCluster =
        (Option.map ~f:EcsCluster.of_xml) (Xml.child xml_arg0 "ecsCluster") in
      let container =
        (Option.map ~f:ContainerFindingResource.of_xml)
          (Xml.child xml_arg0 "container") in
      let kubernetesWorkload =
        (Option.map ~f:KubernetesWorkload.of_xml)
          (Xml.child xml_arg0 "kubernetesWorkload") in
      let eksCluster =
        (Option.map ~f:EksCluster.of_xml) (Xml.child xml_arg0 "eksCluster") in
      let s3Object =
        (Option.map ~f:S3Object.of_xml) (Xml.child xml_arg0 "s3Object") in
      let ec2NetworkInterface =
        (Option.map ~f:Ec2NetworkInterface.of_xml)
          (Xml.child xml_arg0 "ec2NetworkInterface") in
      let accessKey =
        (Option.map ~f:AccessKey.of_xml) (Xml.child xml_arg0 "accessKey") in
      let ec2Instance =
        (Option.map ~f:Ec2Instance.of_xml) (Xml.child xml_arg0 "ec2Instance") in
      let s3Bucket =
        (Option.map ~f:S3Bucket.of_xml) (Xml.child xml_arg0 "s3Bucket") in
      make ?cloudformationStack ?ec2Image ?ec2Vpc ?ec2LaunchTemplate
        ?autoscalingAutoScalingGroup ?iamInstanceProfile ?ecsTask ?ecsCluster
        ?container ?kubernetesWorkload ?eksCluster ?s3Object
        ?ec2NetworkInterface ?accessKey ?ec2Instance ?s3Bucket ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let cloudformationStack =
        field_map json__ "CloudformationStack" CloudformationStack.of_json in
      let ec2Image = field_map json__ "Ec2Image" Ec2Image.of_json in
      let ec2Vpc = field_map json__ "Ec2Vpc" Ec2Vpc.of_json in
      let ec2LaunchTemplate =
        field_map json__ "Ec2LaunchTemplate" Ec2LaunchTemplate.of_json in
      let autoscalingAutoScalingGroup =
        field_map json__ "AutoscalingAutoScalingGroup"
          AutoscalingAutoScalingGroup.of_json in
      let iamInstanceProfile =
        field_map json__ "IamInstanceProfile" IamInstanceProfileV2.of_json in
      let ecsTask = field_map json__ "EcsTask" EcsTask.of_json in
      let ecsCluster = field_map json__ "EcsCluster" EcsCluster.of_json in
      let container =
        field_map json__ "Container" ContainerFindingResource.of_json in
      let kubernetesWorkload =
        field_map json__ "KubernetesWorkload" KubernetesWorkload.of_json in
      let eksCluster = field_map json__ "EksCluster" EksCluster.of_json in
      let s3Object = field_map json__ "S3Object" S3Object.of_json in
      let ec2NetworkInterface =
        field_map json__ "Ec2NetworkInterface" Ec2NetworkInterface.of_json in
      let accessKey = field_map json__ "AccessKey" AccessKey.of_json in
      let ec2Instance = field_map json__ "Ec2Instance" Ec2Instance.of_json in
      let s3Bucket = field_map json__ "S3Bucket" S3Bucket.of_json in
      make ?cloudformationStack ?ec2Image ?ec2Vpc ?ec2LaunchTemplate
        ?autoscalingAutoScalingGroup ?iamInstanceProfile ?ecsTask ?ecsCluster
        ?container ?kubernetesWorkload ?eksCluster ?s3Object
        ?ec2NetworkInterface ?accessKey ?ec2Instance ?s3Bucket ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon Web Services resource that is associated with the activity that prompted GuardDuty to generate a finding."]
module Tags =
  struct
    type nonrec t = Tag.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Tag.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Tag.of_xml)
    let of_json j = list_of_json ~kind:"Tags" ~of_json:Tag.of_json j
    let to_json v = composed_to_json to_value v
  end
module ActorIds =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:400) >>=
             (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"ActorIds" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module EndpointIds =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:400) >>=
             (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"EndpointIds" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module Indicators =
  struct
    type nonrec t = Indicator.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:400) >>=
             (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Indicator.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Indicator.of_xml)
    let of_json j =
      list_of_json ~kind:"Indicators" ~of_json:Indicator.of_json j
    let to_json v = composed_to_json to_value v
  end
module ResourceUids =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:400) >>=
             (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"ResourceUids" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module SignalDescription =
  struct
    type nonrec t = string
    let context_ = "SignalDescription"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:2000) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"SignalDescription" j
    let to_json = simple_to_json to_value
  end
module SignalType =
  struct
    type nonrec t =
      | FINDING 
      | CLOUD_TRAIL 
      | S3_DATA_EVENTS 
      | EKS_AUDIT_LOGS 
      | FLOW_LOGS 
      | DNS_LOGS 
      | RUNTIME_MONITORING 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | FINDING -> "FINDING"
      | CLOUD_TRAIL -> "CLOUD_TRAIL"
      | S3_DATA_EVENTS -> "S3_DATA_EVENTS"
      | EKS_AUDIT_LOGS -> "EKS_AUDIT_LOGS"
      | FLOW_LOGS -> "FLOW_LOGS"
      | DNS_LOGS -> "DNS_LOGS"
      | RUNTIME_MONITORING -> "RUNTIME_MONITORING"
      | Non_static_id s -> s
    let of_string =
      function
      | "FINDING" -> FINDING
      | "CLOUD_TRAIL" -> CLOUD_TRAIL
      | "S3_DATA_EVENTS" -> S3_DATA_EVENTS
      | "EKS_AUDIT_LOGS" -> EKS_AUDIT_LOGS
      | "FLOW_LOGS" -> FLOW_LOGS
      | "DNS_LOGS" -> DNS_LOGS
      | "RUNTIME_MONITORING" -> RUNTIME_MONITORING
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration SignalType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"SignalType" j)
    let to_json = simple_to_json to_value
  end
module ScanThreatName =
  struct
    type nonrec t =
      {
      name: String_.t option
        [@ocaml.doc "The name of the identified threat."];
      severity: String_.t option
        [@ocaml.doc
          "Severity of threat identified as part of the malware scan."];
      itemCount: Integer.t option
        [@ocaml.doc "Total number of files infected with given threat."];
      filePaths: FilePaths.t option
        [@ocaml.doc "List of infected files in EBS volume with details."]}
    let make ?name =
      fun ?severity ->
        fun ?itemCount ->
          fun ?filePaths ->
            fun () -> { name; severity; itemCount; filePaths }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("severity", (Option.map x.severity ~f:String_.to_value));
        ("itemCount", (Option.map x.itemCount ~f:Integer.to_value));
        ("filePaths", (Option.map x.filePaths ~f:FilePaths.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let filePaths =
        (Option.map ~f:FilePaths.of_xml) (Xml.child xml_arg0 "filePaths") in
      let itemCount =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "itemCount") in
      let severity =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "severity") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?filePaths ?itemCount ?severity ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let filePaths = field_map json__ "FilePaths" FilePaths.of_json in
      let itemCount = field_map json__ "ItemCount" Integer.of_json in
      let severity = field_map json__ "Severity" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?filePaths ?itemCount ?severity ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains files infected with the given threat providing details of malware name and severity."]
module ItemDetails =
  struct
    type nonrec t =
      {
      resourceArn: NonEmptyString.t option
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the resource where the threat was detected."];
      itemPath: NonEmptyString.t option
        [@ocaml.doc "The path where the threat was detected."];
      hash: String_.t option
        [@ocaml.doc "The hash value of the infected item."];
      additionalInfo: AdditionalInfo.t option
        [@ocaml.doc "Additional information about the detected threat item."]}
    let make ?resourceArn =
      fun ?itemPath ->
        fun ?hash ->
          fun ?additionalInfo ->
            fun () -> { resourceArn; itemPath; hash; additionalInfo }
    let to_value x =
      structure_to_value
        [("resourceArn",
           (Option.map x.resourceArn ~f:NonEmptyString.to_value));
        ("itemPath", (Option.map x.itemPath ~f:NonEmptyString.to_value));
        ("hash", (Option.map x.hash ~f:String_.to_value));
        ("additionalInfo",
          (Option.map x.additionalInfo ~f:AdditionalInfo.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalInfo =
        (Option.map ~f:AdditionalInfo.of_xml)
          (Xml.child xml_arg0 "additionalInfo") in
      let hash = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "hash") in
      let itemPath =
        (Option.map ~f:NonEmptyString.of_xml) (Xml.child xml_arg0 "itemPath") in
      let resourceArn =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "resourceArn") in
      make ?additionalInfo ?hash ?itemPath ?resourceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalInfo =
        field_map json__ "AdditionalInfo" AdditionalInfo.of_json in
      let hash = field_map json__ "Hash" String_.of_json in
      let itemPath = field_map json__ "ItemPath" NonEmptyString.of_json in
      let resourceArn = field_map json__ "ResourceArn" NonEmptyString.of_json in
      make ?additionalInfo ?hash ?itemPath ?resourceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains detailed information about where a threat was detected."]
module ItemPath =
  struct
    type nonrec t =
      {
      nestedItemPath: String_.t option
        [@ocaml.doc
          "The nested item path where the infected file was found."];
      hash: String_.t option
        [@ocaml.doc "The hash value of the infected resource."]}
    let make ?nestedItemPath =
      fun ?hash -> fun () -> { nestedItemPath; hash }
    let to_value x =
      structure_to_value
        [("nestedItemPath",
           (Option.map x.nestedItemPath ~f:String_.to_value));
        ("hash", (Option.map x.hash ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let hash = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "hash") in
      let nestedItemPath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nestedItemPath") in
      make ?hash ?nestedItemPath ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let hash = field_map json__ "Hash" String_.of_json in
      let nestedItemPath = field_map json__ "NestedItemPath" String_.of_json in
      make ?hash ?nestedItemPath ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the nested item path and hash of the protected resource."]
module LineageObject =
  struct
    type nonrec t =
      {
      startTime: Timestamp.t option
        [@ocaml.doc
          "The time when the process started. This is in UTC format."];
      namespacePid: Integer.t option
        [@ocaml.doc "The process ID of the child process."];
      userId: Integer.t option
        [@ocaml.doc "The user ID of the user that executed the process."];
      name: String_.t option [@ocaml.doc "The name of the process."];
      pid: Integer.t option [@ocaml.doc "The ID of the process."];
      uuid: String_.t option
        [@ocaml.doc "The unique ID assigned to the process by GuardDuty."];
      executablePath: String_.t option
        [@ocaml.doc "The absolute path of the process executable file."];
      euid: Integer.t option
        [@ocaml.doc
          "The effective user ID that was used to execute the process."];
      parentUuid: String_.t option
        [@ocaml.doc
          "The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty."]}
    let make ?startTime =
      fun ?namespacePid ->
        fun ?userId ->
          fun ?name ->
            fun ?pid ->
              fun ?uuid ->
                fun ?executablePath ->
                  fun ?euid ->
                    fun ?parentUuid ->
                      fun () ->
                        {
                          startTime;
                          namespacePid;
                          userId;
                          name;
                          pid;
                          uuid;
                          executablePath;
                          euid;
                          parentUuid
                        }
    let to_value x =
      structure_to_value
        [("startTime", (Option.map x.startTime ~f:Timestamp.to_value));
        ("namespacePid", (Option.map x.namespacePid ~f:Integer.to_value));
        ("userId", (Option.map x.userId ~f:Integer.to_value));
        ("name", (Option.map x.name ~f:String_.to_value));
        ("pid", (Option.map x.pid ~f:Integer.to_value));
        ("uuid", (Option.map x.uuid ~f:String_.to_value));
        ("executablePath", (Option.map x.executablePath ~f:String_.to_value));
        ("euid", (Option.map x.euid ~f:Integer.to_value));
        ("parentUuid", (Option.map x.parentUuid ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let parentUuid =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "parentUuid") in
      let euid = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "euid") in
      let executablePath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "executablePath") in
      let uuid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uuid") in
      let pid = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "pid") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      let userId =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "userId") in
      let namespacePid =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "namespacePid") in
      let startTime =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "startTime") in
      make ?parentUuid ?euid ?executablePath ?uuid ?pid ?name ?userId
        ?namespacePid ?startTime ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let parentUuid = field_map json__ "ParentUuid" String_.of_json in
      let euid = field_map json__ "Euid" Integer.of_json in
      let executablePath = field_map json__ "ExecutablePath" String_.of_json in
      let uuid = field_map json__ "Uuid" String_.of_json in
      let pid = field_map json__ "Pid" Integer.of_json in
      let name = field_map json__ "Name" String_.of_json in
      let userId = field_map json__ "UserId" Integer.of_json in
      let namespacePid = field_map json__ "NamespacePid" Integer.of_json in
      let startTime = field_map json__ "StartTime" Timestamp.of_json in
      make ?parentUuid ?euid ?executablePath ?uuid ?pid ?name ?userId
        ?namespacePid ?startTime ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the runtime process details."]
module OrgFeatureAdditionalConfiguration =
  struct
    type nonrec t =
      | EKS_ADDON_MANAGEMENT 
      | ECS_FARGATE_AGENT_MANAGEMENT 
      | EC2_AGENT_MANAGEMENT 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | EKS_ADDON_MANAGEMENT -> "EKS_ADDON_MANAGEMENT"
      | ECS_FARGATE_AGENT_MANAGEMENT -> "ECS_FARGATE_AGENT_MANAGEMENT"
      | EC2_AGENT_MANAGEMENT -> "EC2_AGENT_MANAGEMENT"
      | Non_static_id s -> s
    let of_string =
      function
      | "EKS_ADDON_MANAGEMENT" -> EKS_ADDON_MANAGEMENT
      | "ECS_FARGATE_AGENT_MANAGEMENT" -> ECS_FARGATE_AGENT_MANAGEMENT
      | "EC2_AGENT_MANAGEMENT" -> EC2_AGENT_MANAGEMENT
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration OrgFeatureAdditionalConfiguration"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"OrgFeatureAdditionalConfiguration" j)
    let to_json = simple_to_json to_value
  end
module DataSourceStatus =
  struct
    type nonrec t =
      | ENABLED 
      | DISABLED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ENABLED -> "ENABLED"
      | DISABLED -> "DISABLED"
      | Non_static_id s -> s
    let of_string =
      function
      | "ENABLED" -> ENABLED
      | "DISABLED" -> DISABLED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration DataSourceStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"DataSourceStatus" j)
    let to_json = simple_to_json to_value
  end
module FeatureStatus =
  struct
    type nonrec t =
      | ENABLED 
      | DISABLED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ENABLED -> "ENABLED"
      | DISABLED -> "DISABLED"
      | Non_static_id s -> s
    let of_string =
      function
      | "ENABLED" -> ENABLED
      | "DISABLED" -> DISABLED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration FeatureStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"FeatureStatus" j)
    let to_json = simple_to_json to_value
  end
module Container =
  struct
    type nonrec t =
      {
      containerRuntime: String_.t option
        [@ocaml.doc
          "The container runtime (such as, Docker or containerd) used to run the container."];
      id: String_.t option [@ocaml.doc "Container ID."];
      name: String_.t option [@ocaml.doc "Container name."];
      image: String_.t option [@ocaml.doc "Container image."];
      imagePrefix: String_.t option
        [@ocaml.doc
          "Part of the image name before the last slash. For example, imagePrefix for public.ecr.aws/amazonlinux/amazonlinux:latest would be public.ecr.aws/amazonlinux. If the image name is relative and does not have a slash, this field is empty."];
      volumeMounts: VolumeMounts.t option
        [@ocaml.doc "Container volume mounts."];
      securityContext: SecurityContext.t option
        [@ocaml.doc "Container security context."]}
    let make ?containerRuntime =
      fun ?id ->
        fun ?name ->
          fun ?image ->
            fun ?imagePrefix ->
              fun ?volumeMounts ->
                fun ?securityContext ->
                  fun () ->
                    {
                      containerRuntime;
                      id;
                      name;
                      image;
                      imagePrefix;
                      volumeMounts;
                      securityContext
                    }
    let to_value x =
      structure_to_value
        [("containerRuntime",
           (Option.map x.containerRuntime ~f:String_.to_value));
        ("id", (Option.map x.id ~f:String_.to_value));
        ("name", (Option.map x.name ~f:String_.to_value));
        ("image", (Option.map x.image ~f:String_.to_value));
        ("imagePrefix", (Option.map x.imagePrefix ~f:String_.to_value));
        ("volumeMounts",
          (Option.map x.volumeMounts ~f:VolumeMounts.to_value));
        ("securityContext",
          (Option.map x.securityContext ~f:SecurityContext.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let securityContext =
        (Option.map ~f:SecurityContext.of_xml)
          (Xml.child xml_arg0 "securityContext") in
      let volumeMounts =
        (Option.map ~f:VolumeMounts.of_xml)
          (Xml.child xml_arg0 "volumeMounts") in
      let imagePrefix =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "imagePrefix") in
      let image = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "image") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      let id = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "id") in
      let containerRuntime =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "containerRuntime") in
      make ?securityContext ?volumeMounts ?imagePrefix ?image ?name ?id
        ?containerRuntime ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let securityContext =
        field_map json__ "SecurityContext" SecurityContext.of_json in
      let volumeMounts = field_map json__ "VolumeMounts" VolumeMounts.of_json in
      let imagePrefix = field_map json__ "ImagePrefix" String_.of_json in
      let image = field_map json__ "Image" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      let id = field_map json__ "Id" String_.of_json in
      let containerRuntime =
        field_map json__ "ContainerRuntime" String_.of_json in
      make ?securityContext ?volumeMounts ?imagePrefix ?image ?name ?id
        ?containerRuntime ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Details of a container."]
module Volume =
  struct
    type nonrec t =
      {
      name: String_.t option [@ocaml.doc "Volume name."];
      hostPath: HostPath.t option
        [@ocaml.doc
          "Represents a pre-existing file or directory on the host machine that the volume maps to."]}
    let make ?name = fun ?hostPath -> fun () -> { name; hostPath }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("hostPath", (Option.map x.hostPath ~f:HostPath.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let hostPath =
        (Option.map ~f:HostPath.of_xml) (Xml.child xml_arg0 "hostPath") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?hostPath ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let hostPath = field_map json__ "HostPath" HostPath.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?hostPath ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Volume used by the Kubernetes workload."]
module Groups =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"Groups" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module PermissionConfiguration =
  struct
    type nonrec t =
      {
      bucketLevelPermissions: BucketLevelPermissions.t option
        [@ocaml.doc
          "Contains information about the bucket level permissions for the S3 bucket."];
      accountLevelPermissions: AccountLevelPermissions.t option
        [@ocaml.doc
          "Contains information about the account level permissions on the S3 bucket."]}
    let make ?bucketLevelPermissions =
      fun ?accountLevelPermissions ->
        fun () -> { bucketLevelPermissions; accountLevelPermissions }
    let to_value x =
      structure_to_value
        [("bucketLevelPermissions",
           (Option.map x.bucketLevelPermissions
              ~f:BucketLevelPermissions.to_value));
        ("accountLevelPermissions",
          (Option.map x.accountLevelPermissions
             ~f:AccountLevelPermissions.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountLevelPermissions =
        (Option.map ~f:AccountLevelPermissions.of_xml)
          (Xml.child xml_arg0 "accountLevelPermissions") in
      let bucketLevelPermissions =
        (Option.map ~f:BucketLevelPermissions.of_xml)
          (Xml.child xml_arg0 "bucketLevelPermissions") in
      make ?accountLevelPermissions ?bucketLevelPermissions ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountLevelPermissions =
        field_map json__ "AccountLevelPermissions"
          AccountLevelPermissions.of_json in
      let bucketLevelPermissions =
        field_map json__ "BucketLevelPermissions"
          BucketLevelPermissions.of_json in
      make ?accountLevelPermissions ?bucketLevelPermissions ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about how permissions are configured for the S3 bucket."]
module S3ObjectDetail =
  struct
    type nonrec t =
      {
      objectArn: String_.t option
        [@ocaml.doc "Amazon Resource Name (ARN) of the S3 object."];
      key: String_.t option [@ocaml.doc "Key of the S3 object."];
      eTag: String_.t option
        [@ocaml.doc
          "The entity tag is a hash of the S3 object. The ETag reflects changes only to the contents of an object, and not its metadata."];
      hash: String_.t option
        [@ocaml.doc "Hash of the threat detected in this finding."];
      versionId: String_.t option [@ocaml.doc "Version ID of the object."]}
    let make ?objectArn =
      fun ?key ->
        fun ?eTag ->
          fun ?hash ->
            fun ?versionId ->
              fun () -> { objectArn; key; eTag; hash; versionId }
    let to_value x =
      structure_to_value
        [("objectArn", (Option.map x.objectArn ~f:String_.to_value));
        ("key", (Option.map x.key ~f:String_.to_value));
        ("eTag", (Option.map x.eTag ~f:String_.to_value));
        ("hash", (Option.map x.hash ~f:String_.to_value));
        ("versionId", (Option.map x.versionId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let versionId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "versionId") in
      let hash = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "hash") in
      let eTag = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "eTag") in
      let key = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "key") in
      let objectArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "objectArn") in
      make ?versionId ?hash ?eTag ?key ?objectArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let versionId = field_map json__ "VersionId" String_.of_json in
      let hash = field_map json__ "Hash" String_.of_json in
      let eTag = field_map json__ "ETag" String_.of_json in
      let key = field_map json__ "Key" String_.of_json in
      let objectArn = field_map json__ "ObjectArn" String_.of_json in
      make ?versionId ?hash ?eTag ?key ?objectArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the S3 object that was scanned"]
module PortProbeDetail =
  struct
    type nonrec t =
      {
      localPortDetails: LocalPortDetails.t option
        [@ocaml.doc "The local port information of the connection."];
      localIpDetails: LocalIpDetails.t option
        [@ocaml.doc "The local IP information of the connection."];
      remoteIpDetails: RemoteIpDetails.t option
        [@ocaml.doc "The remote IP information of the connection."]}
    let make ?localPortDetails =
      fun ?localIpDetails ->
        fun ?remoteIpDetails ->
          fun () -> { localPortDetails; localIpDetails; remoteIpDetails }
    let to_value x =
      structure_to_value
        [("localPortDetails",
           (Option.map x.localPortDetails ~f:LocalPortDetails.to_value));
        ("localIpDetails",
          (Option.map x.localIpDetails ~f:LocalIpDetails.to_value));
        ("remoteIpDetails",
          (Option.map x.remoteIpDetails ~f:RemoteIpDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let remoteIpDetails =
        (Option.map ~f:RemoteIpDetails.of_xml)
          (Xml.child xml_arg0 "remoteIpDetails") in
      let localIpDetails =
        (Option.map ~f:LocalIpDetails.of_xml)
          (Xml.child xml_arg0 "localIpDetails") in
      let localPortDetails =
        (Option.map ~f:LocalPortDetails.of_xml)
          (Xml.child xml_arg0 "localPortDetails") in
      make ?remoteIpDetails ?localIpDetails ?localPortDetails ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let remoteIpDetails =
        field_map json__ "RemoteIpDetails" RemoteIpDetails.of_json in
      let localIpDetails =
        field_map json__ "LocalIpDetails" LocalIpDetails.of_json in
      let localPortDetails =
        field_map json__ "LocalPortDetails" LocalPortDetails.of_json in
      make ?remoteIpDetails ?localIpDetails ?localPortDetails ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the port probe details."]
module LoginAttribute =
  struct
    type nonrec t =
      {
      user: String_.t option
        [@ocaml.doc "Indicates the user name which attempted to log in."];
      application: String_.t option
        [@ocaml.doc "Indicates the application name used to attempt log in."];
      failedLoginAttempts: Integer.t option
        [@ocaml.doc
          "Represents the sum of failed (unsuccessful) login attempts made to establish a connection to the database instance."];
      successfulLoginAttempts: Integer.t option
        [@ocaml.doc
          "Represents the sum of successful connections (a correct combination of login attributes) made to the database instance by the actor."]}
    let make ?user =
      fun ?application ->
        fun ?failedLoginAttempts ->
          fun ?successfulLoginAttempts ->
            fun () ->
              {
                user;
                application;
                failedLoginAttempts;
                successfulLoginAttempts
              }
    let to_value x =
      structure_to_value
        [("user", (Option.map x.user ~f:String_.to_value));
        ("application", (Option.map x.application ~f:String_.to_value));
        ("failedLoginAttempts",
          (Option.map x.failedLoginAttempts ~f:Integer.to_value));
        ("successfulLoginAttempts",
          (Option.map x.successfulLoginAttempts ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let successfulLoginAttempts =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "successfulLoginAttempts") in
      let failedLoginAttempts =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "failedLoginAttempts") in
      let application =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "application") in
      let user = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "user") in
      make ?successfulLoginAttempts ?failedLoginAttempts ?application ?user
        ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let successfulLoginAttempts =
        field_map json__ "SuccessfulLoginAttempts" Integer.of_json in
      let failedLoginAttempts =
        field_map json__ "FailedLoginAttempts" Integer.of_json in
      let application = field_map json__ "Application" String_.of_json in
      let user = field_map json__ "User" String_.of_json in
      make ?successfulLoginAttempts ?failedLoginAttempts ?application ?user
        ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the login attempts."]
module AnomalyProfileFeatures =
  struct
    type nonrec t = (String_.t * AnomalyProfileFeatureObjects.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            let (_ : string) = v in
                            let (_ : string) = chopped in
                            failwith
                              "no of_header for complex types String AnomalyProfileFeatureObjects"))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (String_.to_value x) |>
                    (fun x ->
                       (AnomalyProfileFeatureObjects.to_value y) |>
                         (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:String_.of_string
        ~of_json:AnomalyProfileFeatureObjects.of_json j
    let to_json v = composed_to_json to_value v
  end
module Behavior =
  struct
    type nonrec t = (String_.t * AnomalyUnusualBehaviorFeature.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            let (_ : string) = v in
                            let (_ : string) = chopped in
                            failwith
                              "no of_header for complex types String AnomalyUnusualBehaviorFeature"))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (String_.to_value x) |>
                    (fun x ->
                       (AnomalyUnusualBehaviorFeature.to_value y) |>
                         (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:String_.of_string
        ~of_json:AnomalyUnusualBehaviorFeature.of_json j
    let to_json v = composed_to_json to_value v
  end
module Actor =
  struct
    type nonrec t =
      {
      id: String_.t option [@ocaml.doc "ID of the threat actor."];
      user: User.t option
        [@ocaml.doc
          "Contains information about the user credentials used by the threat actor."];
      session: Session.t option
        [@ocaml.doc
          "Contains information about the user session where the activity initiated."];
      process: ActorProcess.t option
        [@ocaml.doc
          "Contains information about the process associated with the threat actor. This includes details such as process name, path, execution time, and unique identifiers that help track the actor's activities within the system."]}
    let make ?id =
      fun ?user ->
        fun ?session ->
          fun ?process -> fun () -> { id; user; session; process }
    let to_value x =
      structure_to_value
        [("id", (Option.map x.id ~f:String_.to_value));
        ("user", (Option.map x.user ~f:User.to_value));
        ("session", (Option.map x.session ~f:Session.to_value));
        ("process", (Option.map x.process ~f:ActorProcess.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let process =
        (Option.map ~f:ActorProcess.of_xml) (Xml.child xml_arg0 "process") in
      let session =
        (Option.map ~f:Session.of_xml) (Xml.child xml_arg0 "session") in
      let user = (Option.map ~f:User.of_xml) (Xml.child xml_arg0 "user") in
      let id = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "id") in
      make ?process ?session ?user ?id ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let process = field_map json__ "Process" ActorProcess.of_json in
      let session = field_map json__ "Session" Session.of_json in
      let user = field_map json__ "User" User.of_json in
      let id = field_map json__ "Id" String_.of_json in
      make ?process ?session ?user ?id ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the actors involved in an attack sequence."]
module FindingType =
  struct
    type nonrec t = string
    let context_ = "FindingType"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:100) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"FindingType" j
    let to_json = simple_to_json to_value
  end
module NetworkEndpoint =
  struct
    type nonrec t =
      {
      id: String_.t option [@ocaml.doc "The ID of the network endpoint."];
      ip: String_.t option
        [@ocaml.doc "The IP address associated with the network endpoint."];
      domain: String_.t option
        [@ocaml.doc "The domain information for the network endpoint."];
      port: Integer.t option
        [@ocaml.doc "The port number associated with the network endpoint."];
      location: NetworkGeoLocation.t option
        [@ocaml.doc
          "Information about the location of the network endpoint."];
      autonomousSystem: AutonomousSystem.t option
        [@ocaml.doc "The Autonomous System (AS) of the network endpoint."];
      connection: NetworkConnection.t option
        [@ocaml.doc "Information about the network connection."]}
    let make ?id =
      fun ?ip ->
        fun ?domain ->
          fun ?port ->
            fun ?location ->
              fun ?autonomousSystem ->
                fun ?connection ->
                  fun () ->
                    {
                      id;
                      ip;
                      domain;
                      port;
                      location;
                      autonomousSystem;
                      connection
                    }
    let to_value x =
      structure_to_value
        [("id", (Option.map x.id ~f:String_.to_value));
        ("ip", (Option.map x.ip ~f:String_.to_value));
        ("domain", (Option.map x.domain ~f:String_.to_value));
        ("port", (Option.map x.port ~f:Integer.to_value));
        ("location", (Option.map x.location ~f:NetworkGeoLocation.to_value));
        ("autonomousSystem",
          (Option.map x.autonomousSystem ~f:AutonomousSystem.to_value));
        ("connection",
          (Option.map x.connection ~f:NetworkConnection.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let connection =
        (Option.map ~f:NetworkConnection.of_xml)
          (Xml.child xml_arg0 "connection") in
      let autonomousSystem =
        (Option.map ~f:AutonomousSystem.of_xml)
          (Xml.child xml_arg0 "autonomousSystem") in
      let location =
        (Option.map ~f:NetworkGeoLocation.of_xml)
          (Xml.child xml_arg0 "location") in
      let port = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "port") in
      let domain =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "domain") in
      let ip = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "ip") in
      let id = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "id") in
      make ?connection ?autonomousSystem ?location ?port ?domain ?ip ?id ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let connection =
        field_map json__ "Connection" NetworkConnection.of_json in
      let autonomousSystem =
        field_map json__ "AutonomousSystem" AutonomousSystem.of_json in
      let location = field_map json__ "Location" NetworkGeoLocation.of_json in
      let port = field_map json__ "Port" Integer.of_json in
      let domain = field_map json__ "Domain" String_.of_json in
      let ip = field_map json__ "Ip" String_.of_json in
      let id = field_map json__ "Id" String_.of_json in
      make ?connection ?autonomousSystem ?location ?port ?domain ?ip ?id ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about network endpoints that were observed in the attack sequence."]
module ResourceV2 =
  struct
    type nonrec t =
      {
      uid: String_.t option
        [@ocaml.doc "The unique identifier of the resource."];
      name: String_.t option [@ocaml.doc "The name of the resource."];
      accountId: String_.t option
        [@ocaml.doc
          "The Amazon Web Services account ID to which the resource belongs."];
      resourceType: FindingResourceType.t option
        [@ocaml.doc "The type of the Amazon Web Services resource."];
      region: String_.t option
        [@ocaml.doc
          "The Amazon Web Services Region where the resource belongs."];
      service: String_.t option
        [@ocaml.doc "The Amazon Web Services service of the resource."];
      cloudPartition: String_.t option
        [@ocaml.doc
          "The cloud partition within the Amazon Web Services Region to which the resource belongs."];
      tags: Tags.t option
        [@ocaml.doc
          "Contains information about the tags associated with the resource."];
      data: ResourceData.t option
        [@ocaml.doc
          "Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding."]}
    let make ?uid =
      fun ?name ->
        fun ?accountId ->
          fun ?resourceType ->
            fun ?region ->
              fun ?service ->
                fun ?cloudPartition ->
                  fun ?tags ->
                    fun ?data ->
                      fun () ->
                        {
                          uid;
                          name;
                          accountId;
                          resourceType;
                          region;
                          service;
                          cloudPartition;
                          tags;
                          data
                        }
    let to_value x =
      structure_to_value
        [("uid", (Option.map x.uid ~f:String_.to_value));
        ("name", (Option.map x.name ~f:String_.to_value));
        ("accountId", (Option.map x.accountId ~f:String_.to_value));
        ("resourceType",
          (Option.map x.resourceType ~f:FindingResourceType.to_value));
        ("region", (Option.map x.region ~f:String_.to_value));
        ("service", (Option.map x.service ~f:String_.to_value));
        ("cloudPartition", (Option.map x.cloudPartition ~f:String_.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value));
        ("data", (Option.map x.data ~f:ResourceData.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let data =
        (Option.map ~f:ResourceData.of_xml) (Xml.child xml_arg0 "data") in
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let cloudPartition =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "cloudPartition") in
      let service =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "service") in
      let region =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "region") in
      let resourceType =
        (Option.map ~f:FindingResourceType.of_xml)
          (Xml.child xml_arg0 "resourceType") in
      let accountId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "accountId") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      make ?data ?tags ?cloudPartition ?service ?region ?resourceType
        ?accountId ?name ?uid ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let data = field_map json__ "Data" ResourceData.of_json in
      let tags = field_map json__ "Tags" Tags.of_json in
      let cloudPartition = field_map json__ "CloudPartition" String_.of_json in
      let service = field_map json__ "Service" String_.of_json in
      let region = field_map json__ "Region" String_.of_json in
      let resourceType =
        field_map json__ "ResourceType" FindingResourceType.of_json in
      let accountId = field_map json__ "AccountId" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      let uid = field_map json__ "Uid" String_.of_json in
      make ?data ?tags ?cloudPartition ?service ?region ?resourceType
        ?accountId ?name ?uid ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon Web Services resource that is associated with the GuardDuty finding."]
module Signal =
  struct
    type nonrec t =
      {
      uid: String_.t option
        [@ocaml.doc "The unique identifier of the signal."];
      type_: SignalType.t option
        [@ocaml.doc
          "The type of the signal used to identify an attack sequence. Signals can be GuardDuty findings or activities observed in data sources that GuardDuty monitors. For more information, see Foundational data sources in the Amazon GuardDuty User Guide. A signal type can be one of the valid values listed in this API. Here are the related descriptions: FINDING - Individually generated GuardDuty finding. CLOUD_TRAIL - Activity observed from CloudTrail logs S3_DATA_EVENTS - Activity observed from CloudTrail data events for S3. Activities associated with this type will show up only when you have enabled GuardDuty S3 Protection feature in your account. For more information about S3 Protection and steps to enable it, see S3 Protection in the Amazon GuardDuty User Guide."];
      description: SignalDescription.t option
        [@ocaml.doc "The description of the signal."];
      name: String_.t option
        [@ocaml.doc
          "The name of the signal. For example, when signal type is FINDING, the signal name is the name of the finding."];
      createdAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the first finding or activity related to this signal was observed."];
      updatedAt: Timestamp.t option
        [@ocaml.doc "The timestamp when this signal was last observed."];
      firstSeenAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the first finding or activity related to this signal was observed."];
      lastSeenAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the last finding or activity related to this signal was observed."];
      severity: Double.t option
        [@ocaml.doc
          "The severity associated with the signal. For more information about severity, see Findings severity levels in the Amazon GuardDuty User Guide."];
      count: Integer.t option
        [@ocaml.doc "The number of times this signal was observed."];
      resourceUids: ResourceUids.t option
        [@ocaml.doc
          "Information about the unique identifiers of the resources involved in the signal."];
      actorIds: ActorIds.t option
        [@ocaml.doc
          "Information about the IDs of the threat actors involved in the signal."];
      endpointIds: EndpointIds.t option
        [@ocaml.doc
          "Information about the endpoint IDs associated with this signal."];
      signalIndicators: Indicators.t option
        [@ocaml.doc
          "Contains information about the indicators associated with the signals."]}
    let make ?uid =
      fun ?type_ ->
        fun ?description ->
          fun ?name ->
            fun ?createdAt ->
              fun ?updatedAt ->
                fun ?firstSeenAt ->
                  fun ?lastSeenAt ->
                    fun ?severity ->
                      fun ?count ->
                        fun ?resourceUids ->
                          fun ?actorIds ->
                            fun ?endpointIds ->
                              fun ?signalIndicators ->
                                fun () ->
                                  {
                                    uid;
                                    type_;
                                    description;
                                    name;
                                    createdAt;
                                    updatedAt;
                                    firstSeenAt;
                                    lastSeenAt;
                                    severity;
                                    count;
                                    resourceUids;
                                    actorIds;
                                    endpointIds;
                                    signalIndicators
                                  }
    let to_value x =
      structure_to_value
        [("uid", (Option.map x.uid ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:SignalType.to_value));
        ("description",
          (Option.map x.description ~f:SignalDescription.to_value));
        ("name", (Option.map x.name ~f:String_.to_value));
        ("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value));
        ("firstSeenAt", (Option.map x.firstSeenAt ~f:Timestamp.to_value));
        ("lastSeenAt", (Option.map x.lastSeenAt ~f:Timestamp.to_value));
        ("severity", (Option.map x.severity ~f:Double.to_value));
        ("count", (Option.map x.count ~f:Integer.to_value));
        ("resourceUids",
          (Option.map x.resourceUids ~f:ResourceUids.to_value));
        ("actorIds", (Option.map x.actorIds ~f:ActorIds.to_value));
        ("endpointIds", (Option.map x.endpointIds ~f:EndpointIds.to_value));
        ("signalIndicators",
          (Option.map x.signalIndicators ~f:Indicators.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let signalIndicators =
        (Option.map ~f:Indicators.of_xml)
          (Xml.child xml_arg0 "signalIndicators") in
      let endpointIds =
        (Option.map ~f:EndpointIds.of_xml) (Xml.child xml_arg0 "endpointIds") in
      let actorIds =
        (Option.map ~f:ActorIds.of_xml) (Xml.child xml_arg0 "actorIds") in
      let resourceUids =
        (Option.map ~f:ResourceUids.of_xml)
          (Xml.child xml_arg0 "resourceUids") in
      let count = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "count") in
      let severity =
        (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "severity") in
      let lastSeenAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "lastSeenAt") in
      let firstSeenAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "firstSeenAt") in
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      let description =
        (Option.map ~f:SignalDescription.of_xml)
          (Xml.child xml_arg0 "description") in
      let type_ =
        (Option.map ~f:SignalType.of_xml) (Xml.child xml_arg0 "type") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      make ?signalIndicators ?endpointIds ?actorIds ?resourceUids ?count
        ?severity ?lastSeenAt ?firstSeenAt ?updatedAt ?createdAt ?name
        ?description ?type_ ?uid ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let signalIndicators =
        field_map json__ "SignalIndicators" Indicators.of_json in
      let endpointIds = field_map json__ "EndpointIds" EndpointIds.of_json in
      let actorIds = field_map json__ "ActorIds" ActorIds.of_json in
      let resourceUids = field_map json__ "ResourceUids" ResourceUids.of_json in
      let count = field_map json__ "Count" Integer.of_json in
      let severity = field_map json__ "Severity" Double.of_json in
      let lastSeenAt = field_map json__ "LastSeenAt" Timestamp.of_json in
      let firstSeenAt = field_map json__ "FirstSeenAt" Timestamp.of_json in
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      let name = field_map json__ "Name" String_.of_json in
      let description =
        field_map json__ "Description" SignalDescription.of_json in
      let type_ = field_map json__ "Type" SignalType.of_json in
      let uid = field_map json__ "Uid" String_.of_json in
      make ?signalIndicators ?endpointIds ?actorIds ?resourceUids ?count
        ?severity ?lastSeenAt ?firstSeenAt ?updatedAt ?createdAt ?name
        ?description ?type_ ?uid ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the signals involved in the attack sequence."]
module ScanThreatNames =
  struct
    type nonrec t = ScanThreatName.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ScanThreatName.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ScanThreatName.of_xml)
    let of_json j =
      list_of_json ~kind:"ScanThreatNames" ~of_json:ScanThreatName.of_json j
    let to_json v = composed_to_json to_value v
  end
module ThreatNames =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"ThreatNames" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module ItemDetailsList =
  struct
    type nonrec t = ItemDetails.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ItemDetails.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ItemDetails.of_xml)
    let of_json j =
      list_of_json ~kind:"ItemDetailsList" ~of_json:ItemDetails.of_json j
    let to_json v = composed_to_json to_value v
  end
module ItemPaths =
  struct
    type nonrec t = ItemPath.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ItemPath.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ItemPath.of_xml)
    let of_json j =
      list_of_json ~kind:"ItemPaths" ~of_json:ItemPath.of_json j
    let to_json v = composed_to_json to_value v
  end
module Long =
  struct
    type nonrec t = Int64.t
    let make i = i
    let of_string = Int64.of_string
    let to_value x = `Long x
    let to_query v = to_query to_value v
    let to_header x = Int64.to_string x
    let of_xml xml_arg0 =
      Int64.of_string (string_of_xml ~kind:"a long" xml_arg0)
    let of_json j = Int64.of_float (float_of_json ~kind:"a long" j)
    let to_json = simple_to_json to_value
  end
module Lineage =
  struct
    type nonrec t = LineageObject.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:LineageObject.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:LineageObject.of_xml)
    let of_json j =
      list_of_json ~kind:"Lineage" ~of_json:LineageObject.of_json j
    let to_json v = composed_to_json to_value v
  end
module TagKey =
  struct
    type nonrec t = string
    let context_ = "TagKey"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_min i ~min:1) >>=
             (fun () ->
                (check_string_max i ~max:128) >>=
                  (fun () ->
                     check_pattern i ~pattern:"(?!aws:)[a-zA-Z+-=._:/]+")));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"TagKey" j
    let to_json = simple_to_json to_value
  end
module TagValue =
  struct
    type nonrec t = string
    let context_ = "TagValue"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:256) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"TagValue" j
    let to_json = simple_to_json to_value
  end
module Issues =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"Issues" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module ManagementType =
  struct
    type nonrec t =
      | AUTO_MANAGED 
      | MANUAL 
      | DISABLED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | AUTO_MANAGED -> "AUTO_MANAGED"
      | MANUAL -> "MANUAL"
      | DISABLED -> "DISABLED"
      | Non_static_id s -> s
    let of_string =
      function
      | "AUTO_MANAGED" -> AUTO_MANAGED
      | "MANUAL" -> MANUAL
      | "DISABLED" -> DISABLED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ManagementType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ManagementType" j)
    let to_json = simple_to_json to_value
  end
module AccountId =
  struct
    type nonrec t = string
    let context_ = "AccountId"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:12) >>=
             (fun () -> check_string_min i ~min:12));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"AccountId" j
    let to_json = simple_to_json to_value
  end
module Total =
  struct
    type nonrec t =
      {
      amount: String_.t option [@ocaml.doc "The total usage."];
      unit: String_.t option
        [@ocaml.doc "The currency unit that the amount is given in."]}
    let make ?amount = fun ?unit -> fun () -> { amount; unit }
    let to_value x =
      structure_to_value
        [("amount", (Option.map x.amount ~f:String_.to_value));
        ("unit", (Option.map x.unit ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unit = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "unit") in
      let amount =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "amount") in
      make ?unit ?amount ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unit = field_map json__ "Unit" String_.of_json in
      let amount = field_map json__ "Amount" String_.of_json in
      make ?unit ?amount ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains the total usage with the corresponding currency unit for that value."]
module OrganizationFeatureStatisticsAdditionalConfiguration =
  struct
    type nonrec t =
      {
      name: OrgFeatureAdditionalConfiguration.t option
        [@ocaml.doc "Name of the additional configuration within a feature."];
      enabledAccountsCount: Integer.t option
        [@ocaml.doc
          "Total number of accounts that have enabled the additional configuration."]}
    let make ?name =
      fun ?enabledAccountsCount -> fun () -> { name; enabledAccountsCount }
    let to_value x =
      structure_to_value
        [("name",
           (Option.map x.name ~f:OrgFeatureAdditionalConfiguration.to_value));
        ("enabledAccountsCount",
          (Option.map x.enabledAccountsCount ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let enabledAccountsCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "enabledAccountsCount") in
      let name =
        (Option.map ~f:OrgFeatureAdditionalConfiguration.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?enabledAccountsCount ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let enabledAccountsCount =
        field_map json__ "EnabledAccountsCount" Integer.of_json in
      let name =
        field_map json__ "Name" OrgFeatureAdditionalConfiguration.of_json in
      make ?enabledAccountsCount ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the coverage statistic for the additional configuration of the feature."]
module EbsVolumesResult =
  struct
    type nonrec t =
      {
      status: DataSourceStatus.t option
        [@ocaml.doc
          "Describes whether scanning EBS volumes is enabled as a data source."];
      reason: String_.t option
        [@ocaml.doc
          "Specifies the reason why scanning EBS volumes (Malware Protection) was not enabled as a data source."]}
    let make ?status = fun ?reason -> fun () -> { status; reason }
    let to_value x =
      structure_to_value
        [("status", (Option.map x.status ~f:DataSourceStatus.to_value));
        ("reason", (Option.map x.reason ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let reason =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "reason") in
      let status =
        (Option.map ~f:DataSourceStatus.of_xml) (Xml.child xml_arg0 "status") in
      make ?reason ?status ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let reason = field_map json__ "Reason" String_.of_json in
      let status = field_map json__ "Status" DataSourceStatus.of_json in
      make ?reason ?status ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes the configuration of scanning EBS volumes as a data source."]
module MemberAdditionalConfigurationResult =
  struct
    type nonrec t =
      {
      name: OrgFeatureAdditionalConfiguration.t option
        [@ocaml.doc
          "Indicates the name of the additional configuration that is set for the member account."];
      status: FeatureStatus.t option
        [@ocaml.doc
          "Indicates the status of the additional configuration that is set for the member account."];
      updatedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the additional configuration was set for the member account. This is in UTC format."]}
    let make ?name =
      fun ?status -> fun ?updatedAt -> fun () -> { name; status; updatedAt }
    let to_value x =
      structure_to_value
        [("name",
           (Option.map x.name ~f:OrgFeatureAdditionalConfiguration.to_value));
        ("status", (Option.map x.status ~f:FeatureStatus.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let status =
        (Option.map ~f:FeatureStatus.of_xml) (Xml.child xml_arg0 "status") in
      let name =
        (Option.map ~f:OrgFeatureAdditionalConfiguration.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?updatedAt ?status ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      let status = field_map json__ "Status" FeatureStatus.of_json in
      let name =
        field_map json__ "Name" OrgFeatureAdditionalConfiguration.of_json in
      make ?updatedAt ?status ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the additional configuration for the member account."]
module VolumeDetail =
  struct
    type nonrec t =
      {
      volumeArn: String_.t option [@ocaml.doc "EBS volume ARN information."];
      volumeType: String_.t option [@ocaml.doc "The EBS volume type."];
      deviceName: String_.t option
        [@ocaml.doc "The device name for the EBS volume."];
      volumeSizeInGB: Integer.t option [@ocaml.doc "EBS volume size in GB."];
      encryptionType: String_.t option
        [@ocaml.doc "EBS volume encryption type."];
      snapshotArn: String_.t option
        [@ocaml.doc "Snapshot ARN of the EBS volume."];
      kmsKeyArn: String_.t option
        [@ocaml.doc "KMS key ARN used to encrypt the EBS volume."]}
    let make ?volumeArn =
      fun ?volumeType ->
        fun ?deviceName ->
          fun ?volumeSizeInGB ->
            fun ?encryptionType ->
              fun ?snapshotArn ->
                fun ?kmsKeyArn ->
                  fun () ->
                    {
                      volumeArn;
                      volumeType;
                      deviceName;
                      volumeSizeInGB;
                      encryptionType;
                      snapshotArn;
                      kmsKeyArn
                    }
    let to_value x =
      structure_to_value
        [("volumeArn", (Option.map x.volumeArn ~f:String_.to_value));
        ("volumeType", (Option.map x.volumeType ~f:String_.to_value));
        ("deviceName", (Option.map x.deviceName ~f:String_.to_value));
        ("volumeSizeInGB", (Option.map x.volumeSizeInGB ~f:Integer.to_value));
        ("encryptionType", (Option.map x.encryptionType ~f:String_.to_value));
        ("snapshotArn", (Option.map x.snapshotArn ~f:String_.to_value));
        ("kmsKeyArn", (Option.map x.kmsKeyArn ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let kmsKeyArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "kmsKeyArn") in
      let snapshotArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "snapshotArn") in
      let encryptionType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "encryptionType") in
      let volumeSizeInGB =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "volumeSizeInGB") in
      let deviceName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "deviceName") in
      let volumeType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "volumeType") in
      let volumeArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "volumeArn") in
      make ?kmsKeyArn ?snapshotArn ?encryptionType ?volumeSizeInGB
        ?deviceName ?volumeType ?volumeArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let kmsKeyArn = field_map json__ "KmsKeyArn" String_.of_json in
      let snapshotArn = field_map json__ "SnapshotArn" String_.of_json in
      let encryptionType = field_map json__ "EncryptionType" String_.of_json in
      let volumeSizeInGB = field_map json__ "VolumeSizeInGB" Integer.of_json in
      let deviceName = field_map json__ "DeviceName" String_.of_json in
      let volumeType = field_map json__ "VolumeType" String_.of_json in
      let volumeArn = field_map json__ "VolumeArn" String_.of_json in
      make ?kmsKeyArn ?snapshotArn ?encryptionType ?volumeSizeInGB
        ?deviceName ?volumeType ?volumeArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains EBS volume details."]
module Containers =
  struct
    type nonrec t = Container.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Container.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Container.of_xml)
    let of_json j =
      list_of_json ~kind:"Containers" ~of_json:Container.of_json j
    let to_json v = composed_to_json to_value v
  end
module Volumes =
  struct
    type nonrec t = Volume.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Volume.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Volume.of_xml)
    let of_json j = list_of_json ~kind:"Volumes" ~of_json:Volume.of_json j
    let to_json v = composed_to_json to_value v
  end
module NetworkInterface =
  struct
    type nonrec t =
      {
      ipv6Addresses: Ipv6Addresses.t option
        [@ocaml.doc "A list of IPv6 addresses for the EC2 instance."];
      networkInterfaceId: String_.t option
        [@ocaml.doc "The ID of the network interface."];
      privateDnsName: String_.t option
        [@ocaml.doc "The private DNS name of the EC2 instance."];
      privateIpAddress: SensitiveString.t option
        [@ocaml.doc "The private IP address of the EC2 instance."];
      privateIpAddresses: PrivateIpAddresses.t option
        [@ocaml.doc
          "Other private IP address information of the EC2 instance."];
      publicDnsName: String_.t option
        [@ocaml.doc "The public DNS name of the EC2 instance."];
      publicIp: String_.t option
        [@ocaml.doc "The public IP address of the EC2 instance."];
      securityGroups: SecurityGroups.t option
        [@ocaml.doc "The security groups associated with the EC2 instance."];
      subnetId: String_.t option
        [@ocaml.doc "The subnet ID of the EC2 instance."];
      vpcId: String_.t option [@ocaml.doc "The VPC ID of the EC2 instance."]}
    let make ?ipv6Addresses =
      fun ?networkInterfaceId ->
        fun ?privateDnsName ->
          fun ?privateIpAddress ->
            fun ?privateIpAddresses ->
              fun ?publicDnsName ->
                fun ?publicIp ->
                  fun ?securityGroups ->
                    fun ?subnetId ->
                      fun ?vpcId ->
                        fun () ->
                          {
                            ipv6Addresses;
                            networkInterfaceId;
                            privateDnsName;
                            privateIpAddress;
                            privateIpAddresses;
                            publicDnsName;
                            publicIp;
                            securityGroups;
                            subnetId;
                            vpcId
                          }
    let to_value x =
      structure_to_value
        [("ipv6Addresses",
           (Option.map x.ipv6Addresses ~f:Ipv6Addresses.to_value));
        ("networkInterfaceId",
          (Option.map x.networkInterfaceId ~f:String_.to_value));
        ("privateDnsName", (Option.map x.privateDnsName ~f:String_.to_value));
        ("privateIpAddress",
          (Option.map x.privateIpAddress ~f:SensitiveString.to_value));
        ("privateIpAddresses",
          (Option.map x.privateIpAddresses ~f:PrivateIpAddresses.to_value));
        ("publicDnsName", (Option.map x.publicDnsName ~f:String_.to_value));
        ("publicIp", (Option.map x.publicIp ~f:String_.to_value));
        ("securityGroups",
          (Option.map x.securityGroups ~f:SecurityGroups.to_value));
        ("subnetId", (Option.map x.subnetId ~f:String_.to_value));
        ("vpcId", (Option.map x.vpcId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let vpcId = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "vpcId") in
      let subnetId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "subnetId") in
      let securityGroups =
        (Option.map ~f:SecurityGroups.of_xml)
          (Xml.child xml_arg0 "securityGroups") in
      let publicIp =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "publicIp") in
      let publicDnsName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "publicDnsName") in
      let privateIpAddresses =
        (Option.map ~f:PrivateIpAddresses.of_xml)
          (Xml.child xml_arg0 "privateIpAddresses") in
      let privateIpAddress =
        (Option.map ~f:SensitiveString.of_xml)
          (Xml.child xml_arg0 "privateIpAddress") in
      let privateDnsName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "privateDnsName") in
      let networkInterfaceId =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "networkInterfaceId") in
      let ipv6Addresses =
        (Option.map ~f:Ipv6Addresses.of_xml)
          (Xml.child xml_arg0 "ipv6Addresses") in
      make ?vpcId ?subnetId ?securityGroups ?publicIp ?publicDnsName
        ?privateIpAddresses ?privateIpAddress ?privateDnsName
        ?networkInterfaceId ?ipv6Addresses ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let vpcId = field_map json__ "VpcId" String_.of_json in
      let subnetId = field_map json__ "SubnetId" String_.of_json in
      let securityGroups =
        field_map json__ "SecurityGroups" SecurityGroups.of_json in
      let publicIp = field_map json__ "PublicIp" String_.of_json in
      let publicDnsName = field_map json__ "PublicDnsName" String_.of_json in
      let privateIpAddresses =
        field_map json__ "PrivateIpAddresses" PrivateIpAddresses.of_json in
      let privateIpAddress =
        field_map json__ "PrivateIpAddress" SensitiveString.of_json in
      let privateDnsName = field_map json__ "PrivateDnsName" String_.of_json in
      let networkInterfaceId =
        field_map json__ "NetworkInterfaceId" String_.of_json in
      let ipv6Addresses =
        field_map json__ "Ipv6Addresses" Ipv6Addresses.of_json in
      make ?vpcId ?subnetId ?securityGroups ?publicIp ?publicDnsName
        ?privateIpAddresses ?privateIpAddress ?privateDnsName
        ?networkInterfaceId ?ipv6Addresses ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the elastic network interface of the EC2 instance."]
module ImpersonatedUser =
  struct
    type nonrec t =
      {
      username: String_.t option
        [@ocaml.doc
          "Information about the username that was being impersonated."];
      groups: Groups.t option
        [@ocaml.doc "The group to which the user name belongs."]}
    let make ?username = fun ?groups -> fun () -> { username; groups }
    let to_value x =
      structure_to_value
        [("username", (Option.map x.username ~f:String_.to_value));
        ("groups", (Option.map x.groups ~f:Groups.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let groups =
        (Option.map ~f:Groups.of_xml) (Xml.child xml_arg0 "groups") in
      let username =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "username") in
      make ?groups ?username ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let groups = field_map json__ "Groups" Groups.of_json in
      let username = field_map json__ "Username" String_.of_json in
      make ?groups ?username ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the impersonated user."]
module SessionNameList =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"SessionNameList" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module SubnetIds =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"SubnetIds" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module DefaultServerSideEncryption =
  struct
    type nonrec t =
      {
      encryptionType: String_.t option
        [@ocaml.doc
          "The type of encryption used for objects within the S3 bucket."];
      kmsMasterKeyArn: String_.t option
        [@ocaml.doc
          "The Amazon Resource Name (ARN) of the KMS encryption key. Only available if the bucket EncryptionType is aws:kms."]}
    let make ?encryptionType =
      fun ?kmsMasterKeyArn -> fun () -> { encryptionType; kmsMasterKeyArn }
    let to_value x =
      structure_to_value
        [("encryptionType",
           (Option.map x.encryptionType ~f:String_.to_value));
        ("kmsMasterKeyArn",
          (Option.map x.kmsMasterKeyArn ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let kmsMasterKeyArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "kmsMasterKeyArn") in
      let encryptionType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "encryptionType") in
      make ?kmsMasterKeyArn ?encryptionType ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let kmsMasterKeyArn =
        field_map json__ "KmsMasterKeyArn" String_.of_json in
      let encryptionType = field_map json__ "EncryptionType" String_.of_json in
      make ?kmsMasterKeyArn ?encryptionType ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the server side encryption method used in the S3 bucket. See S3 Server-Side Encryption for more information."]
module Owner =
  struct
    type nonrec t =
      {
      id: String_.t option
        [@ocaml.doc
          "The canonical user ID of the bucket owner. For information about locating your canonical user ID see Finding Your Account Canonical User ID."]}
    let make ?id = fun () -> { id }
    let to_value x =
      structure_to_value [("id", (Option.map x.id ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let id = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "id") in
      make ?id ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let id = field_map json__ "Id" String_.of_json in make ?id ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information on the owner of the bucket."]
module PublicAccess =
  struct
    type nonrec t =
      {
      permissionConfiguration: PermissionConfiguration.t option
        [@ocaml.doc
          "Contains information about how permissions are configured for the S3 bucket."];
      effectivePermission: String_.t option
        [@ocaml.doc
          "Describes the effective permission on this bucket after factoring all attached policies."]}
    let make ?permissionConfiguration =
      fun ?effectivePermission ->
        fun () -> { permissionConfiguration; effectivePermission }
    let to_value x =
      structure_to_value
        [("permissionConfiguration",
           (Option.map x.permissionConfiguration
              ~f:PermissionConfiguration.to_value));
        ("effectivePermission",
          (Option.map x.effectivePermission ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let effectivePermission =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "effectivePermission") in
      let permissionConfiguration =
        (Option.map ~f:PermissionConfiguration.of_xml)
          (Xml.child xml_arg0 "permissionConfiguration") in
      make ?effectivePermission ?permissionConfiguration ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let effectivePermission =
        field_map json__ "EffectivePermission" String_.of_json in
      let permissionConfiguration =
        field_map json__ "PermissionConfiguration"
          PermissionConfiguration.of_json in
      make ?effectivePermission ?permissionConfiguration ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes the public access policies that apply to the S3 bucket."]
module S3ObjectDetails =
  struct
    type nonrec t = S3ObjectDetail.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:S3ObjectDetail.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:S3ObjectDetail.of_xml)
    let of_json j =
      list_of_json ~kind:"S3ObjectDetails" ~of_json:S3ObjectDetail.of_json j
    let to_json v = composed_to_json to_value v
  end
module AffectedResources =
  struct
    type nonrec t = (String_.t * String_.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            ((String_.of_string chopped),
                              (String_.of_string v))))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (String_.to_value x) |>
                    (fun x -> (String_.to_value y) |> (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:String_.of_string
        ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module DomainDetails =
  struct
    type nonrec t =
      {
      domain: String_.t option
        [@ocaml.doc
          "The domain information for the Amazon Web Services API call."]}
    let make ?domain = fun () -> { domain }
    let to_value x =
      structure_to_value
        [("domain", (Option.map x.domain ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let domain =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "domain") in
      make ?domain ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let domain = field_map json__ "Domain" String_.of_json in
      make ?domain ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the domain."]
module RemoteAccountDetails =
  struct
    type nonrec t =
      {
      accountId: String_.t option
        [@ocaml.doc
          "The Amazon Web Services account ID of the remote API caller."];
      affiliated: Boolean.t option
        [@ocaml.doc
          "Details on whether the Amazon Web Services account of the remote API caller is related to your GuardDuty environment. If this value is True the API caller is affiliated to your account in some way. If it is False the API caller is from outside your environment."]}
    let make ?accountId =
      fun ?affiliated -> fun () -> { accountId; affiliated }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:String_.to_value));
        ("affiliated", (Option.map x.affiliated ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let affiliated =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "affiliated") in
      let accountId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?affiliated ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let affiliated = field_map json__ "Affiliated" Boolean.of_json in
      let accountId = field_map json__ "AccountId" String_.of_json in
      make ?affiliated ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains details about the remote Amazon Web Services account that made the API call."]
module SourceIps =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"SourceIps" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module RemotePortDetails =
  struct
    type nonrec t =
      {
      port: Integer.t option
        [@ocaml.doc "The port number of the remote connection."];
      portName: String_.t option
        [@ocaml.doc "The port name of the remote connection."]}
    let make ?port = fun ?portName -> fun () -> { port; portName }
    let to_value x =
      structure_to_value
        [("port", (Option.map x.port ~f:Integer.to_value));
        ("portName", (Option.map x.portName ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let portName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "portName") in
      let port = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "port") in
      make ?portName ?port ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let portName = field_map json__ "PortName" String_.of_json in
      let port = field_map json__ "Port" Integer.of_json in
      make ?portName ?port ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the remote port."]
module PortProbeDetails =
  struct
    type nonrec t = PortProbeDetail.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:PortProbeDetail.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:PortProbeDetail.of_xml)
    let of_json j =
      list_of_json ~kind:"PortProbeDetails" ~of_json:PortProbeDetail.of_json
        j
    let to_json v = composed_to_json to_value v
  end
module LoginAttributes =
  struct
    type nonrec t = LoginAttribute.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:LoginAttribute.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:LoginAttribute.of_xml)
    let of_json j =
      list_of_json ~kind:"LoginAttributes" ~of_json:LoginAttribute.of_json j
    let to_json v = composed_to_json to_value v
  end
module AnomalyProfiles =
  struct
    type nonrec t = (String_.t * AnomalyProfileFeatures.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            let (_ : string) = v in
                            let (_ : string) = chopped in
                            failwith
                              "no of_header for complex types String AnomalyProfileFeatures"))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (String_.to_value x) |>
                    (fun x ->
                       (AnomalyProfileFeatures.to_value y) |>
                         (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:String_.of_string
        ~of_json:AnomalyProfileFeatures.of_json j
    let to_json v = composed_to_json to_value v
  end
module AnomalyUnusual =
  struct
    type nonrec t =
      {
      behavior: Behavior.t option
        [@ocaml.doc
          "The behavior of the anomalous activity that caused GuardDuty to generate the finding."]}
    let make ?behavior = fun () -> { behavior }
    let to_value x =
      structure_to_value
        [("behavior", (Option.map x.behavior ~f:Behavior.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let behavior =
        (Option.map ~f:Behavior.of_xml) (Xml.child xml_arg0 "behavior") in
      make ?behavior ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let behavior = field_map json__ "Behavior" Behavior.of_json in
      make ?behavior ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the behavior of the anomaly that is new to GuardDuty."]
module Actors =
  struct
    type nonrec t = Actor.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:400) >>=
             (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Actor.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Actor.of_xml)
    let of_json j = list_of_json ~kind:"Actors" ~of_json:Actor.of_json j
    let to_json v = composed_to_json to_value v
  end
module AdditionalSequenceTypes =
  struct
    type nonrec t = FindingType.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:FindingType.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:FindingType.of_xml)
    let of_json j =
      list_of_json ~kind:"AdditionalSequenceTypes"
        ~of_json:FindingType.of_json j
    let to_json v = composed_to_json to_value v
  end
module NetworkEndpoints =
  struct
    type nonrec t = NetworkEndpoint.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:400) >>=
             (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:NetworkEndpoint.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:NetworkEndpoint.of_xml)
    let of_json j =
      list_of_json ~kind:"NetworkEndpoints" ~of_json:NetworkEndpoint.of_json
        j
    let to_json v = composed_to_json to_value v
  end
module Resources =
  struct
    type nonrec t = ResourceV2.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:400) >>=
             (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ResourceV2.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ResourceV2.of_xml)
    let of_json j =
      list_of_json ~kind:"Resources" ~of_json:ResourceV2.of_json j
    let to_json v = composed_to_json to_value v
  end
module SequenceDescription =
  struct
    type nonrec t = string
    let context_ = "SequenceDescription"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:4096) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"SequenceDescription" j
    let to_json = simple_to_json to_value
  end
module Signals =
  struct
    type nonrec t = Signal.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:100) >>=
             (fun () -> check_list_min i ~min:1));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Signal.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Signal.of_xml)
    let of_json j = list_of_json ~kind:"Signals" ~of_json:Signal.of_json j
    let to_json v = composed_to_json to_value v
  end
module HighestSeverityThreatDetails =
  struct
    type nonrec t =
      {
      severity: String_.t option
        [@ocaml.doc
          "Severity level of the highest severity threat detected."];
      threatName: String_.t option
        [@ocaml.doc
          "Threat name of the highest severity threat detected as part of the malware scan."];
      count: Integer.t option
        [@ocaml.doc
          "Total number of infected files with the highest severity threat detected."]}
    let make ?severity =
      fun ?threatName ->
        fun ?count -> fun () -> { severity; threatName; count }
    let to_value x =
      structure_to_value
        [("severity", (Option.map x.severity ~f:String_.to_value));
        ("threatName", (Option.map x.threatName ~f:String_.to_value));
        ("count", (Option.map x.count ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let count = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "count") in
      let threatName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "threatName") in
      let severity =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "severity") in
      make ?count ?threatName ?severity ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let count = field_map json__ "Count" Integer.of_json in
      let threatName = field_map json__ "ThreatName" String_.of_json in
      let severity = field_map json__ "Severity" String_.of_json in
      make ?count ?threatName ?severity ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains details of the highest severity threat detected during scan and number of infected files."]
module ScannedItemCount =
  struct
    type nonrec t =
      {
      totalGb: Integer.t option
        [@ocaml.doc "Total GB of files scanned for malware."];
      files: Integer.t option [@ocaml.doc "Number of files scanned."];
      volumes: Integer.t option
        [@ocaml.doc "Total number of scanned volumes."]}
    let make ?totalGb =
      fun ?files -> fun ?volumes -> fun () -> { totalGb; files; volumes }
    let to_value x =
      structure_to_value
        [("totalGb", (Option.map x.totalGb ~f:Integer.to_value));
        ("files", (Option.map x.files ~f:Integer.to_value));
        ("volumes", (Option.map x.volumes ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let volumes =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "volumes") in
      let files = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "files") in
      let totalGb =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "totalGb") in
      make ?volumes ?files ?totalGb ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let volumes = field_map json__ "Volumes" Integer.of_json in
      let files = field_map json__ "Files" Integer.of_json in
      let totalGb = field_map json__ "TotalGb" Integer.of_json in
      make ?volumes ?files ?totalGb ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Total number of scanned files."]
module ThreatDetectedByName =
  struct
    type nonrec t =
      {
      itemCount: Integer.t option
        [@ocaml.doc "Total number of infected files identified."];
      uniqueThreatNameCount: Integer.t option
        [@ocaml.doc
          "Total number of unique threats by name identified, as part of the malware scan."];
      shortened: Boolean.t option
        [@ocaml.doc
          "Flag to determine if the finding contains every single infected file-path and/or every threat."];
      threatNames: ScanThreatNames.t option
        [@ocaml.doc
          "List of identified threats with details, organized by threat name."]}
    let make ?itemCount =
      fun ?uniqueThreatNameCount ->
        fun ?shortened ->
          fun ?threatNames ->
            fun () ->
              { itemCount; uniqueThreatNameCount; shortened; threatNames }
    let to_value x =
      structure_to_value
        [("itemCount", (Option.map x.itemCount ~f:Integer.to_value));
        ("uniqueThreatNameCount",
          (Option.map x.uniqueThreatNameCount ~f:Integer.to_value));
        ("shortened", (Option.map x.shortened ~f:Boolean.to_value));
        ("threatNames",
          (Option.map x.threatNames ~f:ScanThreatNames.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatNames =
        (Option.map ~f:ScanThreatNames.of_xml)
          (Xml.child xml_arg0 "threatNames") in
      let shortened =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "shortened") in
      let uniqueThreatNameCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "uniqueThreatNameCount") in
      let itemCount =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "itemCount") in
      make ?threatNames ?shortened ?uniqueThreatNameCount ?itemCount ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatNames =
        field_map json__ "ThreatNames" ScanThreatNames.of_json in
      let shortened = field_map json__ "Shortened" Boolean.of_json in
      let uniqueThreatNameCount =
        field_map json__ "UniqueThreatNameCount" Integer.of_json in
      let itemCount = field_map json__ "ItemCount" Integer.of_json in
      make ?threatNames ?shortened ?uniqueThreatNameCount ?itemCount ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains details about identified threats organized by threat name."]
module ThreatsDetectedItemCount =
  struct
    type nonrec t =
      {
      files: Integer.t option [@ocaml.doc "Total number of infected files."]}
    let make ?files = fun () -> { files }
    let to_value x =
      structure_to_value
        [("files", (Option.map x.files ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let files = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "files") in
      make ?files ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let files = field_map json__ "Files" Integer.of_json in make ?files ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains total number of infected files."]
module ThreatIntelligenceDetail =
  struct
    type nonrec t =
      {
      threatListName: String_.t option
        [@ocaml.doc
          "The name of the threat intelligence list that triggered the finding."];
      threatNames: ThreatNames.t option
        [@ocaml.doc
          "A list of names of the threats in the threat intelligence list that triggered the finding."];
      threatFileSha256: String_.t option
        [@ocaml.doc "SHA256 of the file that generated the finding."]}
    let make ?threatListName =
      fun ?threatNames ->
        fun ?threatFileSha256 ->
          fun () -> { threatListName; threatNames; threatFileSha256 }
    let to_value x =
      structure_to_value
        [("threatListName",
           (Option.map x.threatListName ~f:String_.to_value));
        ("threatNames", (Option.map x.threatNames ~f:ThreatNames.to_value));
        ("threatFileSha256",
          (Option.map x.threatFileSha256 ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatFileSha256 =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "threatFileSha256") in
      let threatNames =
        (Option.map ~f:ThreatNames.of_xml) (Xml.child xml_arg0 "threatNames") in
      let threatListName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "threatListName") in
      make ?threatFileSha256 ?threatNames ?threatListName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatFileSha256 =
        field_map json__ "ThreatFileSha256" String_.of_json in
      let threatNames = field_map json__ "ThreatNames" ThreatNames.of_json in
      let threatListName = field_map json__ "ThreatListName" String_.of_json in
      make ?threatFileSha256 ?threatNames ?threatListName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "An instance of a threat intelligence detail that constitutes evidence for the finding."]
module IncrementalScanDetails =
  struct
    type nonrec t =
      {
      baselineResourceArn: NonEmptyString.t
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the baseline resource used for incremental scanning. The scan will only process changes since this baseline resource was created."]}
    let context_ = "IncrementalScanDetails"
    let make ~baselineResourceArn = fun () -> { baselineResourceArn }
    let to_value x =
      structure_to_value
        [("baselineResourceArn",
           (Some (NonEmptyString.to_value x.baselineResourceArn)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let baselineResourceArn =
        NonEmptyString.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "baselineResourceArn") in
      make ~baselineResourceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let baselineResourceArn =
        field_map_exn json__ "BaselineResourceArn" NonEmptyString.of_json in
      make ~baselineResourceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the incremental scan configuration."]
module TriggerType =
  struct
    type nonrec t =
      | BACKUP 
      | GUARDDUTY 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | BACKUP -> "BACKUP"
      | GUARDDUTY -> "GUARDDUTY"
      | Non_static_id s -> s
    let of_string =
      function
      | "BACKUP" -> BACKUP
      | "GUARDDUTY" -> GUARDDUTY
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration TriggerType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"TriggerType" j)
    let to_json = simple_to_json to_value
  end
module Threat =
  struct
    type nonrec t =
      {
      name: String_.t option
        [@ocaml.doc
          "Name of the detected threat that caused GuardDuty to generate this finding."];
      source: String_.t option
        [@ocaml.doc "Source of the threat that generated this finding."];
      itemPaths: ItemPaths.t option
        [@ocaml.doc
          "Information about the nested item path and hash of the protected resource."];
      count: Long.t option
        [@ocaml.doc
          "The number of occurrences of this specific threat detected during the scan."];
      hash: String_.t option
        [@ocaml.doc "The hash identifier of the detected malware threat."];
      itemDetails: ItemDetailsList.t option
        [@ocaml.doc
          "Detailed information about the detected malware threat."]}
    let make ?name =
      fun ?source ->
        fun ?itemPaths ->
          fun ?count ->
            fun ?hash ->
              fun ?itemDetails ->
                fun () ->
                  { name; source; itemPaths; count; hash; itemDetails }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("source", (Option.map x.source ~f:String_.to_value));
        ("itemPaths", (Option.map x.itemPaths ~f:ItemPaths.to_value));
        ("count", (Option.map x.count ~f:Long.to_value));
        ("hash", (Option.map x.hash ~f:String_.to_value));
        ("itemDetails",
          (Option.map x.itemDetails ~f:ItemDetailsList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let itemDetails =
        (Option.map ~f:ItemDetailsList.of_xml)
          (Xml.child xml_arg0 "itemDetails") in
      let hash = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "hash") in
      let count = (Option.map ~f:Long.of_xml) (Xml.child xml_arg0 "count") in
      let itemPaths =
        (Option.map ~f:ItemPaths.of_xml) (Xml.child xml_arg0 "itemPaths") in
      let source =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "source") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?itemDetails ?hash ?count ?itemPaths ?source ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let itemDetails =
        field_map json__ "ItemDetails" ItemDetailsList.of_json in
      let hash = field_map json__ "Hash" String_.of_json in
      let count = field_map json__ "Count" Long.of_json in
      let itemPaths = field_map json__ "ItemPaths" ItemPaths.of_json in
      let source = field_map json__ "Source" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?itemDetails ?hash ?count ?itemPaths ?source ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the detected threats associated with the generated finding."]
module FlagsList =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"FlagsList" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module MemoryRegionsList =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"MemoryRegionsList" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module ProcessDetails =
  struct
    type nonrec t =
      {
      name: String_.t option [@ocaml.doc "The name of the process."];
      executablePath: String_.t option
        [@ocaml.doc "The absolute path of the process executable file."];
      executableSha256: String_.t option
        [@ocaml.doc "The SHA256 hash of the process executable."];
      namespacePid: Integer.t option
        [@ocaml.doc "The ID of the child process."];
      pwd: String_.t option
        [@ocaml.doc "The present working directory of the process."];
      pid: Integer.t option [@ocaml.doc "The ID of the process."];
      startTime: Timestamp.t option
        [@ocaml.doc
          "The time when the process started. This is in UTC format."];
      uuid: String_.t option
        [@ocaml.doc "The unique ID assigned to the process by GuardDuty."];
      parentUuid: String_.t option
        [@ocaml.doc
          "The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty."];
      user: String_.t option
        [@ocaml.doc "The user that executed the process."];
      userId: Integer.t option
        [@ocaml.doc "The unique ID of the user that executed the process."];
      euid: Integer.t option
        [@ocaml.doc
          "The effective user ID of the user that executed the process."];
      lineage: Lineage.t option
        [@ocaml.doc "Information about the process's lineage."]}
    let make ?name =
      fun ?executablePath ->
        fun ?executableSha256 ->
          fun ?namespacePid ->
            fun ?pwd ->
              fun ?pid ->
                fun ?startTime ->
                  fun ?uuid ->
                    fun ?parentUuid ->
                      fun ?user ->
                        fun ?userId ->
                          fun ?euid ->
                            fun ?lineage ->
                              fun () ->
                                {
                                  name;
                                  executablePath;
                                  executableSha256;
                                  namespacePid;
                                  pwd;
                                  pid;
                                  startTime;
                                  uuid;
                                  parentUuid;
                                  user;
                                  userId;
                                  euid;
                                  lineage
                                }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("executablePath", (Option.map x.executablePath ~f:String_.to_value));
        ("executableSha256",
          (Option.map x.executableSha256 ~f:String_.to_value));
        ("namespacePid", (Option.map x.namespacePid ~f:Integer.to_value));
        ("pwd", (Option.map x.pwd ~f:String_.to_value));
        ("pid", (Option.map x.pid ~f:Integer.to_value));
        ("startTime", (Option.map x.startTime ~f:Timestamp.to_value));
        ("uuid", (Option.map x.uuid ~f:String_.to_value));
        ("parentUuid", (Option.map x.parentUuid ~f:String_.to_value));
        ("user", (Option.map x.user ~f:String_.to_value));
        ("userId", (Option.map x.userId ~f:Integer.to_value));
        ("euid", (Option.map x.euid ~f:Integer.to_value));
        ("lineage", (Option.map x.lineage ~f:Lineage.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let lineage =
        (Option.map ~f:Lineage.of_xml) (Xml.child xml_arg0 "lineage") in
      let euid = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "euid") in
      let userId =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "userId") in
      let user = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "user") in
      let parentUuid =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "parentUuid") in
      let uuid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uuid") in
      let startTime =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "startTime") in
      let pid = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "pid") in
      let pwd = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "pwd") in
      let namespacePid =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "namespacePid") in
      let executableSha256 =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "executableSha256") in
      let executablePath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "executablePath") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?lineage ?euid ?userId ?user ?parentUuid ?uuid ?startTime ?pid
        ?pwd ?namespacePid ?executableSha256 ?executablePath ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let lineage = field_map json__ "Lineage" Lineage.of_json in
      let euid = field_map json__ "Euid" Integer.of_json in
      let userId = field_map json__ "UserId" Integer.of_json in
      let user = field_map json__ "User" String_.of_json in
      let parentUuid = field_map json__ "ParentUuid" String_.of_json in
      let uuid = field_map json__ "Uuid" String_.of_json in
      let startTime = field_map json__ "StartTime" Timestamp.of_json in
      let pid = field_map json__ "Pid" Integer.of_json in
      let pwd = field_map json__ "Pwd" String_.of_json in
      let namespacePid = field_map json__ "NamespacePid" Integer.of_json in
      let executableSha256 =
        field_map json__ "ExecutableSha256" String_.of_json in
      let executablePath = field_map json__ "ExecutablePath" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?lineage ?euid ?userId ?user ?parentUuid ?uuid ?startTime ?pid
        ?pwd ?namespacePid ?executableSha256 ?executablePath ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the observed process."]
module OrgFeatureStatus =
  struct
    type nonrec t =
      | NEW 
      | NONE 
      | ALL 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | NEW -> "NEW"
      | NONE -> "NONE"
      | ALL -> "ALL"
      | Non_static_id s -> s
    let of_string =
      function
      | "NEW" -> NEW
      | "NONE" -> NONE
      | "ALL" -> ALL
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration OrgFeatureStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"OrgFeatureStatus" j)
    let to_json = simple_to_json to_value
  end
module ScanConditionPair =
  struct
    type nonrec t =
      {
      key: TagKey.t [@ocaml.doc "Represents the key in the map condition."];
      value: TagValue.t option
        [@ocaml.doc
          "Represents optional value in the map condition. If not specified, only the key will be matched."]}
    let context_ = "ScanConditionPair"
    let make ?value = fun ~key -> fun () -> { value; key }
    let to_value x =
      structure_to_value
        [("key", (Some (TagKey.to_value x.key)));
        ("value", (Option.map x.value ~f:TagValue.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let value =
        (Option.map ~f:TagValue.of_xml) (Xml.child xml_arg0 "value") in
      let key =
        TagKey.of_xml (Xml.child_exn ~context:context_ xml_arg0 "key") in
      make ?value ~key ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let value = field_map json__ "Value" TagValue.of_json in
      let key = field_map_exn json__ "Key" TagKey.of_json in
      make ?value ~key ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents the key:value pair to be matched against given resource property."]
module Match =
  struct
    type nonrec t = string
    let context_ = "Match"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:512) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"Match" j
    let to_json = simple_to_json to_value
  end
module NotMatch =
  struct
    type nonrec t = string
    let context_ = "NotMatch"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:512) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"NotMatch" j
    let to_json = simple_to_json to_value
  end
module FeatureAdditionalConfiguration =
  struct
    type nonrec t =
      | EKS_ADDON_MANAGEMENT 
      | ECS_FARGATE_AGENT_MANAGEMENT 
      | EC2_AGENT_MANAGEMENT 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | EKS_ADDON_MANAGEMENT -> "EKS_ADDON_MANAGEMENT"
      | ECS_FARGATE_AGENT_MANAGEMENT -> "ECS_FARGATE_AGENT_MANAGEMENT"
      | EC2_AGENT_MANAGEMENT -> "EC2_AGENT_MANAGEMENT"
      | Non_static_id s -> s
    let of_string =
      function
      | "EKS_ADDON_MANAGEMENT" -> EKS_ADDON_MANAGEMENT
      | "ECS_FARGATE_AGENT_MANAGEMENT" -> ECS_FARGATE_AGENT_MANAGEMENT
      | "EC2_AGENT_MANAGEMENT" -> EC2_AGENT_MANAGEMENT
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration FeatureAdditionalConfiguration"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"FeatureAdditionalConfiguration" j)
    let to_json = simple_to_json to_value
  end
module LongValue =
  struct
    type nonrec t = Int64.t
    let make i = i
    let of_string = Int64.of_string
    let to_value x = `Long x
    let to_query v = to_query to_value v
    let to_header x = Int64.to_string x
    let of_xml xml_arg0 =
      Int64.of_string (string_of_xml ~kind:"a long" xml_arg0)
    let of_json j = Int64.of_float (float_of_json ~kind:"a long" j)
    let to_json = simple_to_json to_value
  end
module AgentDetails =
  struct
    type nonrec t =
      {
      version: String_.t option
        [@ocaml.doc "Version of the installed GuardDuty security agent."]}
    let make ?version = fun () -> { version }
    let to_value x =
      structure_to_value
        [("version", (Option.map x.version ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let version =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "version") in
      make ?version ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let version = field_map json__ "Version" String_.of_json in
      make ?version ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the installed GuardDuty security agent."]
module ContainerInstanceDetails =
  struct
    type nonrec t =
      {
      coveredContainerInstances: Long.t option
        [@ocaml.doc
          "Represents the nodes in the Amazon ECS cluster that has a HEALTHY coverage status."];
      compatibleContainerInstances: Long.t option
        [@ocaml.doc
          "Represents total number of nodes in the Amazon ECS cluster."]}
    let make ?coveredContainerInstances =
      fun ?compatibleContainerInstances ->
        fun () -> { coveredContainerInstances; compatibleContainerInstances }
    let to_value x =
      structure_to_value
        [("coveredContainerInstances",
           (Option.map x.coveredContainerInstances ~f:Long.to_value));
        ("compatibleContainerInstances",
          (Option.map x.compatibleContainerInstances ~f:Long.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let compatibleContainerInstances =
        (Option.map ~f:Long.of_xml)
          (Xml.child xml_arg0 "compatibleContainerInstances") in
      let coveredContainerInstances =
        (Option.map ~f:Long.of_xml)
          (Xml.child xml_arg0 "coveredContainerInstances") in
      make ?compatibleContainerInstances ?coveredContainerInstances ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let compatibleContainerInstances =
        field_map json__ "CompatibleContainerInstances" Long.of_json in
      let coveredContainerInstances =
        field_map json__ "CoveredContainerInstances" Long.of_json in
      make ?compatibleContainerInstances ?coveredContainerInstances ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon EC2 instance that is running the Amazon ECS container."]
module FargateDetails =
  struct
    type nonrec t =
      {
      issues: Issues.t option
        [@ocaml.doc
          "Runtime coverage issues identified for the resource running on Amazon Web Services Fargate."];
      managementType: ManagementType.t option
        [@ocaml.doc
          "Indicates how the GuardDuty security agent is managed for this resource. AUTO_MANAGED indicates that GuardDuty deploys and manages updates for this resource. DISABLED indicates that the deployment of the GuardDuty security agent is disabled for this resource. The MANUAL status doesn't apply to the Amazon Web Services Fargate (Amazon ECS only) woprkloads."]}
    let make ?issues =
      fun ?managementType -> fun () -> { issues; managementType }
    let to_value x =
      structure_to_value
        [("issues", (Option.map x.issues ~f:Issues.to_value));
        ("managementType",
          (Option.map x.managementType ~f:ManagementType.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let managementType =
        (Option.map ~f:ManagementType.of_xml)
          (Xml.child xml_arg0 "managementType") in
      let issues =
        (Option.map ~f:Issues.of_xml) (Xml.child xml_arg0 "issues") in
      make ?managementType ?issues ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let managementType =
        field_map json__ "ManagementType" ManagementType.of_json in
      let issues = field_map json__ "Issues" Issues.of_json in
      make ?managementType ?issues ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about Amazon Web Services Fargate details associated with an Amazon ECS cluster."]
module AddonDetails =
  struct
    type nonrec t =
      {
      addonVersion: String_.t option
        [@ocaml.doc "Version of the installed EKS add-on."];
      addonStatus: String_.t option
        [@ocaml.doc "Status of the installed EKS add-on."]}
    let make ?addonVersion =
      fun ?addonStatus -> fun () -> { addonVersion; addonStatus }
    let to_value x =
      structure_to_value
        [("addonVersion", (Option.map x.addonVersion ~f:String_.to_value));
        ("addonStatus", (Option.map x.addonStatus ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let addonStatus =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "addonStatus") in
      let addonVersion =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "addonVersion") in
      make ?addonStatus ?addonVersion ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let addonStatus = field_map json__ "AddonStatus" String_.of_json in
      let addonVersion = field_map json__ "AddonVersion" String_.of_json in
      make ?addonStatus ?addonVersion ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the installed EKS add-on (GuardDuty security agent)."]
module Equals =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"Equals" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module NotEquals =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"NotEquals" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module UsageTopAccountResult =
  struct
    type nonrec t =
      {
      accountId: AccountId.t option [@ocaml.doc "The unique account ID."];
      total: Total.t option }
    let make ?accountId = fun ?total -> fun () -> { accountId; total }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("total", (Option.map x.total ~f:Total.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let total = (Option.map ~f:Total.of_xml) (Xml.child xml_arg0 "total") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?total ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let total = field_map json__ "Total" Total.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      make ?total ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the total of usage based on the topmost 50 account IDs."]
module DataSourceFreeTrial =
  struct
    type nonrec t =
      {
      freeTrialDaysRemaining: Integer.t option
        [@ocaml.doc
          "A value that specifies the number of days left to use each enabled data source."]}
    let make ?freeTrialDaysRemaining = fun () -> { freeTrialDaysRemaining }
    let to_value x =
      structure_to_value
        [("freeTrialDaysRemaining",
           (Option.map x.freeTrialDaysRemaining ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let freeTrialDaysRemaining =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "freeTrialDaysRemaining") in
      make ?freeTrialDaysRemaining ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let freeTrialDaysRemaining =
        field_map json__ "FreeTrialDaysRemaining" Integer.of_json in
      make ?freeTrialDaysRemaining ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about which data sources are enabled for the GuardDuty member account."]
module FreeTrialFeatureResult =
  struct
    type nonrec t =
      | FLOW_LOGS 
      | CLOUD_TRAIL 
      | DNS_LOGS 
      | S3_DATA_EVENTS 
      | EKS_AUDIT_LOGS 
      | EBS_MALWARE_PROTECTION 
      | RDS_LOGIN_EVENTS 
      | LAMBDA_NETWORK_LOGS 
      | EKS_RUNTIME_MONITORING 
      | EC2_RUNTIME_MONITORING 
      | FARGATE_RUNTIME_MONITORING 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | FLOW_LOGS -> "FLOW_LOGS"
      | CLOUD_TRAIL -> "CLOUD_TRAIL"
      | DNS_LOGS -> "DNS_LOGS"
      | S3_DATA_EVENTS -> "S3_DATA_EVENTS"
      | EKS_AUDIT_LOGS -> "EKS_AUDIT_LOGS"
      | EBS_MALWARE_PROTECTION -> "EBS_MALWARE_PROTECTION"
      | RDS_LOGIN_EVENTS -> "RDS_LOGIN_EVENTS"
      | LAMBDA_NETWORK_LOGS -> "LAMBDA_NETWORK_LOGS"
      | EKS_RUNTIME_MONITORING -> "EKS_RUNTIME_MONITORING"
      | EC2_RUNTIME_MONITORING -> "EC2_RUNTIME_MONITORING"
      | FARGATE_RUNTIME_MONITORING -> "FARGATE_RUNTIME_MONITORING"
      | Non_static_id s -> s
    let of_string =
      function
      | "FLOW_LOGS" -> FLOW_LOGS
      | "CLOUD_TRAIL" -> CLOUD_TRAIL
      | "DNS_LOGS" -> DNS_LOGS
      | "S3_DATA_EVENTS" -> S3_DATA_EVENTS
      | "EKS_AUDIT_LOGS" -> EKS_AUDIT_LOGS
      | "EBS_MALWARE_PROTECTION" -> EBS_MALWARE_PROTECTION
      | "RDS_LOGIN_EVENTS" -> RDS_LOGIN_EVENTS
      | "LAMBDA_NETWORK_LOGS" -> LAMBDA_NETWORK_LOGS
      | "EKS_RUNTIME_MONITORING" -> EKS_RUNTIME_MONITORING
      | "EC2_RUNTIME_MONITORING" -> EC2_RUNTIME_MONITORING
      | "FARGATE_RUNTIME_MONITORING" -> FARGATE_RUNTIME_MONITORING
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration FreeTrialFeatureResult" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"FreeTrialFeatureResult" j)
    let to_json = simple_to_json to_value
  end
module OrgFeature =
  struct
    type nonrec t =
      | S3_DATA_EVENTS 
      | EKS_AUDIT_LOGS 
      | EBS_MALWARE_PROTECTION 
      | RDS_LOGIN_EVENTS 
      | LAMBDA_NETWORK_LOGS 
      | EKS_RUNTIME_MONITORING 
      | RUNTIME_MONITORING 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | S3_DATA_EVENTS -> "S3_DATA_EVENTS"
      | EKS_AUDIT_LOGS -> "EKS_AUDIT_LOGS"
      | EBS_MALWARE_PROTECTION -> "EBS_MALWARE_PROTECTION"
      | RDS_LOGIN_EVENTS -> "RDS_LOGIN_EVENTS"
      | LAMBDA_NETWORK_LOGS -> "LAMBDA_NETWORK_LOGS"
      | EKS_RUNTIME_MONITORING -> "EKS_RUNTIME_MONITORING"
      | RUNTIME_MONITORING -> "RUNTIME_MONITORING"
      | Non_static_id s -> s
    let of_string =
      function
      | "S3_DATA_EVENTS" -> S3_DATA_EVENTS
      | "EKS_AUDIT_LOGS" -> EKS_AUDIT_LOGS
      | "EBS_MALWARE_PROTECTION" -> EBS_MALWARE_PROTECTION
      | "RDS_LOGIN_EVENTS" -> RDS_LOGIN_EVENTS
      | "LAMBDA_NETWORK_LOGS" -> LAMBDA_NETWORK_LOGS
      | "EKS_RUNTIME_MONITORING" -> EKS_RUNTIME_MONITORING
      | "RUNTIME_MONITORING" -> RUNTIME_MONITORING
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration OrgFeature" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"OrgFeature" j)
    let to_json = simple_to_json to_value
  end
module OrganizationFeatureStatisticsAdditionalConfigurations =
  struct
    type nonrec t =
      OrganizationFeatureStatisticsAdditionalConfiguration.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |>
         (List.map
            ~f:OrganizationFeatureStatisticsAdditionalConfiguration.to_value))
        |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:OrganizationFeatureStatisticsAdditionalConfiguration.of_xml)
    let of_json j =
      list_of_json
        ~kind:"OrganizationFeatureStatisticsAdditionalConfigurations"
        ~of_json:OrganizationFeatureStatisticsAdditionalConfiguration.of_json
        j
    let to_json v = composed_to_json to_value v
  end
module KubernetesAuditLogsConfigurationResult =
  struct
    type nonrec t =
      {
      status: DataSourceStatus.t option
        [@ocaml.doc
          "A value that describes whether Kubernetes audit logs are enabled as a data source."]}
    let make ?status = fun () -> { status }
    let to_value x =
      structure_to_value
        [("status", (Option.map x.status ~f:DataSourceStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:DataSourceStatus.of_xml) (Xml.child xml_arg0 "status") in
      make ?status ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status = field_map json__ "Status" DataSourceStatus.of_json in
      make ?status ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether Kubernetes audit logs are enabled as a data source."]
module ScanEc2InstanceWithFindingsResult =
  struct
    type nonrec t =
      {
      ebsVolumes: EbsVolumesResult.t option
        [@ocaml.doc
          "Describes the configuration of scanning EBS volumes as a data source."]}
    let make ?ebsVolumes = fun () -> { ebsVolumes }
    let to_value x =
      structure_to_value
        [("ebsVolumes",
           (Option.map x.ebsVolumes ~f:EbsVolumesResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ebsVolumes =
        (Option.map ~f:EbsVolumesResult.of_xml)
          (Xml.child xml_arg0 "ebsVolumes") in
      make ?ebsVolumes ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ebsVolumes = field_map json__ "EbsVolumes" EbsVolumesResult.of_json in
      make ?ebsVolumes ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "An object that contains information on the status of whether Malware Protection for EC2 instances with findings will be enabled as a data source."]
module MemberAdditionalConfigurationResults =
  struct
    type nonrec t = MemberAdditionalConfigurationResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:MemberAdditionalConfigurationResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:MemberAdditionalConfigurationResult.of_xml)
    let of_json j =
      list_of_json ~kind:"MemberAdditionalConfigurationResults"
        ~of_json:MemberAdditionalConfigurationResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module VolumeDetails =
  struct
    type nonrec t = VolumeDetail.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:VolumeDetail.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:VolumeDetail.of_xml)
    let of_json j =
      list_of_json ~kind:"VolumeDetails" ~of_json:VolumeDetail.of_json j
    let to_json v = composed_to_json to_value v
  end
module EcsTaskDetails =
  struct
    type nonrec t =
      {
      arn: String_.t option
        [@ocaml.doc "The Amazon Resource Name (ARN) of the task."];
      definitionArn: String_.t option
        [@ocaml.doc "The ARN of the task definition that creates the task."];
      version: String_.t option
        [@ocaml.doc "The version counter for the task."];
      taskCreatedAt: Timestamp.t option
        [@ocaml.doc
          "The Unix timestamp for the time when the task was created."];
      startedAt: Timestamp.t option
        [@ocaml.doc "The Unix timestamp for the time when the task started."];
      startedBy: String_.t option
        [@ocaml.doc "Contains the tag specified when a task is started."];
      tags: Tags.t option [@ocaml.doc "The tags of the ECS Task."];
      volumes: Volumes.t option
        [@ocaml.doc "The list of data volume definitions for the task."];
      containers: Containers.t option
        [@ocaml.doc "The containers that's associated with the task."];
      group: String_.t option
        [@ocaml.doc
          "The name of the task group that's associated with the task."];
      launchType: String_.t option
        [@ocaml.doc
          "A capacity on which the task is running. For example, Fargate and EC2."]}
    let make ?arn =
      fun ?definitionArn ->
        fun ?version ->
          fun ?taskCreatedAt ->
            fun ?startedAt ->
              fun ?startedBy ->
                fun ?tags ->
                  fun ?volumes ->
                    fun ?containers ->
                      fun ?group ->
                        fun ?launchType ->
                          fun () ->
                            {
                              arn;
                              definitionArn;
                              version;
                              taskCreatedAt;
                              startedAt;
                              startedBy;
                              tags;
                              volumes;
                              containers;
                              group;
                              launchType
                            }
    let to_value x =
      structure_to_value
        [("arn", (Option.map x.arn ~f:String_.to_value));
        ("definitionArn", (Option.map x.definitionArn ~f:String_.to_value));
        ("version", (Option.map x.version ~f:String_.to_value));
        ("createdAt", (Option.map x.taskCreatedAt ~f:Timestamp.to_value));
        ("startedAt", (Option.map x.startedAt ~f:Timestamp.to_value));
        ("startedBy", (Option.map x.startedBy ~f:String_.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value));
        ("volumes", (Option.map x.volumes ~f:Volumes.to_value));
        ("containers", (Option.map x.containers ~f:Containers.to_value));
        ("group", (Option.map x.group ~f:String_.to_value));
        ("launchType", (Option.map x.launchType ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let launchType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "launchType") in
      let group = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "group") in
      let containers =
        (Option.map ~f:Containers.of_xml) (Xml.child xml_arg0 "containers") in
      let volumes =
        (Option.map ~f:Volumes.of_xml) (Xml.child xml_arg0 "volumes") in
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let startedBy =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "startedBy") in
      let startedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "startedAt") in
      let taskCreatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let version =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "version") in
      let definitionArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "definitionArn") in
      let arn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "arn") in
      make ?launchType ?group ?containers ?volumes ?tags ?startedBy
        ?startedAt ?taskCreatedAt ?version ?definitionArn ?arn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let launchType = field_map json__ "LaunchType" String_.of_json in
      let group = field_map json__ "Group" String_.of_json in
      let containers = field_map json__ "Containers" Containers.of_json in
      let volumes = field_map json__ "Volumes" Volumes.of_json in
      let tags = field_map json__ "Tags" Tags.of_json in
      let startedBy = field_map json__ "StartedBy" String_.of_json in
      let startedAt = field_map json__ "StartedAt" Timestamp.of_json in
      let taskCreatedAt = field_map json__ "TaskCreatedAt" Timestamp.of_json in
      let version = field_map json__ "Version" String_.of_json in
      let definitionArn = field_map json__ "DefinitionArn" String_.of_json in
      let arn = field_map json__ "Arn" String_.of_json in
      make ?launchType ?group ?containers ?volumes ?tags ?startedBy
        ?startedAt ?taskCreatedAt ?version ?definitionArn ?arn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the task in an ECS cluster."]
module NetworkInterfaces =
  struct
    type nonrec t = NetworkInterface.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:NetworkInterface.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:NetworkInterface.of_xml)
    let of_json j =
      list_of_json ~kind:"NetworkInterfaces"
        ~of_json:NetworkInterface.of_json j
    let to_json v = composed_to_json to_value v
  end
module KubernetesUserDetails =
  struct
    type nonrec t =
      {
      username: String_.t option
        [@ocaml.doc
          "The username of the user who called the Kubernetes API."];
      uid: String_.t option
        [@ocaml.doc "The user ID of the user who called the Kubernetes API."];
      groups: Groups.t option
        [@ocaml.doc
          "The groups that include the user who called the Kubernetes API."];
      sessionName: SessionNameList.t option
        [@ocaml.doc
          "Entity that assumes the IAM role when Kubernetes RBAC permissions are assigned to that role."];
      impersonatedUser: ImpersonatedUser.t option
        [@ocaml.doc "Information about the impersonated user."]}
    let make ?username =
      fun ?uid ->
        fun ?groups ->
          fun ?sessionName ->
            fun ?impersonatedUser ->
              fun () ->
                { username; uid; groups; sessionName; impersonatedUser }
    let to_value x =
      structure_to_value
        [("username", (Option.map x.username ~f:String_.to_value));
        ("uid", (Option.map x.uid ~f:String_.to_value));
        ("groups", (Option.map x.groups ~f:Groups.to_value));
        ("sessionName",
          (Option.map x.sessionName ~f:SessionNameList.to_value));
        ("impersonatedUser",
          (Option.map x.impersonatedUser ~f:ImpersonatedUser.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let impersonatedUser =
        (Option.map ~f:ImpersonatedUser.of_xml)
          (Xml.child xml_arg0 "impersonatedUser") in
      let sessionName =
        (Option.map ~f:SessionNameList.of_xml)
          (Xml.child xml_arg0 "sessionName") in
      let groups =
        (Option.map ~f:Groups.of_xml) (Xml.child xml_arg0 "groups") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      let username =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "username") in
      make ?impersonatedUser ?sessionName ?groups ?uid ?username ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let impersonatedUser =
        field_map json__ "ImpersonatedUser" ImpersonatedUser.of_json in
      let sessionName =
        field_map json__ "SessionName" SessionNameList.of_json in
      let groups = field_map json__ "Groups" Groups.of_json in
      let uid = field_map json__ "Uid" String_.of_json in
      let username = field_map json__ "Username" String_.of_json in
      make ?impersonatedUser ?sessionName ?groups ?uid ?username ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Details about the Kubernetes user involved in a Kubernetes finding."]
module KubernetesWorkloadDetails =
  struct
    type nonrec t =
      {
      name: String_.t option [@ocaml.doc "Kubernetes workload name."];
      type_: String_.t option
        [@ocaml.doc "Kubernetes workload type (e.g. Pod, Deployment, etc.)."];
      uid: String_.t option [@ocaml.doc "Kubernetes workload ID."];
      namespace: String_.t option
        [@ocaml.doc "Kubernetes namespace that the workload is part of."];
      hostNetwork: Boolean.t option
        [@ocaml.doc
          "Whether the hostNetwork flag is enabled for the pods included in the workload."];
      serviceAccountName: String_.t option
        [@ocaml.doc
          "The service account name that is associated with a Kubernetes workload."];
      containers: Containers.t option
        [@ocaml.doc "Containers running as part of the Kubernetes workload."];
      volumes: Volumes.t option
        [@ocaml.doc "Volumes used by the Kubernetes workload."];
      hostIPC: Boolean.t option
        [@ocaml.doc
          "Whether the host IPC flag is enabled for the pods in the workload."];
      hostPID: Boolean.t option
        [@ocaml.doc
          "Whether the host PID flag is enabled for the pods in the workload."]}
    let make ?name =
      fun ?type_ ->
        fun ?uid ->
          fun ?namespace ->
            fun ?hostNetwork ->
              fun ?serviceAccountName ->
                fun ?containers ->
                  fun ?volumes ->
                    fun ?hostIPC ->
                      fun ?hostPID ->
                        fun () ->
                          {
                            name;
                            type_;
                            uid;
                            namespace;
                            hostNetwork;
                            serviceAccountName;
                            containers;
                            volumes;
                            hostIPC;
                            hostPID
                          }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value));
        ("uid", (Option.map x.uid ~f:String_.to_value));
        ("namespace", (Option.map x.namespace ~f:String_.to_value));
        ("hostNetwork", (Option.map x.hostNetwork ~f:Boolean.to_value));
        ("serviceAccountName",
          (Option.map x.serviceAccountName ~f:String_.to_value));
        ("containers", (Option.map x.containers ~f:Containers.to_value));
        ("volumes", (Option.map x.volumes ~f:Volumes.to_value));
        ("hostIPC", (Option.map x.hostIPC ~f:Boolean.to_value));
        ("hostPID", (Option.map x.hostPID ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let hostPID =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "hostPID") in
      let hostIPC =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "hostIPC") in
      let volumes =
        (Option.map ~f:Volumes.of_xml) (Xml.child xml_arg0 "volumes") in
      let containers =
        (Option.map ~f:Containers.of_xml) (Xml.child xml_arg0 "containers") in
      let serviceAccountName =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "serviceAccountName") in
      let hostNetwork =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "hostNetwork") in
      let namespace =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "namespace") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?hostPID ?hostIPC ?volumes ?containers ?serviceAccountName
        ?hostNetwork ?namespace ?uid ?type_ ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let hostPID = field_map json__ "HostPID" Boolean.of_json in
      let hostIPC = field_map json__ "HostIPC" Boolean.of_json in
      let volumes = field_map json__ "Volumes" Volumes.of_json in
      let containers = field_map json__ "Containers" Containers.of_json in
      let serviceAccountName =
        field_map json__ "ServiceAccountName" String_.of_json in
      let hostNetwork = field_map json__ "HostNetwork" Boolean.of_json in
      let namespace = field_map json__ "Namespace" String_.of_json in
      let uid = field_map json__ "Uid" String_.of_json in
      let type_ = field_map json__ "Type" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?hostPID ?hostIPC ?volumes ?containers ?serviceAccountName
        ?hostNetwork ?namespace ?uid ?type_ ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Details about the Kubernetes workload involved in a Kubernetes finding."]
module VpcConfig =
  struct
    type nonrec t =
      {
      subnetIds: SubnetIds.t option
        [@ocaml.doc
          "The identifiers of the subnets that are associated with your Lambda function."];
      vpcId: String_.t option
        [@ocaml.doc "The identifier of the Amazon Virtual Private Cloud."];
      securityGroups: SecurityGroups.t option
        [@ocaml.doc
          "The identifier of the security group attached to the Lambda function."]}
    let make ?subnetIds =
      fun ?vpcId ->
        fun ?securityGroups -> fun () -> { subnetIds; vpcId; securityGroups }
    let to_value x =
      structure_to_value
        [("subnetIds", (Option.map x.subnetIds ~f:SubnetIds.to_value));
        ("vpcId", (Option.map x.vpcId ~f:String_.to_value));
        ("securityGroups",
          (Option.map x.securityGroups ~f:SecurityGroups.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let securityGroups =
        (Option.map ~f:SecurityGroups.of_xml)
          (Xml.child xml_arg0 "securityGroups") in
      let vpcId = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "vpcId") in
      let subnetIds =
        (Option.map ~f:SubnetIds.of_xml) (Xml.child xml_arg0 "subnetIds") in
      make ?securityGroups ?vpcId ?subnetIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let securityGroups =
        field_map json__ "SecurityGroups" SecurityGroups.of_json in
      let vpcId = field_map json__ "VpcId" String_.of_json in
      let subnetIds = field_map json__ "SubnetIds" SubnetIds.of_json in
      make ?securityGroups ?vpcId ?subnetIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Amazon Virtual Private Cloud configuration details associated with your Lambda function."]
module S3BucketDetail =
  struct
    type nonrec t =
      {
      arn: String_.t option
        [@ocaml.doc "The Amazon Resource Name (ARN) of the S3 bucket."];
      name: String_.t option [@ocaml.doc "The name of the S3 bucket."];
      type_: String_.t option
        [@ocaml.doc
          "Describes whether the bucket is a source or destination bucket."];
      createdAt: Timestamp.t option
        [@ocaml.doc "The date and time the bucket was created at."];
      owner: Owner.t option [@ocaml.doc "The owner of the S3 bucket."];
      tags: Tags.t option [@ocaml.doc "All tags attached to the S3 bucket"];
      defaultServerSideEncryption: DefaultServerSideEncryption.t option
        [@ocaml.doc
          "Describes the server side encryption method used in the S3 bucket."];
      publicAccess: PublicAccess.t option
        [@ocaml.doc
          "Describes the public access policies that apply to the S3 bucket."];
      s3ObjectDetails: S3ObjectDetails.t option
        [@ocaml.doc "Information about the S3 object that was scanned."]}
    let make ?arn =
      fun ?name ->
        fun ?type_ ->
          fun ?createdAt ->
            fun ?owner ->
              fun ?tags ->
                fun ?defaultServerSideEncryption ->
                  fun ?publicAccess ->
                    fun ?s3ObjectDetails ->
                      fun () ->
                        {
                          arn;
                          name;
                          type_;
                          createdAt;
                          owner;
                          tags;
                          defaultServerSideEncryption;
                          publicAccess;
                          s3ObjectDetails
                        }
    let to_value x =
      structure_to_value
        [("arn", (Option.map x.arn ~f:String_.to_value));
        ("name", (Option.map x.name ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value));
        ("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value));
        ("owner", (Option.map x.owner ~f:Owner.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value));
        ("defaultServerSideEncryption",
          (Option.map x.defaultServerSideEncryption
             ~f:DefaultServerSideEncryption.to_value));
        ("publicAccess",
          (Option.map x.publicAccess ~f:PublicAccess.to_value));
        ("s3ObjectDetails",
          (Option.map x.s3ObjectDetails ~f:S3ObjectDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let s3ObjectDetails =
        (Option.map ~f:S3ObjectDetails.of_xml)
          (Xml.child xml_arg0 "s3ObjectDetails") in
      let publicAccess =
        (Option.map ~f:PublicAccess.of_xml)
          (Xml.child xml_arg0 "publicAccess") in
      let defaultServerSideEncryption =
        (Option.map ~f:DefaultServerSideEncryption.of_xml)
          (Xml.child xml_arg0 "defaultServerSideEncryption") in
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let owner = (Option.map ~f:Owner.of_xml) (Xml.child xml_arg0 "owner") in
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      let arn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "arn") in
      make ?s3ObjectDetails ?publicAccess ?defaultServerSideEncryption ?tags
        ?owner ?createdAt ?type_ ?name ?arn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let s3ObjectDetails =
        field_map json__ "S3ObjectDetails" S3ObjectDetails.of_json in
      let publicAccess = field_map json__ "PublicAccess" PublicAccess.of_json in
      let defaultServerSideEncryption =
        field_map json__ "DefaultServerSideEncryption"
          DefaultServerSideEncryption.of_json in
      let tags = field_map json__ "Tags" Tags.of_json in
      let owner = field_map json__ "Owner" Owner.of_json in
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      let type_ = field_map json__ "Type" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      let arn = field_map json__ "Arn" String_.of_json in
      make ?s3ObjectDetails ?publicAccess ?defaultServerSideEncryption ?tags
        ?owner ?createdAt ?type_ ?name ?arn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information on the S3 bucket."]
module AwsApiCallAction =
  struct
    type nonrec t =
      {
      api: String_.t option [@ocaml.doc "The Amazon Web Services API name."];
      callerType: String_.t option
        [@ocaml.doc "The Amazon Web Services API caller type."];
      domainDetails: DomainDetails.t option
        [@ocaml.doc
          "The domain information for the Amazon Web Services API call."];
      errorCode: String_.t option
        [@ocaml.doc
          "The error code of the failed Amazon Web Services API action."];
      userAgent: String_.t option
        [@ocaml.doc "The agent through which the API request was made."];
      remoteIpDetails: RemoteIpDetails.t option
        [@ocaml.doc
          "The remote IP information of the connection that initiated the Amazon Web Services API call."];
      serviceName: String_.t option
        [@ocaml.doc
          "The Amazon Web Services service name whose API was invoked."];
      remoteAccountDetails: RemoteAccountDetails.t option
        [@ocaml.doc
          "The details of the Amazon Web Services account that made the API call. This field appears if the call was made from outside your account."];
      affectedResources: AffectedResources.t option
        [@ocaml.doc
          "The details of the Amazon Web Services account that made the API call. This field identifies the resources that were affected by this API call."]}
    let make ?api =
      fun ?callerType ->
        fun ?domainDetails ->
          fun ?errorCode ->
            fun ?userAgent ->
              fun ?remoteIpDetails ->
                fun ?serviceName ->
                  fun ?remoteAccountDetails ->
                    fun ?affectedResources ->
                      fun () ->
                        {
                          api;
                          callerType;
                          domainDetails;
                          errorCode;
                          userAgent;
                          remoteIpDetails;
                          serviceName;
                          remoteAccountDetails;
                          affectedResources
                        }
    let to_value x =
      structure_to_value
        [("api", (Option.map x.api ~f:String_.to_value));
        ("callerType", (Option.map x.callerType ~f:String_.to_value));
        ("domainDetails",
          (Option.map x.domainDetails ~f:DomainDetails.to_value));
        ("errorCode", (Option.map x.errorCode ~f:String_.to_value));
        ("userAgent", (Option.map x.userAgent ~f:String_.to_value));
        ("remoteIpDetails",
          (Option.map x.remoteIpDetails ~f:RemoteIpDetails.to_value));
        ("serviceName", (Option.map x.serviceName ~f:String_.to_value));
        ("remoteAccountDetails",
          (Option.map x.remoteAccountDetails ~f:RemoteAccountDetails.to_value));
        ("affectedResources",
          (Option.map x.affectedResources ~f:AffectedResources.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let affectedResources =
        (Option.map ~f:AffectedResources.of_xml)
          (Xml.child xml_arg0 "affectedResources") in
      let remoteAccountDetails =
        (Option.map ~f:RemoteAccountDetails.of_xml)
          (Xml.child xml_arg0 "remoteAccountDetails") in
      let serviceName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "serviceName") in
      let remoteIpDetails =
        (Option.map ~f:RemoteIpDetails.of_xml)
          (Xml.child xml_arg0 "remoteIpDetails") in
      let userAgent =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "userAgent") in
      let errorCode =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "errorCode") in
      let domainDetails =
        (Option.map ~f:DomainDetails.of_xml)
          (Xml.child xml_arg0 "domainDetails") in
      let callerType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "callerType") in
      let api = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "api") in
      make ?affectedResources ?remoteAccountDetails ?serviceName
        ?remoteIpDetails ?userAgent ?errorCode ?domainDetails ?callerType
        ?api ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let affectedResources =
        field_map json__ "AffectedResources" AffectedResources.of_json in
      let remoteAccountDetails =
        field_map json__ "RemoteAccountDetails" RemoteAccountDetails.of_json in
      let serviceName = field_map json__ "ServiceName" String_.of_json in
      let remoteIpDetails =
        field_map json__ "RemoteIpDetails" RemoteIpDetails.of_json in
      let userAgent = field_map json__ "UserAgent" String_.of_json in
      let errorCode = field_map json__ "ErrorCode" String_.of_json in
      let domainDetails =
        field_map json__ "DomainDetails" DomainDetails.of_json in
      let callerType = field_map json__ "CallerType" String_.of_json in
      let api = field_map json__ "Api" String_.of_json in
      make ?affectedResources ?remoteAccountDetails ?serviceName
        ?remoteIpDetails ?userAgent ?errorCode ?domainDetails ?callerType
        ?api ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the API action."]
module DnsRequestAction =
  struct
    type nonrec t =
      {
      domain: String_.t option
        [@ocaml.doc "The domain information for the DNS query."];
      protocol: String_.t option
        [@ocaml.doc
          "The network connection protocol observed in the activity that prompted GuardDuty to generate the finding."];
      blocked: Boolean.t option
        [@ocaml.doc "Indicates whether the targeted port is blocked."];
      domainWithSuffix: String_.t option
        [@ocaml.doc
          "The second and top level domain involved in the activity that potentially prompted GuardDuty to generate this finding. For a list of top-level and second-level domains, see public suffix list."];
      vpcOwnerAccountId: AccountId.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the VPC through which the DNS request was made."]}
    let make ?domain =
      fun ?protocol ->
        fun ?blocked ->
          fun ?domainWithSuffix ->
            fun ?vpcOwnerAccountId ->
              fun () ->
                {
                  domain;
                  protocol;
                  blocked;
                  domainWithSuffix;
                  vpcOwnerAccountId
                }
    let to_value x =
      structure_to_value
        [("domain", (Option.map x.domain ~f:String_.to_value));
        ("protocol", (Option.map x.protocol ~f:String_.to_value));
        ("blocked", (Option.map x.blocked ~f:Boolean.to_value));
        ("domainWithSuffix",
          (Option.map x.domainWithSuffix ~f:String_.to_value));
        ("vpcOwnerAccountId",
          (Option.map x.vpcOwnerAccountId ~f:AccountId.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let vpcOwnerAccountId =
        (Option.map ~f:AccountId.of_xml)
          (Xml.child xml_arg0 "vpcOwnerAccountId") in
      let domainWithSuffix =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "domainWithSuffix") in
      let blocked =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "blocked") in
      let protocol =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "protocol") in
      let domain =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "domain") in
      make ?vpcOwnerAccountId ?domainWithSuffix ?blocked ?protocol ?domain ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let vpcOwnerAccountId =
        field_map json__ "VpcOwnerAccountId" AccountId.of_json in
      let domainWithSuffix =
        field_map json__ "DomainWithSuffix" String_.of_json in
      let blocked = field_map json__ "Blocked" Boolean.of_json in
      let protocol = field_map json__ "Protocol" String_.of_json in
      let domain = field_map json__ "Domain" String_.of_json in
      make ?vpcOwnerAccountId ?domainWithSuffix ?blocked ?protocol ?domain ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the DNS_REQUEST action described in this finding."]
module KubernetesApiCallAction =
  struct
    type nonrec t =
      {
      requestUri: String_.t option
        [@ocaml.doc "The Kubernetes API request URI."];
      verb: String_.t option
        [@ocaml.doc "The Kubernetes API request HTTP verb."];
      resource: String_.t option
        [@ocaml.doc
          "The resource component in the Kubernetes API call action."];
      subresource: String_.t option
        [@ocaml.doc
          "The name of the sub-resource in the Kubernetes API call action."];
      namespace: String_.t option
        [@ocaml.doc
          "The name of the namespace where the Kubernetes API call action takes place."];
      resourceName: String_.t option
        [@ocaml.doc
          "The name of the resource in the Kubernetes API call action."];
      sourceIps: SourceIps.t option
        [@ocaml.doc
          "The IP of the Kubernetes API caller and the IPs of any proxies or load balancers between the caller and the API endpoint."];
      userAgent: String_.t option
        [@ocaml.doc "The user agent of the caller of the Kubernetes API."];
      remoteIpDetails: RemoteIpDetails.t option ;
      statusCode: Integer.t option
        [@ocaml.doc
          "The resulting HTTP response code of the Kubernetes API call action."];
      parameters: String_.t option
        [@ocaml.doc "Parameters related to the Kubernetes API call action."]}
    let make ?requestUri =
      fun ?verb ->
        fun ?resource ->
          fun ?subresource ->
            fun ?namespace ->
              fun ?resourceName ->
                fun ?sourceIps ->
                  fun ?userAgent ->
                    fun ?remoteIpDetails ->
                      fun ?statusCode ->
                        fun ?parameters ->
                          fun () ->
                            {
                              requestUri;
                              verb;
                              resource;
                              subresource;
                              namespace;
                              resourceName;
                              sourceIps;
                              userAgent;
                              remoteIpDetails;
                              statusCode;
                              parameters
                            }
    let to_value x =
      structure_to_value
        [("requestUri", (Option.map x.requestUri ~f:String_.to_value));
        ("verb", (Option.map x.verb ~f:String_.to_value));
        ("resource", (Option.map x.resource ~f:String_.to_value));
        ("subresource", (Option.map x.subresource ~f:String_.to_value));
        ("namespace", (Option.map x.namespace ~f:String_.to_value));
        ("resourceName", (Option.map x.resourceName ~f:String_.to_value));
        ("sourceIPs", (Option.map x.sourceIps ~f:SourceIps.to_value));
        ("userAgent", (Option.map x.userAgent ~f:String_.to_value));
        ("remoteIpDetails",
          (Option.map x.remoteIpDetails ~f:RemoteIpDetails.to_value));
        ("statusCode", (Option.map x.statusCode ~f:Integer.to_value));
        ("parameters", (Option.map x.parameters ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let parameters =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "parameters") in
      let statusCode =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "statusCode") in
      let remoteIpDetails =
        (Option.map ~f:RemoteIpDetails.of_xml)
          (Xml.child xml_arg0 "remoteIpDetails") in
      let userAgent =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "userAgent") in
      let sourceIps =
        (Option.map ~f:SourceIps.of_xml) (Xml.child xml_arg0 "sourceIPs") in
      let resourceName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resourceName") in
      let namespace =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "namespace") in
      let subresource =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "subresource") in
      let resource =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resource") in
      let verb = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "verb") in
      let requestUri =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "requestUri") in
      make ?parameters ?statusCode ?remoteIpDetails ?userAgent ?sourceIps
        ?resourceName ?namespace ?subresource ?resource ?verb ?requestUri ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let parameters = field_map json__ "Parameters" String_.of_json in
      let statusCode = field_map json__ "StatusCode" Integer.of_json in
      let remoteIpDetails =
        field_map json__ "RemoteIpDetails" RemoteIpDetails.of_json in
      let userAgent = field_map json__ "UserAgent" String_.of_json in
      let sourceIps = field_map json__ "SourceIps" SourceIps.of_json in
      let resourceName = field_map json__ "ResourceName" String_.of_json in
      let namespace = field_map json__ "Namespace" String_.of_json in
      let subresource = field_map json__ "Subresource" String_.of_json in
      let resource = field_map json__ "Resource" String_.of_json in
      let verb = field_map json__ "Verb" String_.of_json in
      let requestUri = field_map json__ "RequestUri" String_.of_json in
      make ?parameters ?statusCode ?remoteIpDetails ?userAgent ?sourceIps
        ?resourceName ?namespace ?subresource ?resource ?verb ?requestUri ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the Kubernetes API call action described in this finding."]
module KubernetesPermissionCheckedDetails =
  struct
    type nonrec t =
      {
      verb: String_.t option
        [@ocaml.doc
          "The verb component of the Kubernetes API call. For example, when you check whether or not you have the permission to call the CreatePod API, the verb component will be Create."];
      resource: String_.t option
        [@ocaml.doc
          "The Kubernetes resource with which your Kubernetes API call will interact."];
      namespace: String_.t option
        [@ocaml.doc
          "The namespace where the Kubernetes API action will take place."];
      allowed: Boolean.t option
        [@ocaml.doc
          "Information whether the user has the permission to call the Kubernetes API."]}
    let make ?verb =
      fun ?resource ->
        fun ?namespace ->
          fun ?allowed -> fun () -> { verb; resource; namespace; allowed }
    let to_value x =
      structure_to_value
        [("verb", (Option.map x.verb ~f:String_.to_value));
        ("resource", (Option.map x.resource ~f:String_.to_value));
        ("namespace", (Option.map x.namespace ~f:String_.to_value));
        ("allowed", (Option.map x.allowed ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let allowed =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "allowed") in
      let namespace =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "namespace") in
      let resource =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resource") in
      let verb = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "verb") in
      make ?allowed ?namespace ?resource ?verb ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let allowed = field_map json__ "Allowed" Boolean.of_json in
      let namespace = field_map json__ "Namespace" String_.of_json in
      let resource = field_map json__ "Resource" String_.of_json in
      let verb = field_map json__ "Verb" String_.of_json in
      make ?allowed ?namespace ?resource ?verb ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the Kubernetes API for which you check if you have permission to call."]
module KubernetesRoleBindingDetails =
  struct
    type nonrec t =
      {
      kind: String_.t option
        [@ocaml.doc
          "The kind of the role. For role binding, this value will be RoleBinding."];
      name: String_.t option [@ocaml.doc "The name of the RoleBinding."];
      uid: String_.t option
        [@ocaml.doc "The unique identifier of the role binding."];
      roleRefName: String_.t option
        [@ocaml.doc
          "The name of the role being referenced. This must match the name of the Role or ClusterRole that you want to bind to."];
      roleRefKind: String_.t option
        [@ocaml.doc
          "The type of the role being referenced. This could be either Role or ClusterRole."]}
    let make ?kind =
      fun ?name ->
        fun ?uid ->
          fun ?roleRefName ->
            fun ?roleRefKind ->
              fun () -> { kind; name; uid; roleRefName; roleRefKind }
    let to_value x =
      structure_to_value
        [("kind", (Option.map x.kind ~f:String_.to_value));
        ("name", (Option.map x.name ~f:String_.to_value));
        ("uid", (Option.map x.uid ~f:String_.to_value));
        ("roleRefName", (Option.map x.roleRefName ~f:String_.to_value));
        ("roleRefKind", (Option.map x.roleRefKind ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let roleRefKind =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "roleRefKind") in
      let roleRefName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "roleRefName") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      let kind = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "kind") in
      make ?roleRefKind ?roleRefName ?uid ?name ?kind ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let roleRefKind = field_map json__ "RoleRefKind" String_.of_json in
      let roleRefName = field_map json__ "RoleRefName" String_.of_json in
      let uid = field_map json__ "Uid" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      let kind = field_map json__ "Kind" String_.of_json in
      make ?roleRefKind ?roleRefName ?uid ?name ?kind ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the role binding that grants the permission defined in a Kubernetes role."]
module KubernetesRoleDetails =
  struct
    type nonrec t =
      {
      kind: String_.t option
        [@ocaml.doc
          "The kind of role. For this API, the value of kind will be Role."];
      name: String_.t option [@ocaml.doc "The name of the Kubernetes role."];
      uid: String_.t option
        [@ocaml.doc "The unique identifier of the Kubernetes role name."]}
    let make ?kind = fun ?name -> fun ?uid -> fun () -> { kind; name; uid }
    let to_value x =
      structure_to_value
        [("kind", (Option.map x.kind ~f:String_.to_value));
        ("name", (Option.map x.name ~f:String_.to_value));
        ("uid", (Option.map x.uid ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      let kind = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "kind") in
      make ?uid ?name ?kind ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let uid = field_map json__ "Uid" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      let kind = field_map json__ "Kind" String_.of_json in
      make ?uid ?name ?kind ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the Kubernetes role name and role type."]
module NetworkConnectionAction =
  struct
    type nonrec t =
      {
      blocked: Boolean.t option
        [@ocaml.doc
          "Indicates whether EC2 blocked the network connection to your instance."];
      connectionDirection: String_.t option
        [@ocaml.doc "The network connection direction."];
      localPortDetails: LocalPortDetails.t option
        [@ocaml.doc "The local port information of the connection."];
      protocol: String_.t option
        [@ocaml.doc "The network connection protocol."];
      localIpDetails: LocalIpDetails.t option
        [@ocaml.doc "The local IP information of the connection."];
      localNetworkInterface: String_.t option
        [@ocaml.doc
          "The EC2 instance's local elastic network interface utilized for the connection."];
      remoteIpDetails: RemoteIpDetails.t option
        [@ocaml.doc "The remote IP information of the connection."];
      remotePortDetails: RemotePortDetails.t option
        [@ocaml.doc "The remote port information of the connection."]}
    let make ?blocked =
      fun ?connectionDirection ->
        fun ?localPortDetails ->
          fun ?protocol ->
            fun ?localIpDetails ->
              fun ?localNetworkInterface ->
                fun ?remoteIpDetails ->
                  fun ?remotePortDetails ->
                    fun () ->
                      {
                        blocked;
                        connectionDirection;
                        localPortDetails;
                        protocol;
                        localIpDetails;
                        localNetworkInterface;
                        remoteIpDetails;
                        remotePortDetails
                      }
    let to_value x =
      structure_to_value
        [("blocked", (Option.map x.blocked ~f:Boolean.to_value));
        ("connectionDirection",
          (Option.map x.connectionDirection ~f:String_.to_value));
        ("localPortDetails",
          (Option.map x.localPortDetails ~f:LocalPortDetails.to_value));
        ("protocol", (Option.map x.protocol ~f:String_.to_value));
        ("localIpDetails",
          (Option.map x.localIpDetails ~f:LocalIpDetails.to_value));
        ("localNetworkInterface",
          (Option.map x.localNetworkInterface ~f:String_.to_value));
        ("remoteIpDetails",
          (Option.map x.remoteIpDetails ~f:RemoteIpDetails.to_value));
        ("remotePortDetails",
          (Option.map x.remotePortDetails ~f:RemotePortDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let remotePortDetails =
        (Option.map ~f:RemotePortDetails.of_xml)
          (Xml.child xml_arg0 "remotePortDetails") in
      let remoteIpDetails =
        (Option.map ~f:RemoteIpDetails.of_xml)
          (Xml.child xml_arg0 "remoteIpDetails") in
      let localNetworkInterface =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "localNetworkInterface") in
      let localIpDetails =
        (Option.map ~f:LocalIpDetails.of_xml)
          (Xml.child xml_arg0 "localIpDetails") in
      let protocol =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "protocol") in
      let localPortDetails =
        (Option.map ~f:LocalPortDetails.of_xml)
          (Xml.child xml_arg0 "localPortDetails") in
      let connectionDirection =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "connectionDirection") in
      let blocked =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "blocked") in
      make ?remotePortDetails ?remoteIpDetails ?localNetworkInterface
        ?localIpDetails ?protocol ?localPortDetails ?connectionDirection
        ?blocked ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let remotePortDetails =
        field_map json__ "RemotePortDetails" RemotePortDetails.of_json in
      let remoteIpDetails =
        field_map json__ "RemoteIpDetails" RemoteIpDetails.of_json in
      let localNetworkInterface =
        field_map json__ "LocalNetworkInterface" String_.of_json in
      let localIpDetails =
        field_map json__ "LocalIpDetails" LocalIpDetails.of_json in
      let protocol = field_map json__ "Protocol" String_.of_json in
      let localPortDetails =
        field_map json__ "LocalPortDetails" LocalPortDetails.of_json in
      let connectionDirection =
        field_map json__ "ConnectionDirection" String_.of_json in
      let blocked = field_map json__ "Blocked" Boolean.of_json in
      make ?remotePortDetails ?remoteIpDetails ?localNetworkInterface
        ?localIpDetails ?protocol ?localPortDetails ?connectionDirection
        ?blocked ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the NETWORK_CONNECTION action described in the finding."]
module PortProbeAction =
  struct
    type nonrec t =
      {
      blocked: Boolean.t option
        [@ocaml.doc
          "Indicates whether EC2 blocked the port probe to the instance, such as with an ACL."];
      portProbeDetails: PortProbeDetails.t option
        [@ocaml.doc "A list of objects related to port probe details."]}
    let make ?blocked =
      fun ?portProbeDetails -> fun () -> { blocked; portProbeDetails }
    let to_value x =
      structure_to_value
        [("blocked", (Option.map x.blocked ~f:Boolean.to_value));
        ("portProbeDetails",
          (Option.map x.portProbeDetails ~f:PortProbeDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let portProbeDetails =
        (Option.map ~f:PortProbeDetails.of_xml)
          (Xml.child xml_arg0 "portProbeDetails") in
      let blocked =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "blocked") in
      make ?portProbeDetails ?blocked ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let portProbeDetails =
        field_map json__ "PortProbeDetails" PortProbeDetails.of_json in
      let blocked = field_map json__ "Blocked" Boolean.of_json in
      make ?portProbeDetails ?blocked ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the PORT_PROBE action described in the finding."]
module RdsLoginAttemptAction =
  struct
    type nonrec t =
      {
      remoteIpDetails: RemoteIpDetails.t option ;
      loginAttributes: LoginAttributes.t option
        [@ocaml.doc
          "Indicates the login attributes used in the login attempt."]}
    let make ?remoteIpDetails =
      fun ?loginAttributes -> fun () -> { remoteIpDetails; loginAttributes }
    let to_value x =
      structure_to_value
        [("remoteIpDetails",
           (Option.map x.remoteIpDetails ~f:RemoteIpDetails.to_value));
        ("LoginAttributes",
          (Option.map x.loginAttributes ~f:LoginAttributes.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let loginAttributes =
        (Option.map ~f:LoginAttributes.of_xml)
          (Xml.child xml_arg0 "LoginAttributes") in
      let remoteIpDetails =
        (Option.map ~f:RemoteIpDetails.of_xml)
          (Xml.child xml_arg0 "remoteIpDetails") in
      make ?loginAttributes ?remoteIpDetails ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let loginAttributes =
        field_map json__ "LoginAttributes" LoginAttributes.of_json in
      let remoteIpDetails =
        field_map json__ "RemoteIpDetails" RemoteIpDetails.of_json in
      make ?loginAttributes ?remoteIpDetails ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Indicates that a login attempt was made to the potentially compromised database from a remote IP address."]
module Anomaly =
  struct
    type nonrec t =
      {
      profiles: AnomalyProfiles.t option
        [@ocaml.doc "Information about the types of profiles."];
      unusual: AnomalyUnusual.t option
        [@ocaml.doc "Information about the behavior of the anomalies."]}
    let make ?profiles = fun ?unusual -> fun () -> { profiles; unusual }
    let to_value x =
      structure_to_value
        [("profiles", (Option.map x.profiles ~f:AnomalyProfiles.to_value));
        ("unusual", (Option.map x.unusual ~f:AnomalyUnusual.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unusual =
        (Option.map ~f:AnomalyUnusual.of_xml) (Xml.child xml_arg0 "unusual") in
      let profiles =
        (Option.map ~f:AnomalyProfiles.of_xml)
          (Xml.child xml_arg0 "profiles") in
      make ?unusual ?profiles ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unusual = field_map json__ "Unusual" AnomalyUnusual.of_json in
      let profiles = field_map json__ "Profiles" AnomalyProfiles.of_json in
      make ?unusual ?profiles ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the anomalies."]
module Sequence =
  struct
    type nonrec t =
      {
      uid: String_.t option
        [@ocaml.doc "Unique identifier of the attack sequence."];
      description: SequenceDescription.t option
        [@ocaml.doc "Description of the attack sequence."];
      actors: Actors.t option
        [@ocaml.doc
          "Contains information about the actors involved in the attack sequence."];
      resources: Resources.t option
        [@ocaml.doc
          "Contains information about the resources involved in the attack sequence."];
      endpoints: NetworkEndpoints.t option
        [@ocaml.doc
          "Contains information about the network endpoints that were used in the attack sequence."];
      signals: Signals.t option
        [@ocaml.doc
          "Contains information about the signals involved in the attack sequence."];
      sequenceIndicators: Indicators.t option
        [@ocaml.doc
          "Contains information about the indicators observed in the attack sequence."];
      additionalSequenceTypes: AdditionalSequenceTypes.t option
        [@ocaml.doc
          "Additional types of sequences that may be associated with the attack sequence finding, providing further context about the nature of the detected threat."]}
    let make ?uid =
      fun ?description ->
        fun ?actors ->
          fun ?resources ->
            fun ?endpoints ->
              fun ?signals ->
                fun ?sequenceIndicators ->
                  fun ?additionalSequenceTypes ->
                    fun () ->
                      {
                        uid;
                        description;
                        actors;
                        resources;
                        endpoints;
                        signals;
                        sequenceIndicators;
                        additionalSequenceTypes
                      }
    let to_value x =
      structure_to_value
        [("uid", (Option.map x.uid ~f:String_.to_value));
        ("description",
          (Option.map x.description ~f:SequenceDescription.to_value));
        ("actors", (Option.map x.actors ~f:Actors.to_value));
        ("resources", (Option.map x.resources ~f:Resources.to_value));
        ("endpoints", (Option.map x.endpoints ~f:NetworkEndpoints.to_value));
        ("signals", (Option.map x.signals ~f:Signals.to_value));
        ("sequenceIndicators",
          (Option.map x.sequenceIndicators ~f:Indicators.to_value));
        ("additionalSequenceTypes",
          (Option.map x.additionalSequenceTypes
             ~f:AdditionalSequenceTypes.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalSequenceTypes =
        (Option.map ~f:AdditionalSequenceTypes.of_xml)
          (Xml.child xml_arg0 "additionalSequenceTypes") in
      let sequenceIndicators =
        (Option.map ~f:Indicators.of_xml)
          (Xml.child xml_arg0 "sequenceIndicators") in
      let signals =
        (Option.map ~f:Signals.of_xml) (Xml.child xml_arg0 "signals") in
      let endpoints =
        (Option.map ~f:NetworkEndpoints.of_xml)
          (Xml.child xml_arg0 "endpoints") in
      let resources =
        (Option.map ~f:Resources.of_xml) (Xml.child xml_arg0 "resources") in
      let actors =
        (Option.map ~f:Actors.of_xml) (Xml.child xml_arg0 "actors") in
      let description =
        (Option.map ~f:SequenceDescription.of_xml)
          (Xml.child xml_arg0 "description") in
      let uid = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "uid") in
      make ?additionalSequenceTypes ?sequenceIndicators ?signals ?endpoints
        ?resources ?actors ?description ?uid ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalSequenceTypes =
        field_map json__ "AdditionalSequenceTypes"
          AdditionalSequenceTypes.of_json in
      let sequenceIndicators =
        field_map json__ "SequenceIndicators" Indicators.of_json in
      let signals = field_map json__ "Signals" Signals.of_json in
      let endpoints = field_map json__ "Endpoints" NetworkEndpoints.of_json in
      let resources = field_map json__ "Resources" Resources.of_json in
      let actors = field_map json__ "Actors" Actors.of_json in
      let description =
        field_map json__ "Description" SequenceDescription.of_json in
      let uid = field_map json__ "Uid" String_.of_json in
      make ?additionalSequenceTypes ?sequenceIndicators ?signals ?endpoints
        ?resources ?actors ?description ?uid ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the GuardDuty attack sequence finding."]
module ScanDetections =
  struct
    type nonrec t =
      {
      scannedItemCount: ScannedItemCount.t option
        [@ocaml.doc "Total number of scanned files."];
      threatsDetectedItemCount: ThreatsDetectedItemCount.t option
        [@ocaml.doc "Total number of infected files."];
      highestSeverityThreatDetails: HighestSeverityThreatDetails.t option
        [@ocaml.doc
          "Details of the highest severity threat detected during malware scan and number of infected files."];
      threatDetectedByName: ThreatDetectedByName.t option
        [@ocaml.doc
          "Contains details about identified threats organized by threat name."]}
    let make ?scannedItemCount =
      fun ?threatsDetectedItemCount ->
        fun ?highestSeverityThreatDetails ->
          fun ?threatDetectedByName ->
            fun () ->
              {
                scannedItemCount;
                threatsDetectedItemCount;
                highestSeverityThreatDetails;
                threatDetectedByName
              }
    let to_value x =
      structure_to_value
        [("scannedItemCount",
           (Option.map x.scannedItemCount ~f:ScannedItemCount.to_value));
        ("threatsDetectedItemCount",
          (Option.map x.threatsDetectedItemCount
             ~f:ThreatsDetectedItemCount.to_value));
        ("highestSeverityThreatDetails",
          (Option.map x.highestSeverityThreatDetails
             ~f:HighestSeverityThreatDetails.to_value));
        ("threatDetectedByName",
          (Option.map x.threatDetectedByName ~f:ThreatDetectedByName.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatDetectedByName =
        (Option.map ~f:ThreatDetectedByName.of_xml)
          (Xml.child xml_arg0 "threatDetectedByName") in
      let highestSeverityThreatDetails =
        (Option.map ~f:HighestSeverityThreatDetails.of_xml)
          (Xml.child xml_arg0 "highestSeverityThreatDetails") in
      let threatsDetectedItemCount =
        (Option.map ~f:ThreatsDetectedItemCount.of_xml)
          (Xml.child xml_arg0 "threatsDetectedItemCount") in
      let scannedItemCount =
        (Option.map ~f:ScannedItemCount.of_xml)
          (Xml.child xml_arg0 "scannedItemCount") in
      make ?threatDetectedByName ?highestSeverityThreatDetails
        ?threatsDetectedItemCount ?scannedItemCount ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatDetectedByName =
        field_map json__ "ThreatDetectedByName" ThreatDetectedByName.of_json in
      let highestSeverityThreatDetails =
        field_map json__ "HighestSeverityThreatDetails"
          HighestSeverityThreatDetails.of_json in
      let threatsDetectedItemCount =
        field_map json__ "ThreatsDetectedItemCount"
          ThreatsDetectedItemCount.of_json in
      let scannedItemCount =
        field_map json__ "ScannedItemCount" ScannedItemCount.of_json in
      make ?threatDetectedByName ?highestSeverityThreatDetails
        ?threatsDetectedItemCount ?scannedItemCount ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains a complete view providing malware scan result details."]
module ScanType =
  struct
    type nonrec t =
      | GUARDDUTY_INITIATED 
      | ON_DEMAND 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | GUARDDUTY_INITIATED -> "GUARDDUTY_INITIATED"
      | ON_DEMAND -> "ON_DEMAND"
      | Non_static_id s -> s
    let of_string =
      function
      | "GUARDDUTY_INITIATED" -> GUARDDUTY_INITIATED
      | "ON_DEMAND" -> ON_DEMAND
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ScanType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ScanType" j)
    let to_json = simple_to_json to_value
  end
module Sources =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"Sources" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module ThreatIntelligenceDetails =
  struct
    type nonrec t = ThreatIntelligenceDetail.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ThreatIntelligenceDetail.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ThreatIntelligenceDetail.of_xml)
    let of_json j =
      list_of_json ~kind:"ThreatIntelligenceDetails"
        ~of_json:ThreatIntelligenceDetail.of_json j
    let to_json v = composed_to_json to_value v
  end
module MalwareProtectionFindingsScanConfiguration =
  struct
    type nonrec t =
      {
      triggerType: TriggerType.t option
        [@ocaml.doc "The event that triggered the malware scan."];
      incrementalScanDetails: IncrementalScanDetails.t option }
    let make ?triggerType =
      fun ?incrementalScanDetails ->
        fun () -> { triggerType; incrementalScanDetails }
    let to_value x =
      structure_to_value
        [("triggerType", (Option.map x.triggerType ~f:TriggerType.to_value));
        ("incrementalScanDetails",
          (Option.map x.incrementalScanDetails
             ~f:IncrementalScanDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let incrementalScanDetails =
        (Option.map ~f:IncrementalScanDetails.of_xml)
          (Xml.child xml_arg0 "incrementalScanDetails") in
      let triggerType =
        (Option.map ~f:TriggerType.of_xml) (Xml.child xml_arg0 "triggerType") in
      make ?incrementalScanDetails ?triggerType ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let incrementalScanDetails =
        field_map json__ "IncrementalScanDetails"
          IncrementalScanDetails.of_json in
      let triggerType = field_map json__ "TriggerType" TriggerType.of_json in
      make ?incrementalScanDetails ?triggerType ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains finding configuration details about the malware scan."]
module MalwareProtectionScanType =
  struct
    type nonrec t =
      | BACKUP_INITIATED 
      | ON_DEMAND 
      | GUARDDUTY_INITIATED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | BACKUP_INITIATED -> "BACKUP_INITIATED"
      | ON_DEMAND -> "ON_DEMAND"
      | GUARDDUTY_INITIATED -> "GUARDDUTY_INITIATED"
      | Non_static_id s -> s
    let of_string =
      function
      | "BACKUP_INITIATED" -> BACKUP_INITIATED
      | "ON_DEMAND" -> ON_DEMAND
      | "GUARDDUTY_INITIATED" -> GUARDDUTY_INITIATED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration MalwareProtectionScanType" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"MalwareProtectionScanType" j)
    let to_json = simple_to_json to_value
  end
module ScanCategory =
  struct
    type nonrec t =
      | FULL_SCAN 
      | INCREMENTAL_SCAN 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | FULL_SCAN -> "FULL_SCAN"
      | INCREMENTAL_SCAN -> "INCREMENTAL_SCAN"
      | Non_static_id s -> s
    let of_string =
      function
      | "FULL_SCAN" -> FULL_SCAN
      | "INCREMENTAL_SCAN" -> INCREMENTAL_SCAN
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ScanCategory" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ScanCategory" j)
    let to_json = simple_to_json to_value
  end
module Threats =
  struct
    type nonrec t = Threat.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Threat.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Threat.of_xml)
    let of_json j = list_of_json ~kind:"Threats" ~of_json:Threat.of_json j
    let to_json v = composed_to_json to_value v
  end
module RuntimeContext =
  struct
    type nonrec t =
      {
      modifyingProcess: ProcessDetails.t option
        [@ocaml.doc
          "Information about the process that modified the current process. This is available for multiple finding types."];
      modifiedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the process modified the current process. The timestamp is in UTC date string format."];
      scriptPath: String_.t option
        [@ocaml.doc "The path to the script that was executed."];
      libraryPath: String_.t option
        [@ocaml.doc "The path to the new library that was loaded."];
      ldPreloadValue: String_.t option
        [@ocaml.doc "The value of the LD_PRELOAD environment variable."];
      socketPath: String_.t option
        [@ocaml.doc "The path to the docket socket that was accessed."];
      runcBinaryPath: String_.t option
        [@ocaml.doc "The path to the leveraged runc implementation."];
      releaseAgentPath: String_.t option
        [@ocaml.doc
          "The path in the container that modified the release agent file."];
      mountSource: String_.t option
        [@ocaml.doc "The path on the host that is mounted by the container."];
      mountTarget: String_.t option
        [@ocaml.doc
          "The path in the container that is mapped to the host directory."];
      fileSystemType: String_.t option
        [@ocaml.doc "Represents the type of mounted fileSystem."];
      flags: FlagsList.t option
        [@ocaml.doc
          "Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag."];
      moduleName: String_.t option
        [@ocaml.doc "The name of the module loaded into the kernel."];
      moduleFilePath: String_.t option
        [@ocaml.doc "The path to the module loaded into the kernel."];
      moduleSha256: String_.t option
        [@ocaml.doc "The SHA256 hash of the module."];
      shellHistoryFilePath: String_.t option
        [@ocaml.doc "The path to the modified shell history file."];
      targetProcess: ProcessDetails.t option
        [@ocaml.doc
          "Information about the process that had its memory overwritten by the current process."];
      addressFamily: String_.t option
        [@ocaml.doc
          "Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP version of 4 protocol."];
      ianaProtocolNumber: Integer.t option
        [@ocaml.doc
          "Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol."];
      memoryRegions: MemoryRegionsList.t option
        [@ocaml.doc
          "Specifies the Region of a process's address space such as stack and heap."];
      toolName: String_.t option
        [@ocaml.doc "Name of the potentially suspicious tool."];
      toolCategory: String_.t option
        [@ocaml.doc
          "Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer."];
      serviceName: String_.t option
        [@ocaml.doc
          "Name of the security service that has been potentially disabled."];
      commandLineExample: String_.t option
        [@ocaml.doc
          "Example of the command line involved in the suspicious activity."];
      threatFilePath: String_.t option
        [@ocaml.doc
          "The suspicious file path for which the threat intelligence details were found."]}
    let make ?modifyingProcess =
      fun ?modifiedAt ->
        fun ?scriptPath ->
          fun ?libraryPath ->
            fun ?ldPreloadValue ->
              fun ?socketPath ->
                fun ?runcBinaryPath ->
                  fun ?releaseAgentPath ->
                    fun ?mountSource ->
                      fun ?mountTarget ->
                        fun ?fileSystemType ->
                          fun ?flags ->
                            fun ?moduleName ->
                              fun ?moduleFilePath ->
                                fun ?moduleSha256 ->
                                  fun ?shellHistoryFilePath ->
                                    fun ?targetProcess ->
                                      fun ?addressFamily ->
                                        fun ?ianaProtocolNumber ->
                                          fun ?memoryRegions ->
                                            fun ?toolName ->
                                              fun ?toolCategory ->
                                                fun ?serviceName ->
                                                  fun ?commandLineExample ->
                                                    fun ?threatFilePath ->
                                                      fun () ->
                                                        {
                                                          modifyingProcess;
                                                          modifiedAt;
                                                          scriptPath;
                                                          libraryPath;
                                                          ldPreloadValue;
                                                          socketPath;
                                                          runcBinaryPath;
                                                          releaseAgentPath;
                                                          mountSource;
                                                          mountTarget;
                                                          fileSystemType;
                                                          flags;
                                                          moduleName;
                                                          moduleFilePath;
                                                          moduleSha256;
                                                          shellHistoryFilePath;
                                                          targetProcess;
                                                          addressFamily;
                                                          ianaProtocolNumber;
                                                          memoryRegions;
                                                          toolName;
                                                          toolCategory;
                                                          serviceName;
                                                          commandLineExample;
                                                          threatFilePath
                                                        }
    let to_value x =
      structure_to_value
        [("modifyingProcess",
           (Option.map x.modifyingProcess ~f:ProcessDetails.to_value));
        ("modifiedAt", (Option.map x.modifiedAt ~f:Timestamp.to_value));
        ("scriptPath", (Option.map x.scriptPath ~f:String_.to_value));
        ("libraryPath", (Option.map x.libraryPath ~f:String_.to_value));
        ("ldPreloadValue", (Option.map x.ldPreloadValue ~f:String_.to_value));
        ("socketPath", (Option.map x.socketPath ~f:String_.to_value));
        ("runcBinaryPath", (Option.map x.runcBinaryPath ~f:String_.to_value));
        ("releaseAgentPath",
          (Option.map x.releaseAgentPath ~f:String_.to_value));
        ("mountSource", (Option.map x.mountSource ~f:String_.to_value));
        ("mountTarget", (Option.map x.mountTarget ~f:String_.to_value));
        ("fileSystemType", (Option.map x.fileSystemType ~f:String_.to_value));
        ("flags", (Option.map x.flags ~f:FlagsList.to_value));
        ("moduleName", (Option.map x.moduleName ~f:String_.to_value));
        ("moduleFilePath", (Option.map x.moduleFilePath ~f:String_.to_value));
        ("moduleSha256", (Option.map x.moduleSha256 ~f:String_.to_value));
        ("shellHistoryFilePath",
          (Option.map x.shellHistoryFilePath ~f:String_.to_value));
        ("targetProcess",
          (Option.map x.targetProcess ~f:ProcessDetails.to_value));
        ("addressFamily", (Option.map x.addressFamily ~f:String_.to_value));
        ("ianaProtocolNumber",
          (Option.map x.ianaProtocolNumber ~f:Integer.to_value));
        ("memoryRegions",
          (Option.map x.memoryRegions ~f:MemoryRegionsList.to_value));
        ("toolName", (Option.map x.toolName ~f:String_.to_value));
        ("toolCategory", (Option.map x.toolCategory ~f:String_.to_value));
        ("serviceName", (Option.map x.serviceName ~f:String_.to_value));
        ("commandLineExample",
          (Option.map x.commandLineExample ~f:String_.to_value));
        ("threatFilePath", (Option.map x.threatFilePath ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatFilePath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "threatFilePath") in
      let commandLineExample =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "commandLineExample") in
      let serviceName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "serviceName") in
      let toolCategory =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "toolCategory") in
      let toolName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "toolName") in
      let memoryRegions =
        (Option.map ~f:MemoryRegionsList.of_xml)
          (Xml.child xml_arg0 "memoryRegions") in
      let ianaProtocolNumber =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "ianaProtocolNumber") in
      let addressFamily =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "addressFamily") in
      let targetProcess =
        (Option.map ~f:ProcessDetails.of_xml)
          (Xml.child xml_arg0 "targetProcess") in
      let shellHistoryFilePath =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "shellHistoryFilePath") in
      let moduleSha256 =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "moduleSha256") in
      let moduleFilePath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "moduleFilePath") in
      let moduleName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "moduleName") in
      let flags =
        (Option.map ~f:FlagsList.of_xml) (Xml.child xml_arg0 "flags") in
      let fileSystemType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "fileSystemType") in
      let mountTarget =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "mountTarget") in
      let mountSource =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "mountSource") in
      let releaseAgentPath =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "releaseAgentPath") in
      let runcBinaryPath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "runcBinaryPath") in
      let socketPath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "socketPath") in
      let ldPreloadValue =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "ldPreloadValue") in
      let libraryPath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "libraryPath") in
      let scriptPath =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "scriptPath") in
      let modifiedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "modifiedAt") in
      let modifyingProcess =
        (Option.map ~f:ProcessDetails.of_xml)
          (Xml.child xml_arg0 "modifyingProcess") in
      make ?threatFilePath ?commandLineExample ?serviceName ?toolCategory
        ?toolName ?memoryRegions ?ianaProtocolNumber ?addressFamily
        ?targetProcess ?shellHistoryFilePath ?moduleSha256 ?moduleFilePath
        ?moduleName ?flags ?fileSystemType ?mountTarget ?mountSource
        ?releaseAgentPath ?runcBinaryPath ?socketPath ?ldPreloadValue
        ?libraryPath ?scriptPath ?modifiedAt ?modifyingProcess ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatFilePath = field_map json__ "ThreatFilePath" String_.of_json in
      let commandLineExample =
        field_map json__ "CommandLineExample" String_.of_json in
      let serviceName = field_map json__ "ServiceName" String_.of_json in
      let toolCategory = field_map json__ "ToolCategory" String_.of_json in
      let toolName = field_map json__ "ToolName" String_.of_json in
      let memoryRegions =
        field_map json__ "MemoryRegions" MemoryRegionsList.of_json in
      let ianaProtocolNumber =
        field_map json__ "IanaProtocolNumber" Integer.of_json in
      let addressFamily = field_map json__ "AddressFamily" String_.of_json in
      let targetProcess =
        field_map json__ "TargetProcess" ProcessDetails.of_json in
      let shellHistoryFilePath =
        field_map json__ "ShellHistoryFilePath" String_.of_json in
      let moduleSha256 = field_map json__ "ModuleSha256" String_.of_json in
      let moduleFilePath = field_map json__ "ModuleFilePath" String_.of_json in
      let moduleName = field_map json__ "ModuleName" String_.of_json in
      let flags = field_map json__ "Flags" FlagsList.of_json in
      let fileSystemType = field_map json__ "FileSystemType" String_.of_json in
      let mountTarget = field_map json__ "MountTarget" String_.of_json in
      let mountSource = field_map json__ "MountSource" String_.of_json in
      let releaseAgentPath =
        field_map json__ "ReleaseAgentPath" String_.of_json in
      let runcBinaryPath = field_map json__ "RuncBinaryPath" String_.of_json in
      let socketPath = field_map json__ "SocketPath" String_.of_json in
      let ldPreloadValue = field_map json__ "LdPreloadValue" String_.of_json in
      let libraryPath = field_map json__ "LibraryPath" String_.of_json in
      let scriptPath = field_map json__ "ScriptPath" String_.of_json in
      let modifiedAt = field_map json__ "ModifiedAt" Timestamp.of_json in
      let modifyingProcess =
        field_map json__ "ModifyingProcess" ProcessDetails.of_json in
      make ?threatFilePath ?commandLineExample ?serviceName ?toolCategory
        ?toolName ?memoryRegions ?ianaProtocolNumber ?addressFamily
        ?targetProcess ?shellHistoryFilePath ?moduleSha256 ?moduleFilePath
        ?moduleName ?flags ?fileSystemType ?mountTarget ?mountSource
        ?releaseAgentPath ?runcBinaryPath ?socketPath ?ldPreloadValue
        ?libraryPath ?scriptPath ?modifiedAt ?modifyingProcess ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Additional information about the suspicious activity."]
module OrganizationEbsVolumes =
  struct
    type nonrec t =
      {
      autoEnable: Boolean.t option
        [@ocaml.doc
          "Whether scanning EBS volumes should be auto-enabled for new members joining the organization."]}
    let make ?autoEnable = fun () -> { autoEnable }
    let to_value x =
      structure_to_value
        [("autoEnable", (Option.map x.autoEnable ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnable =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "autoEnable") in
      make ?autoEnable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnable = field_map json__ "AutoEnable" Boolean.of_json in
      make ?autoEnable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Organization-wide EBS volumes scan configuration."]
module OrganizationAdditionalConfiguration =
  struct
    type nonrec t =
      {
      name: OrgFeatureAdditionalConfiguration.t option
        [@ocaml.doc
          "The name of the additional configuration that will be configured for the organization. These values are applicable to only Runtime Monitoring protection plan."];
      autoEnable: OrgFeatureStatus.t option
        [@ocaml.doc
          "The status of the additional configuration that will be configured for the organization. Use one of the following values to configure the feature status for the entire organization: NEW: Indicates that when a new account joins the organization, they will have the additional configuration enabled automatically. ALL: Indicates that all accounts in the organization have the additional configuration enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. It may take up to 24 hours to update the configuration for all the member accounts. NONE: Indicates that the additional configuration will not be automatically enabled for any account in the organization. The administrator must manage the additional configuration for each account individually."]}
    let make ?name = fun ?autoEnable -> fun () -> { name; autoEnable }
    let to_value x =
      structure_to_value
        [("name",
           (Option.map x.name ~f:OrgFeatureAdditionalConfiguration.to_value));
        ("autoEnable",
          (Option.map x.autoEnable ~f:OrgFeatureStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnable =
        (Option.map ~f:OrgFeatureStatus.of_xml)
          (Xml.child xml_arg0 "autoEnable") in
      let name =
        (Option.map ~f:OrgFeatureAdditionalConfiguration.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?autoEnable ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnable = field_map json__ "AutoEnable" OrgFeatureStatus.of_json in
      let name =
        field_map json__ "Name" OrgFeatureAdditionalConfiguration.of_json in
      make ?autoEnable ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "A list of additional configurations which will be configured for the organization. Additional configuration applies to only GuardDuty Runtime Monitoring protection plan."]
module MemberAdditionalConfiguration =
  struct
    type nonrec t =
      {
      name: OrgFeatureAdditionalConfiguration.t option
        [@ocaml.doc "Name of the additional configuration."];
      status: FeatureStatus.t option
        [@ocaml.doc "Status of the additional configuration."]}
    let make ?name = fun ?status -> fun () -> { name; status }
    let to_value x =
      structure_to_value
        [("name",
           (Option.map x.name ~f:OrgFeatureAdditionalConfiguration.to_value));
        ("status", (Option.map x.status ~f:FeatureStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:FeatureStatus.of_xml) (Xml.child xml_arg0 "status") in
      let name =
        (Option.map ~f:OrgFeatureAdditionalConfiguration.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?status ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status = field_map json__ "Status" FeatureStatus.of_json in
      let name =
        field_map json__ "Name" OrgFeatureAdditionalConfiguration.of_json in
      make ?status ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the additional configuration for the member account."]
module MapEquals =
  struct
    type nonrec t = ScanConditionPair.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ScanConditionPair.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ScanConditionPair.of_xml)
    let of_json j =
      list_of_json ~kind:"MapEquals" ~of_json:ScanConditionPair.of_json j
    let to_json v = composed_to_json to_value v
  end
module Eq =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"Eq" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module Matches =
  struct
    type nonrec t = Match.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:5) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Match.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Match.of_xml)
    let of_json j = list_of_json ~kind:"Matches" ~of_json:Match.of_json j
    let to_json v = composed_to_json to_value v
  end
module Neq =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"Neq" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module NotMatches =
  struct
    type nonrec t = NotMatch.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:5) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:NotMatch.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:NotMatch.of_xml)
    let of_json j =
      list_of_json ~kind:"NotMatches" ~of_json:NotMatch.of_json j
    let to_json v = composed_to_json to_value v
  end
module DetectorAdditionalConfiguration =
  struct
    type nonrec t =
      {
      name: FeatureAdditionalConfiguration.t option
        [@ocaml.doc "Name of the additional configuration."];
      status: FeatureStatus.t option
        [@ocaml.doc "Status of the additional configuration."]}
    let make ?name = fun ?status -> fun () -> { name; status }
    let to_value x =
      structure_to_value
        [("name",
           (Option.map x.name ~f:FeatureAdditionalConfiguration.to_value));
        ("status", (Option.map x.status ~f:FeatureStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:FeatureStatus.of_xml) (Xml.child xml_arg0 "status") in
      let name =
        (Option.map ~f:FeatureAdditionalConfiguration.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?status ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status = field_map json__ "Status" FeatureStatus.of_json in
      let name =
        field_map json__ "Name" FeatureAdditionalConfiguration.of_json in
      make ?status ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the additional configuration for a feature in your GuardDuty account."]
module FilterCondition =
  struct
    type nonrec t =
      {
      equalsValue: NonEmptyString.t option
        [@ocaml.doc
          "Represents an equal condition to be applied to a single field when querying for scan entries."];
      greaterThan: LongValue.t option
        [@ocaml.doc
          "Represents a greater than condition to be applied to a single field when querying for scan entries."];
      lessThan: LongValue.t option
        [@ocaml.doc
          "Represents a less than condition to be applied to a single field when querying for scan entries."]}
    let make ?equalsValue =
      fun ?greaterThan ->
        fun ?lessThan -> fun () -> { equalsValue; greaterThan; lessThan }
    let to_value x =
      structure_to_value
        [("equalsValue",
           (Option.map x.equalsValue ~f:NonEmptyString.to_value));
        ("greaterThan", (Option.map x.greaterThan ~f:LongValue.to_value));
        ("lessThan", (Option.map x.lessThan ~f:LongValue.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let lessThan =
        (Option.map ~f:LongValue.of_xml) (Xml.child xml_arg0 "lessThan") in
      let greaterThan =
        (Option.map ~f:LongValue.of_xml) (Xml.child xml_arg0 "greaterThan") in
      let equalsValue =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "equalsValue") in
      make ?lessThan ?greaterThan ?equalsValue ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let lessThan = field_map json__ "LessThan" LongValue.of_json in
      let greaterThan = field_map json__ "GreaterThan" LongValue.of_json in
      let equalsValue = field_map json__ "EqualsValue" NonEmptyString.of_json in
      make ?lessThan ?greaterThan ?equalsValue ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the condition."]
module ListMalwareScansCriterionKey =
  struct
    type nonrec t =
      | RESOURCE_ARN 
      | SCAN_ID 
      | ACCOUNT_ID 
      | GUARDDUTY_FINDING_ID 
      | RESOURCE_TYPE 
      | SCAN_START_TIME 
      | SCAN_STATUS 
      | SCAN_TYPE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | RESOURCE_ARN -> "RESOURCE_ARN"
      | SCAN_ID -> "SCAN_ID"
      | ACCOUNT_ID -> "ACCOUNT_ID"
      | GUARDDUTY_FINDING_ID -> "GUARDDUTY_FINDING_ID"
      | RESOURCE_TYPE -> "RESOURCE_TYPE"
      | SCAN_START_TIME -> "SCAN_START_TIME"
      | SCAN_STATUS -> "SCAN_STATUS"
      | SCAN_TYPE -> "SCAN_TYPE"
      | Non_static_id s -> s
    let of_string =
      function
      | "RESOURCE_ARN" -> RESOURCE_ARN
      | "SCAN_ID" -> SCAN_ID
      | "ACCOUNT_ID" -> ACCOUNT_ID
      | "GUARDDUTY_FINDING_ID" -> GUARDDUTY_FINDING_ID
      | "RESOURCE_TYPE" -> RESOURCE_TYPE
      | "SCAN_START_TIME" -> SCAN_START_TIME
      | "SCAN_STATUS" -> SCAN_STATUS
      | "SCAN_TYPE" -> SCAN_TYPE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration ListMalwareScansCriterionKey"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"ListMalwareScansCriterionKey" j)
    let to_json = simple_to_json to_value
  end
module CoverageEc2InstanceDetails =
  struct
    type nonrec t =
      {
      instanceId: String_.t option [@ocaml.doc "The Amazon EC2 instance ID."];
      instanceType: String_.t option
        [@ocaml.doc "The instance type of the Amazon EC2 instance."];
      clusterArn: String_.t option
        [@ocaml.doc
          "The cluster ARN of the Amazon ECS cluster running on the Amazon EC2 instance."];
      agentDetails: AgentDetails.t option
        [@ocaml.doc "Information about the installed security agent."];
      managementType: ManagementType.t option
        [@ocaml.doc
          "Indicates how the GuardDuty security agent is managed for this resource. AUTO_MANAGED indicates that GuardDuty deploys and manages updates for this resource. MANUAL indicates that you are responsible to deploy, update, and manage the GuardDuty security agent updates for this resource. The DISABLED status doesn't apply to Amazon EC2 instances and Amazon EKS clusters."]}
    let make ?instanceId =
      fun ?instanceType ->
        fun ?clusterArn ->
          fun ?agentDetails ->
            fun ?managementType ->
              fun () ->
                {
                  instanceId;
                  instanceType;
                  clusterArn;
                  agentDetails;
                  managementType
                }
    let to_value x =
      structure_to_value
        [("instanceId", (Option.map x.instanceId ~f:String_.to_value));
        ("instanceType", (Option.map x.instanceType ~f:String_.to_value));
        ("clusterArn", (Option.map x.clusterArn ~f:String_.to_value));
        ("agentDetails",
          (Option.map x.agentDetails ~f:AgentDetails.to_value));
        ("managementType",
          (Option.map x.managementType ~f:ManagementType.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let managementType =
        (Option.map ~f:ManagementType.of_xml)
          (Xml.child xml_arg0 "managementType") in
      let agentDetails =
        (Option.map ~f:AgentDetails.of_xml)
          (Xml.child xml_arg0 "agentDetails") in
      let clusterArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "clusterArn") in
      let instanceType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "instanceType") in
      let instanceId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "instanceId") in
      make ?managementType ?agentDetails ?clusterArn ?instanceType
        ?instanceId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let managementType =
        field_map json__ "ManagementType" ManagementType.of_json in
      let agentDetails = field_map json__ "AgentDetails" AgentDetails.of_json in
      let clusterArn = field_map json__ "ClusterArn" String_.of_json in
      let instanceType = field_map json__ "InstanceType" String_.of_json in
      let instanceId = field_map json__ "InstanceId" String_.of_json in
      make ?managementType ?agentDetails ?clusterArn ?instanceType
        ?instanceId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon EC2 instance runtime coverage details."]
module CoverageEcsClusterDetails =
  struct
    type nonrec t =
      {
      clusterName: String_.t option
        [@ocaml.doc "The name of the Amazon ECS cluster."];
      fargateDetails: FargateDetails.t option
        [@ocaml.doc
          "Information about the Fargate details associated with the Amazon ECS cluster."];
      containerInstanceDetails: ContainerInstanceDetails.t option
        [@ocaml.doc
          "Information about the Amazon ECS container running on Amazon EC2 instance."]}
    let make ?clusterName =
      fun ?fargateDetails ->
        fun ?containerInstanceDetails ->
          fun () -> { clusterName; fargateDetails; containerInstanceDetails }
    let to_value x =
      structure_to_value
        [("clusterName", (Option.map x.clusterName ~f:String_.to_value));
        ("fargateDetails",
          (Option.map x.fargateDetails ~f:FargateDetails.to_value));
        ("containerInstanceDetails",
          (Option.map x.containerInstanceDetails
             ~f:ContainerInstanceDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let containerInstanceDetails =
        (Option.map ~f:ContainerInstanceDetails.of_xml)
          (Xml.child xml_arg0 "containerInstanceDetails") in
      let fargateDetails =
        (Option.map ~f:FargateDetails.of_xml)
          (Xml.child xml_arg0 "fargateDetails") in
      let clusterName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "clusterName") in
      make ?containerInstanceDetails ?fargateDetails ?clusterName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let containerInstanceDetails =
        field_map json__ "ContainerInstanceDetails"
          ContainerInstanceDetails.of_json in
      let fargateDetails =
        field_map json__ "FargateDetails" FargateDetails.of_json in
      let clusterName = field_map json__ "ClusterName" String_.of_json in
      make ?containerInstanceDetails ?fargateDetails ?clusterName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about Amazon ECS cluster runtime coverage details."]
module CoverageEksClusterDetails =
  struct
    type nonrec t =
      {
      clusterName: String_.t option [@ocaml.doc "Name of the EKS cluster."];
      coveredNodes: Long.t option
        [@ocaml.doc
          "Represents the nodes within the EKS cluster that have a HEALTHY coverage status."];
      compatibleNodes: Long.t option
        [@ocaml.doc
          "Represents all the nodes within the EKS cluster in your account."];
      addonDetails: AddonDetails.t option
        [@ocaml.doc "Information about the installed EKS add-on."];
      managementType: ManagementType.t option
        [@ocaml.doc
          "Indicates how the Amazon EKS add-on GuardDuty agent is managed for this EKS cluster. AUTO_MANAGED indicates GuardDuty deploys and manages updates for this resource. MANUAL indicates that you are responsible to deploy, update, and manage the Amazon EKS add-on GuardDuty agent for this resource."]}
    let make ?clusterName =
      fun ?coveredNodes ->
        fun ?compatibleNodes ->
          fun ?addonDetails ->
            fun ?managementType ->
              fun () ->
                {
                  clusterName;
                  coveredNodes;
                  compatibleNodes;
                  addonDetails;
                  managementType
                }
    let to_value x =
      structure_to_value
        [("clusterName", (Option.map x.clusterName ~f:String_.to_value));
        ("coveredNodes", (Option.map x.coveredNodes ~f:Long.to_value));
        ("compatibleNodes", (Option.map x.compatibleNodes ~f:Long.to_value));
        ("addonDetails",
          (Option.map x.addonDetails ~f:AddonDetails.to_value));
        ("managementType",
          (Option.map x.managementType ~f:ManagementType.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let managementType =
        (Option.map ~f:ManagementType.of_xml)
          (Xml.child xml_arg0 "managementType") in
      let addonDetails =
        (Option.map ~f:AddonDetails.of_xml)
          (Xml.child xml_arg0 "addonDetails") in
      let compatibleNodes =
        (Option.map ~f:Long.of_xml) (Xml.child xml_arg0 "compatibleNodes") in
      let coveredNodes =
        (Option.map ~f:Long.of_xml) (Xml.child xml_arg0 "coveredNodes") in
      let clusterName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "clusterName") in
      make ?managementType ?addonDetails ?compatibleNodes ?coveredNodes
        ?clusterName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let managementType =
        field_map json__ "ManagementType" ManagementType.of_json in
      let addonDetails = field_map json__ "AddonDetails" AddonDetails.of_json in
      let compatibleNodes = field_map json__ "CompatibleNodes" Long.of_json in
      let coveredNodes = field_map json__ "CoveredNodes" Long.of_json in
      let clusterName = field_map json__ "ClusterName" String_.of_json in
      make ?managementType ?addonDetails ?compatibleNodes ?coveredNodes
        ?clusterName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the EKS cluster that has a coverage status."]
module ResourceType =
  struct
    type nonrec t =
      | EKS 
      | ECS 
      | EC2 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | EKS -> "EKS"
      | ECS -> "ECS"
      | EC2 -> "EC2"
      | Non_static_id s -> s
    let of_string =
      function
      | "EKS" -> EKS
      | "ECS" -> ECS
      | "EC2" -> EC2
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ResourceType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ResourceType" j)
    let to_json = simple_to_json to_value
  end
module CoverageFilterCondition =
  struct
    type nonrec t =
      {
      equals: Equals.t option
        [@ocaml.doc
          "Represents an equal condition that is applied to a single field while retrieving the coverage details."];
      notEquals: NotEquals.t option
        [@ocaml.doc
          "Represents a not equal condition that is applied to a single field while retrieving the coverage details."]}
    let make ?equals = fun ?notEquals -> fun () -> { equals; notEquals }
    let to_value x =
      structure_to_value
        [("equals", (Option.map x.equals ~f:Equals.to_value));
        ("notEquals", (Option.map x.notEquals ~f:NotEquals.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let notEquals =
        (Option.map ~f:NotEquals.of_xml) (Xml.child xml_arg0 "notEquals") in
      let equals =
        (Option.map ~f:Equals.of_xml) (Xml.child xml_arg0 "equals") in
      make ?notEquals ?equals ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let notEquals = field_map json__ "NotEquals" NotEquals.of_json in
      let equals = field_map json__ "Equals" Equals.of_json in
      make ?notEquals ?equals ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents a condition that when matched will be added to the response of the operation."]
module CoverageFilterCriterionKey =
  struct
    type nonrec t =
      | ACCOUNT_ID 
      | RESOURCE_TYPE 
      | COVERAGE_STATUS 
      | ADDON_VERSION 
      | CLUSTER_NAME 
      | ECS_CLUSTER_NAME 
      | MANAGEMENT_TYPE 
      | EKS_CLUSTER_NAME 
      | AGENT_VERSION 
      | INSTANCE_ID 
      | CLUSTER_ARN 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ACCOUNT_ID -> "ACCOUNT_ID"
      | RESOURCE_TYPE -> "RESOURCE_TYPE"
      | COVERAGE_STATUS -> "COVERAGE_STATUS"
      | ADDON_VERSION -> "ADDON_VERSION"
      | CLUSTER_NAME -> "CLUSTER_NAME"
      | ECS_CLUSTER_NAME -> "ECS_CLUSTER_NAME"
      | MANAGEMENT_TYPE -> "MANAGEMENT_TYPE"
      | EKS_CLUSTER_NAME -> "EKS_CLUSTER_NAME"
      | AGENT_VERSION -> "AGENT_VERSION"
      | INSTANCE_ID -> "INSTANCE_ID"
      | CLUSTER_ARN -> "CLUSTER_ARN"
      | Non_static_id s -> s
    let of_string =
      function
      | "ACCOUNT_ID" -> ACCOUNT_ID
      | "RESOURCE_TYPE" -> RESOURCE_TYPE
      | "COVERAGE_STATUS" -> COVERAGE_STATUS
      | "ADDON_VERSION" -> ADDON_VERSION
      | "CLUSTER_NAME" -> CLUSTER_NAME
      | "ECS_CLUSTER_NAME" -> ECS_CLUSTER_NAME
      | "MANAGEMENT_TYPE" -> MANAGEMENT_TYPE
      | "EKS_CLUSTER_NAME" -> EKS_CLUSTER_NAME
      | "AGENT_VERSION" -> AGENT_VERSION
      | "INSTANCE_ID" -> INSTANCE_ID
      | "CLUSTER_ARN" -> CLUSTER_ARN
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration CoverageFilterCriterionKey"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"CoverageFilterCriterionKey" j)
    let to_json = simple_to_json to_value
  end
module DataSource =
  struct
    type nonrec t =
      | FLOW_LOGS 
      | CLOUD_TRAIL 
      | DNS_LOGS 
      | S3_LOGS 
      | KUBERNETES_AUDIT_LOGS 
      | EC2_MALWARE_SCAN 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | FLOW_LOGS -> "FLOW_LOGS"
      | CLOUD_TRAIL -> "CLOUD_TRAIL"
      | DNS_LOGS -> "DNS_LOGS"
      | S3_LOGS -> "S3_LOGS"
      | KUBERNETES_AUDIT_LOGS -> "KUBERNETES_AUDIT_LOGS"
      | EC2_MALWARE_SCAN -> "EC2_MALWARE_SCAN"
      | Non_static_id s -> s
    let of_string =
      function
      | "FLOW_LOGS" -> FLOW_LOGS
      | "CLOUD_TRAIL" -> CLOUD_TRAIL
      | "DNS_LOGS" -> DNS_LOGS
      | "S3_LOGS" -> S3_LOGS
      | "KUBERNETES_AUDIT_LOGS" -> KUBERNETES_AUDIT_LOGS
      | "EC2_MALWARE_SCAN" -> EC2_MALWARE_SCAN
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration DataSource" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"DataSource" j)
    let to_json = simple_to_json to_value
  end
module UsageFeature =
  struct
    type nonrec t =
      | FLOW_LOGS 
      | CLOUD_TRAIL 
      | DNS_LOGS 
      | S3_DATA_EVENTS 
      | EKS_AUDIT_LOGS 
      | EBS_MALWARE_PROTECTION 
      | RDS_LOGIN_EVENTS 
      | LAMBDA_NETWORK_LOGS 
      | EKS_RUNTIME_MONITORING 
      | EC2_RUNTIME_MONITORING 
      | FARGATE_RUNTIME_MONITORING 
      | RDS_DBI_PROTECTION_PROVISIONED 
      | RDS_DBI_PROTECTION_SERVERLESS 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | FLOW_LOGS -> "FLOW_LOGS"
      | CLOUD_TRAIL -> "CLOUD_TRAIL"
      | DNS_LOGS -> "DNS_LOGS"
      | S3_DATA_EVENTS -> "S3_DATA_EVENTS"
      | EKS_AUDIT_LOGS -> "EKS_AUDIT_LOGS"
      | EBS_MALWARE_PROTECTION -> "EBS_MALWARE_PROTECTION"
      | RDS_LOGIN_EVENTS -> "RDS_LOGIN_EVENTS"
      | LAMBDA_NETWORK_LOGS -> "LAMBDA_NETWORK_LOGS"
      | EKS_RUNTIME_MONITORING -> "EKS_RUNTIME_MONITORING"
      | EC2_RUNTIME_MONITORING -> "EC2_RUNTIME_MONITORING"
      | FARGATE_RUNTIME_MONITORING -> "FARGATE_RUNTIME_MONITORING"
      | RDS_DBI_PROTECTION_PROVISIONED -> "RDS_DBI_PROTECTION_PROVISIONED"
      | RDS_DBI_PROTECTION_SERVERLESS -> "RDS_DBI_PROTECTION_SERVERLESS"
      | Non_static_id s -> s
    let of_string =
      function
      | "FLOW_LOGS" -> FLOW_LOGS
      | "CLOUD_TRAIL" -> CLOUD_TRAIL
      | "DNS_LOGS" -> DNS_LOGS
      | "S3_DATA_EVENTS" -> S3_DATA_EVENTS
      | "EKS_AUDIT_LOGS" -> EKS_AUDIT_LOGS
      | "EBS_MALWARE_PROTECTION" -> EBS_MALWARE_PROTECTION
      | "RDS_LOGIN_EVENTS" -> RDS_LOGIN_EVENTS
      | "LAMBDA_NETWORK_LOGS" -> LAMBDA_NETWORK_LOGS
      | "EKS_RUNTIME_MONITORING" -> EKS_RUNTIME_MONITORING
      | "EC2_RUNTIME_MONITORING" -> EC2_RUNTIME_MONITORING
      | "FARGATE_RUNTIME_MONITORING" -> FARGATE_RUNTIME_MONITORING
      | "RDS_DBI_PROTECTION_PROVISIONED" -> RDS_DBI_PROTECTION_PROVISIONED
      | "RDS_DBI_PROTECTION_SERVERLESS" -> RDS_DBI_PROTECTION_SERVERLESS
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration UsageFeature" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"UsageFeature" j)
    let to_json = simple_to_json to_value
  end
module UsageTopAccountsByFeatureList =
  struct
    type nonrec t = UsageTopAccountResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:UsageTopAccountResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:UsageTopAccountResult.of_xml)
    let of_json j =
      list_of_json ~kind:"UsageTopAccountsByFeatureList"
        ~of_json:UsageTopAccountResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module KubernetesDataSourceFreeTrial =
  struct
    type nonrec t =
      {
      auditLogs: DataSourceFreeTrial.t option
        [@ocaml.doc
          "Describes whether Kubernetes audit logs are enabled as a data source."]}
    let make ?auditLogs = fun () -> { auditLogs }
    let to_value x =
      structure_to_value
        [("auditLogs",
           (Option.map x.auditLogs ~f:DataSourceFreeTrial.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let auditLogs =
        (Option.map ~f:DataSourceFreeTrial.of_xml)
          (Xml.child xml_arg0 "auditLogs") in
      make ?auditLogs ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let auditLogs =
        field_map json__ "AuditLogs" DataSourceFreeTrial.of_json in
      make ?auditLogs ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides details about the Kubernetes resources when it is enabled as a data source."]
module MalwareProtectionDataSourceFreeTrial =
  struct
    type nonrec t =
      {
      scanEc2InstanceWithFindings: DataSourceFreeTrial.t option
        [@ocaml.doc
          "Describes whether Malware Protection for EC2 instances with findings is enabled as a data source."]}
    let make ?scanEc2InstanceWithFindings =
      fun () -> { scanEc2InstanceWithFindings }
    let to_value x =
      structure_to_value
        [("scanEc2InstanceWithFindings",
           (Option.map x.scanEc2InstanceWithFindings
              ~f:DataSourceFreeTrial.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanEc2InstanceWithFindings =
        (Option.map ~f:DataSourceFreeTrial.of_xml)
          (Xml.child xml_arg0 "scanEc2InstanceWithFindings") in
      make ?scanEc2InstanceWithFindings ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanEc2InstanceWithFindings =
        field_map json__ "ScanEc2InstanceWithFindings"
          DataSourceFreeTrial.of_json in
      make ?scanEc2InstanceWithFindings ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides details about Malware Protection when it is enabled as a data source."]
module FreeTrialFeatureConfigurationResult =
  struct
    type nonrec t =
      {
      name: FreeTrialFeatureResult.t option
        [@ocaml.doc
          "The name of the feature for which the free trial is configured."];
      freeTrialDaysRemaining: Integer.t option
        [@ocaml.doc
          "The number of the remaining free trial days for the feature."]}
    let make ?name =
      fun ?freeTrialDaysRemaining ->
        fun () -> { name; freeTrialDaysRemaining }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:FreeTrialFeatureResult.to_value));
        ("freeTrialDaysRemaining",
          (Option.map x.freeTrialDaysRemaining ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let freeTrialDaysRemaining =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "freeTrialDaysRemaining") in
      let name =
        (Option.map ~f:FreeTrialFeatureResult.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?freeTrialDaysRemaining ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let freeTrialDaysRemaining =
        field_map json__ "FreeTrialDaysRemaining" Integer.of_json in
      let name = field_map json__ "Name" FreeTrialFeatureResult.of_json in
      make ?freeTrialDaysRemaining ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the free trial period for a feature."]
module OrganizationFeatureStatistics =
  struct
    type nonrec t =
      {
      name: OrgFeature.t option [@ocaml.doc "Name of the feature."];
      enabledAccountsCount: Integer.t option
        [@ocaml.doc
          "Total number of accounts that have enabled a specific feature."];
      additionalConfiguration:
        OrganizationFeatureStatisticsAdditionalConfigurations.t option
        [@ocaml.doc "Name of the additional configuration."]}
    let make ?name =
      fun ?enabledAccountsCount ->
        fun ?additionalConfiguration ->
          fun () -> { name; enabledAccountsCount; additionalConfiguration }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:OrgFeature.to_value));
        ("enabledAccountsCount",
          (Option.map x.enabledAccountsCount ~f:Integer.to_value));
        ("additionalConfiguration",
          (Option.map x.additionalConfiguration
             ~f:OrganizationFeatureStatisticsAdditionalConfigurations.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalConfiguration =
        (Option.map
           ~f:OrganizationFeatureStatisticsAdditionalConfigurations.of_xml)
          (Xml.child xml_arg0 "additionalConfiguration") in
      let enabledAccountsCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "enabledAccountsCount") in
      let name =
        (Option.map ~f:OrgFeature.of_xml) (Xml.child xml_arg0 "name") in
      make ?additionalConfiguration ?enabledAccountsCount ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalConfiguration =
        field_map json__ "AdditionalConfiguration"
          OrganizationFeatureStatisticsAdditionalConfigurations.of_json in
      let enabledAccountsCount =
        field_map json__ "EnabledAccountsCount" Integer.of_json in
      let name = field_map json__ "Name" OrgFeature.of_json in
      make ?additionalConfiguration ?enabledAccountsCount ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the number of accounts that have enabled a specific feature."]
module CloudTrailConfigurationResult =
  struct
    type nonrec t =
      {
      status: DataSourceStatus.t option
        [@ocaml.doc
          "Describes whether CloudTrail is enabled as a data source for the detector."]}
    let make ?status = fun () -> { status }
    let to_value x =
      structure_to_value
        [("status", (Option.map x.status ~f:DataSourceStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:DataSourceStatus.of_xml) (Xml.child xml_arg0 "status") in
      make ?status ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status = field_map json__ "Status" DataSourceStatus.of_json in
      make ?status ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the status of CloudTrail as a data source for the detector."]
module DNSLogsConfigurationResult =
  struct
    type nonrec t =
      {
      status: DataSourceStatus.t option
        [@ocaml.doc "Denotes whether DNS logs is enabled as a data source."]}
    let make ?status = fun () -> { status }
    let to_value x =
      structure_to_value
        [("status", (Option.map x.status ~f:DataSourceStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:DataSourceStatus.of_xml) (Xml.child xml_arg0 "status") in
      make ?status ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status = field_map json__ "Status" DataSourceStatus.of_json in
      make ?status ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the status of DNS logs as a data source."]
module FlowLogsConfigurationResult =
  struct
    type nonrec t =
      {
      status: DataSourceStatus.t option
        [@ocaml.doc
          "Denotes whether VPC flow logs is enabled as a data source."]}
    let make ?status = fun () -> { status }
    let to_value x =
      structure_to_value
        [("status", (Option.map x.status ~f:DataSourceStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:DataSourceStatus.of_xml) (Xml.child xml_arg0 "status") in
      make ?status ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status = field_map json__ "Status" DataSourceStatus.of_json in
      make ?status ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the status of VPC flow logs as a data source."]
module KubernetesConfigurationResult =
  struct
    type nonrec t =
      {
      auditLogs: KubernetesAuditLogsConfigurationResult.t option
        [@ocaml.doc
          "Describes whether Kubernetes audit logs are enabled as a data source."]}
    let make ?auditLogs = fun () -> { auditLogs }
    let to_value x =
      structure_to_value
        [("auditLogs",
           (Option.map x.auditLogs
              ~f:KubernetesAuditLogsConfigurationResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let auditLogs =
        (Option.map ~f:KubernetesAuditLogsConfigurationResult.of_xml)
          (Xml.child xml_arg0 "auditLogs") in
      make ?auditLogs ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let auditLogs =
        field_map json__ "AuditLogs"
          KubernetesAuditLogsConfigurationResult.of_json in
      make ?auditLogs ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether any Kubernetes logs will be enabled as a data source."]
module MalwareProtectionConfigurationResult =
  struct
    type nonrec t =
      {
      scanEc2InstanceWithFindings: ScanEc2InstanceWithFindingsResult.t option
        [@ocaml.doc
          "Describes the configuration of Malware Protection for EC2 instances with findings."];
      serviceRole: String_.t option
        [@ocaml.doc "The GuardDuty Malware Protection service role."]}
    let make ?scanEc2InstanceWithFindings =
      fun ?serviceRole ->
        fun () -> { scanEc2InstanceWithFindings; serviceRole }
    let to_value x =
      structure_to_value
        [("scanEc2InstanceWithFindings",
           (Option.map x.scanEc2InstanceWithFindings
              ~f:ScanEc2InstanceWithFindingsResult.to_value));
        ("serviceRole", (Option.map x.serviceRole ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let serviceRole =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "serviceRole") in
      let scanEc2InstanceWithFindings =
        (Option.map ~f:ScanEc2InstanceWithFindingsResult.of_xml)
          (Xml.child xml_arg0 "scanEc2InstanceWithFindings") in
      make ?serviceRole ?scanEc2InstanceWithFindings ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let serviceRole = field_map json__ "ServiceRole" String_.of_json in
      let scanEc2InstanceWithFindings =
        field_map json__ "ScanEc2InstanceWithFindings"
          ScanEc2InstanceWithFindingsResult.of_json in
      make ?serviceRole ?scanEc2InstanceWithFindings ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "An object that contains information on the status of all Malware Protection data sources."]
module S3LogsConfigurationResult =
  struct
    type nonrec t =
      {
      status: DataSourceStatus.t option
        [@ocaml.doc
          "A value that describes whether S3 data event logs are automatically enabled for new members of the organization."]}
    let make ?status = fun () -> { status }
    let to_value x =
      structure_to_value
        [("status", (Option.map x.status ~f:DataSourceStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:DataSourceStatus.of_xml) (Xml.child xml_arg0 "status") in
      make ?status ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status = field_map json__ "Status" DataSourceStatus.of_json in
      make ?status ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether S3 data event logs will be enabled as a data source."]
module MemberFeaturesConfigurationResult =
  struct
    type nonrec t =
      {
      name: OrgFeature.t option
        [@ocaml.doc
          "Indicates the name of the feature that is enabled for the detector."];
      status: FeatureStatus.t option
        [@ocaml.doc
          "Indicates the status of the feature that is enabled for the detector."];
      updatedAt: Timestamp.t option
        [@ocaml.doc "The timestamp at which the feature object was updated."];
      additionalConfiguration: MemberAdditionalConfigurationResults.t option
        [@ocaml.doc
          "Indicates the additional configuration of the feature that is configured for the member account."]}
    let make ?name =
      fun ?status ->
        fun ?updatedAt ->
          fun ?additionalConfiguration ->
            fun () -> { name; status; updatedAt; additionalConfiguration }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:OrgFeature.to_value));
        ("status", (Option.map x.status ~f:FeatureStatus.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value));
        ("additionalConfiguration",
          (Option.map x.additionalConfiguration
             ~f:MemberAdditionalConfigurationResults.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalConfiguration =
        (Option.map ~f:MemberAdditionalConfigurationResults.of_xml)
          (Xml.child xml_arg0 "additionalConfiguration") in
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let status =
        (Option.map ~f:FeatureStatus.of_xml) (Xml.child xml_arg0 "status") in
      let name =
        (Option.map ~f:OrgFeature.of_xml) (Xml.child xml_arg0 "name") in
      make ?additionalConfiguration ?updatedAt ?status ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalConfiguration =
        field_map json__ "AdditionalConfiguration"
          MemberAdditionalConfigurationResults.of_json in
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      let status = field_map json__ "Status" FeatureStatus.of_json in
      let name = field_map json__ "Name" OrgFeature.of_json in
      make ?additionalConfiguration ?updatedAt ?status ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the features for the member account."]
module DetectionSource =
  struct
    type nonrec t =
      | AMAZON 
      | BITDEFENDER 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | AMAZON -> "AMAZON"
      | BITDEFENDER -> "BITDEFENDER"
      | Non_static_id s -> s
    let of_string =
      function
      | "AMAZON" -> AMAZON
      | "BITDEFENDER" -> BITDEFENDER
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration DetectionSource" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"DetectionSource" j)
    let to_json = simple_to_json to_value
  end
module PositiveLong =
  struct
    type nonrec t = Int64.t
    let make i =
      let open Result in ok_or_failwith (check_int64_min i ~min:0L); i
    let of_string = Int64.of_string
    let to_value x = `Long x
    let to_query v = to_query to_value v
    let to_header x = Int64.to_string x
    let of_xml xml_arg0 =
      Int64.of_string (string_of_xml ~kind:"a long" xml_arg0)
    let of_json j = Int64.of_float (float_of_json ~kind:"a long" j)
    let to_json = simple_to_json to_value
  end
module EbsSnapshot =
  struct
    type nonrec t =
      {
      deviceName: NonEmptyString.t option
        [@ocaml.doc "The device name of the EBS snapshot that was scanned."]}
    let make ?deviceName = fun () -> { deviceName }
    let to_value x =
      structure_to_value
        [("deviceName", (Option.map x.deviceName ~f:NonEmptyString.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let deviceName =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "deviceName") in
      make ?deviceName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let deviceName = field_map json__ "DeviceName" NonEmptyString.of_json in
      make ?deviceName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about an EBS snapshot that was scanned for malware."]
module AccessKeyDetails =
  struct
    type nonrec t =
      {
      accessKeyId: String_.t option
        [@ocaml.doc "The access key ID of the user."];
      principalId: String_.t option
        [@ocaml.doc "The principal ID of the user."];
      userName: String_.t option [@ocaml.doc "The name of the user."];
      userType: String_.t option [@ocaml.doc "The type of the user."]}
    let make ?accessKeyId =
      fun ?principalId ->
        fun ?userName ->
          fun ?userType ->
            fun () -> { accessKeyId; principalId; userName; userType }
    let to_value x =
      structure_to_value
        [("accessKeyId", (Option.map x.accessKeyId ~f:String_.to_value));
        ("principalId", (Option.map x.principalId ~f:String_.to_value));
        ("userName", (Option.map x.userName ~f:String_.to_value));
        ("userType", (Option.map x.userType ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let userType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "userType") in
      let userName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "userName") in
      let principalId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "principalId") in
      let accessKeyId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "accessKeyId") in
      make ?userType ?userName ?principalId ?accessKeyId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let userType = field_map json__ "UserType" String_.of_json in
      let userName = field_map json__ "UserName" String_.of_json in
      let principalId = field_map json__ "PrincipalId" String_.of_json in
      let accessKeyId = field_map json__ "AccessKeyId" String_.of_json in
      make ?userType ?userName ?principalId ?accessKeyId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the access keys."]
module EbsSnapshotDetails =
  struct
    type nonrec t =
      {
      snapshotArn: String_.t option
        [@ocaml.doc "The Amazon Resource Name (ARN) of the EBS snapshot."]}
    let make ?snapshotArn = fun () -> { snapshotArn }
    let to_value x =
      structure_to_value
        [("snapshotArn", (Option.map x.snapshotArn ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let snapshotArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "snapshotArn") in
      make ?snapshotArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let snapshotArn = field_map json__ "SnapshotArn" String_.of_json in
      make ?snapshotArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains details about the EBS snapshot that was scanned for malware."]
module EbsVolumeDetails =
  struct
    type nonrec t =
      {
      scannedVolumeDetails: VolumeDetails.t option
        [@ocaml.doc "List of EBS volumes that were scanned."];
      skippedVolumeDetails: VolumeDetails.t option
        [@ocaml.doc
          "List of EBS volumes that were skipped from the malware scan."]}
    let make ?scannedVolumeDetails =
      fun ?skippedVolumeDetails ->
        fun () -> { scannedVolumeDetails; skippedVolumeDetails }
    let to_value x =
      structure_to_value
        [("scannedVolumeDetails",
           (Option.map x.scannedVolumeDetails ~f:VolumeDetails.to_value));
        ("skippedVolumeDetails",
          (Option.map x.skippedVolumeDetails ~f:VolumeDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let skippedVolumeDetails =
        (Option.map ~f:VolumeDetails.of_xml)
          (Xml.child xml_arg0 "skippedVolumeDetails") in
      let scannedVolumeDetails =
        (Option.map ~f:VolumeDetails.of_xml)
          (Xml.child xml_arg0 "scannedVolumeDetails") in
      make ?skippedVolumeDetails ?scannedVolumeDetails ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let skippedVolumeDetails =
        field_map json__ "SkippedVolumeDetails" VolumeDetails.of_json in
      let scannedVolumeDetails =
        field_map json__ "ScannedVolumeDetails" VolumeDetails.of_json in
      make ?skippedVolumeDetails ?scannedVolumeDetails ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains list of scanned and skipped EBS volumes with details."]
module Ec2ImageDetails =
  struct
    type nonrec t =
      {
      imageArn: String_.t option
        [@ocaml.doc "The Amazon Resource Name (ARN) of the EC2 AMI."]}
    let make ?imageArn = fun () -> { imageArn }
    let to_value x =
      structure_to_value
        [("imageArn", (Option.map x.imageArn ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let imageArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "imageArn") in
      make ?imageArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let imageArn = field_map json__ "ImageArn" String_.of_json in
      make ?imageArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains details about the EC2 AMI that was scanned."]
module EcsClusterDetails =
  struct
    type nonrec t =
      {
      name: String_.t option [@ocaml.doc "The name of the ECS Cluster."];
      arn: String_.t option
        [@ocaml.doc
          "The Amazon Resource Name (ARN) that identifies the cluster."];
      status: String_.t option [@ocaml.doc "The status of the ECS cluster."];
      activeServicesCount: Integer.t option
        [@ocaml.doc
          "The number of services that are running on the cluster in an ACTIVE state."];
      registeredContainerInstancesCount: Integer.t option
        [@ocaml.doc
          "The number of container instances registered into the cluster."];
      runningTasksCount: Integer.t option
        [@ocaml.doc
          "The number of tasks in the cluster that are in the RUNNING state."];
      tags: Tags.t option [@ocaml.doc "The tags of the ECS Cluster."];
      taskDetails: EcsTaskDetails.t option
        [@ocaml.doc
          "Contains information about the details of the ECS Task."]}
    let make ?name =
      fun ?arn ->
        fun ?status ->
          fun ?activeServicesCount ->
            fun ?registeredContainerInstancesCount ->
              fun ?runningTasksCount ->
                fun ?tags ->
                  fun ?taskDetails ->
                    fun () ->
                      {
                        name;
                        arn;
                        status;
                        activeServicesCount;
                        registeredContainerInstancesCount;
                        runningTasksCount;
                        tags;
                        taskDetails
                      }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("arn", (Option.map x.arn ~f:String_.to_value));
        ("status", (Option.map x.status ~f:String_.to_value));
        ("activeServicesCount",
          (Option.map x.activeServicesCount ~f:Integer.to_value));
        ("registeredContainerInstancesCount",
          (Option.map x.registeredContainerInstancesCount ~f:Integer.to_value));
        ("runningTasksCount",
          (Option.map x.runningTasksCount ~f:Integer.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value));
        ("taskDetails",
          (Option.map x.taskDetails ~f:EcsTaskDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let taskDetails =
        (Option.map ~f:EcsTaskDetails.of_xml)
          (Xml.child xml_arg0 "taskDetails") in
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let runningTasksCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "runningTasksCount") in
      let registeredContainerInstancesCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "registeredContainerInstancesCount") in
      let activeServicesCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "activeServicesCount") in
      let status =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "status") in
      let arn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "arn") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?taskDetails ?tags ?runningTasksCount
        ?registeredContainerInstancesCount ?activeServicesCount ?status ?arn
        ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let taskDetails = field_map json__ "TaskDetails" EcsTaskDetails.of_json in
      let tags = field_map json__ "Tags" Tags.of_json in
      let runningTasksCount =
        field_map json__ "RunningTasksCount" Integer.of_json in
      let registeredContainerInstancesCount =
        field_map json__ "RegisteredContainerInstancesCount" Integer.of_json in
      let activeServicesCount =
        field_map json__ "ActiveServicesCount" Integer.of_json in
      let status = field_map json__ "Status" String_.of_json in
      let arn = field_map json__ "Arn" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?taskDetails ?tags ?runningTasksCount
        ?registeredContainerInstancesCount ?activeServicesCount ?status ?arn
        ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the details of the ECS Cluster."]
module EksClusterDetails =
  struct
    type nonrec t =
      {
      name: String_.t option [@ocaml.doc "EKS cluster name."];
      arn: String_.t option [@ocaml.doc "EKS cluster ARN."];
      vpcId: String_.t option
        [@ocaml.doc "The VPC ID to which the EKS cluster is attached."];
      status: String_.t option [@ocaml.doc "The EKS cluster status."];
      tags: Tags.t option [@ocaml.doc "The EKS cluster tags."];
      createdAt: Timestamp.t option
        [@ocaml.doc "The timestamp when the EKS cluster was created."]}
    let make ?name =
      fun ?arn ->
        fun ?vpcId ->
          fun ?status ->
            fun ?tags ->
              fun ?createdAt ->
                fun () -> { name; arn; vpcId; status; tags; createdAt }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:String_.to_value));
        ("arn", (Option.map x.arn ~f:String_.to_value));
        ("vpcId", (Option.map x.vpcId ~f:String_.to_value));
        ("status", (Option.map x.status ~f:String_.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value));
        ("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let status =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "status") in
      let vpcId = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "vpcId") in
      let arn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "arn") in
      let name = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "name") in
      make ?createdAt ?tags ?status ?vpcId ?arn ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      let tags = field_map json__ "Tags" Tags.of_json in
      let status = field_map json__ "Status" String_.of_json in
      let vpcId = field_map json__ "VpcId" String_.of_json in
      let arn = field_map json__ "Arn" String_.of_json in
      let name = field_map json__ "Name" String_.of_json in
      make ?createdAt ?tags ?status ?vpcId ?arn ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Details about the EKS cluster involved in a Kubernetes finding."]
module InstanceDetails =
  struct
    type nonrec t =
      {
      availabilityZone: String_.t option
        [@ocaml.doc "The Availability Zone of the EC2 instance."];
      iamInstanceProfile: IamInstanceProfile.t option
        [@ocaml.doc "The profile information of the EC2 instance."];
      imageDescription: String_.t option
        [@ocaml.doc "The image description of the EC2 instance."];
      imageId: String_.t option
        [@ocaml.doc "The image ID of the EC2 instance."];
      instanceId: String_.t option [@ocaml.doc "The ID of the EC2 instance."];
      instanceState: String_.t option
        [@ocaml.doc "The state of the EC2 instance."];
      instanceType: String_.t option
        [@ocaml.doc "The type of the EC2 instance."];
      outpostArn: String_.t option
        [@ocaml.doc
          "The Amazon Resource Name (ARN) of the Amazon Web Services Outpost. Only applicable to Amazon Web Services Outposts instances."];
      launchTime: String_.t option
        [@ocaml.doc "The launch time of the EC2 instance."];
      networkInterfaces: NetworkInterfaces.t option
        [@ocaml.doc
          "The elastic network interface information of the EC2 instance."];
      platform: String_.t option
        [@ocaml.doc "The platform of the EC2 instance."];
      productCodes: ProductCodes.t option
        [@ocaml.doc "The product code of the EC2 instance."];
      tags: Tags.t option [@ocaml.doc "The tags of the EC2 instance."]}
    let make ?availabilityZone =
      fun ?iamInstanceProfile ->
        fun ?imageDescription ->
          fun ?imageId ->
            fun ?instanceId ->
              fun ?instanceState ->
                fun ?instanceType ->
                  fun ?outpostArn ->
                    fun ?launchTime ->
                      fun ?networkInterfaces ->
                        fun ?platform ->
                          fun ?productCodes ->
                            fun ?tags ->
                              fun () ->
                                {
                                  availabilityZone;
                                  iamInstanceProfile;
                                  imageDescription;
                                  imageId;
                                  instanceId;
                                  instanceState;
                                  instanceType;
                                  outpostArn;
                                  launchTime;
                                  networkInterfaces;
                                  platform;
                                  productCodes;
                                  tags
                                }
    let to_value x =
      structure_to_value
        [("availabilityZone",
           (Option.map x.availabilityZone ~f:String_.to_value));
        ("iamInstanceProfile",
          (Option.map x.iamInstanceProfile ~f:IamInstanceProfile.to_value));
        ("imageDescription",
          (Option.map x.imageDescription ~f:String_.to_value));
        ("imageId", (Option.map x.imageId ~f:String_.to_value));
        ("instanceId", (Option.map x.instanceId ~f:String_.to_value));
        ("instanceState", (Option.map x.instanceState ~f:String_.to_value));
        ("instanceType", (Option.map x.instanceType ~f:String_.to_value));
        ("outpostArn", (Option.map x.outpostArn ~f:String_.to_value));
        ("launchTime", (Option.map x.launchTime ~f:String_.to_value));
        ("networkInterfaces",
          (Option.map x.networkInterfaces ~f:NetworkInterfaces.to_value));
        ("platform", (Option.map x.platform ~f:String_.to_value));
        ("productCodes",
          (Option.map x.productCodes ~f:ProductCodes.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let productCodes =
        (Option.map ~f:ProductCodes.of_xml)
          (Xml.child xml_arg0 "productCodes") in
      let platform =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "platform") in
      let networkInterfaces =
        (Option.map ~f:NetworkInterfaces.of_xml)
          (Xml.child xml_arg0 "networkInterfaces") in
      let launchTime =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "launchTime") in
      let outpostArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "outpostArn") in
      let instanceType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "instanceType") in
      let instanceState =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "instanceState") in
      let instanceId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "instanceId") in
      let imageId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "imageId") in
      let imageDescription =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "imageDescription") in
      let iamInstanceProfile =
        (Option.map ~f:IamInstanceProfile.of_xml)
          (Xml.child xml_arg0 "iamInstanceProfile") in
      let availabilityZone =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "availabilityZone") in
      make ?tags ?productCodes ?platform ?networkInterfaces ?launchTime
        ?outpostArn ?instanceType ?instanceState ?instanceId ?imageId
        ?imageDescription ?iamInstanceProfile ?availabilityZone ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" Tags.of_json in
      let productCodes = field_map json__ "ProductCodes" ProductCodes.of_json in
      let platform = field_map json__ "Platform" String_.of_json in
      let networkInterfaces =
        field_map json__ "NetworkInterfaces" NetworkInterfaces.of_json in
      let launchTime = field_map json__ "LaunchTime" String_.of_json in
      let outpostArn = field_map json__ "OutpostArn" String_.of_json in
      let instanceType = field_map json__ "InstanceType" String_.of_json in
      let instanceState = field_map json__ "InstanceState" String_.of_json in
      let instanceId = field_map json__ "InstanceId" String_.of_json in
      let imageId = field_map json__ "ImageId" String_.of_json in
      let imageDescription =
        field_map json__ "ImageDescription" String_.of_json in
      let iamInstanceProfile =
        field_map json__ "IamInstanceProfile" IamInstanceProfile.of_json in
      let availabilityZone =
        field_map json__ "AvailabilityZone" String_.of_json in
      make ?tags ?productCodes ?platform ?networkInterfaces ?launchTime
        ?outpostArn ?instanceType ?instanceState ?instanceId ?imageId
        ?imageDescription ?iamInstanceProfile ?availabilityZone ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the details of an instance."]
module KubernetesDetails =
  struct
    type nonrec t =
      {
      kubernetesUserDetails: KubernetesUserDetails.t option
        [@ocaml.doc
          "Details about the Kubernetes user involved in a Kubernetes finding."];
      kubernetesWorkloadDetails: KubernetesWorkloadDetails.t option
        [@ocaml.doc
          "Details about the Kubernetes workload involved in a Kubernetes finding."]}
    let make ?kubernetesUserDetails =
      fun ?kubernetesWorkloadDetails ->
        fun () -> { kubernetesUserDetails; kubernetesWorkloadDetails }
    let to_value x =
      structure_to_value
        [("kubernetesUserDetails",
           (Option.map x.kubernetesUserDetails
              ~f:KubernetesUserDetails.to_value));
        ("kubernetesWorkloadDetails",
          (Option.map x.kubernetesWorkloadDetails
             ~f:KubernetesWorkloadDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let kubernetesWorkloadDetails =
        (Option.map ~f:KubernetesWorkloadDetails.of_xml)
          (Xml.child xml_arg0 "kubernetesWorkloadDetails") in
      let kubernetesUserDetails =
        (Option.map ~f:KubernetesUserDetails.of_xml)
          (Xml.child xml_arg0 "kubernetesUserDetails") in
      make ?kubernetesWorkloadDetails ?kubernetesUserDetails ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let kubernetesWorkloadDetails =
        field_map json__ "KubernetesWorkloadDetails"
          KubernetesWorkloadDetails.of_json in
      let kubernetesUserDetails =
        field_map json__ "KubernetesUserDetails"
          KubernetesUserDetails.of_json in
      make ?kubernetesWorkloadDetails ?kubernetesUserDetails ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Details about Kubernetes resources such as a Kubernetes user or workload resource involved in a Kubernetes finding."]
module LambdaDetails =
  struct
    type nonrec t =
      {
      functionArn: String_.t option
        [@ocaml.doc "Amazon Resource Name (ARN) of the Lambda function."];
      functionName: String_.t option
        [@ocaml.doc "Name of the Lambda function."];
      description: String_.t option
        [@ocaml.doc "Description of the Lambda function."];
      lastModifiedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the Lambda function was last modified. This field is in the UTC date string format (2023-03-22T19:37:20.168Z)."];
      revisionId: String_.t option
        [@ocaml.doc "The revision ID of the Lambda function version."];
      functionVersion: String_.t option
        [@ocaml.doc "The version of the Lambda function."];
      role: String_.t option
        [@ocaml.doc "The execution role of the Lambda function."];
      vpcConfig: VpcConfig.t option
        [@ocaml.doc
          "Amazon Virtual Private Cloud configuration details associated with your Lambda function."];
      tags: Tags.t option
        [@ocaml.doc
          "A list of tags attached to this resource, listed in the format of key:value pair."]}
    let make ?functionArn =
      fun ?functionName ->
        fun ?description ->
          fun ?lastModifiedAt ->
            fun ?revisionId ->
              fun ?functionVersion ->
                fun ?role ->
                  fun ?vpcConfig ->
                    fun ?tags ->
                      fun () ->
                        {
                          functionArn;
                          functionName;
                          description;
                          lastModifiedAt;
                          revisionId;
                          functionVersion;
                          role;
                          vpcConfig;
                          tags
                        }
    let to_value x =
      structure_to_value
        [("functionArn", (Option.map x.functionArn ~f:String_.to_value));
        ("functionName", (Option.map x.functionName ~f:String_.to_value));
        ("description", (Option.map x.description ~f:String_.to_value));
        ("lastModifiedAt",
          (Option.map x.lastModifiedAt ~f:Timestamp.to_value));
        ("revisionId", (Option.map x.revisionId ~f:String_.to_value));
        ("functionVersion",
          (Option.map x.functionVersion ~f:String_.to_value));
        ("role", (Option.map x.role ~f:String_.to_value));
        ("vpcConfig", (Option.map x.vpcConfig ~f:VpcConfig.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let vpcConfig =
        (Option.map ~f:VpcConfig.of_xml) (Xml.child xml_arg0 "vpcConfig") in
      let role = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "role") in
      let functionVersion =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "functionVersion") in
      let revisionId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "revisionId") in
      let lastModifiedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "lastModifiedAt") in
      let description =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "description") in
      let functionName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "functionName") in
      let functionArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "functionArn") in
      make ?tags ?vpcConfig ?role ?functionVersion ?revisionId
        ?lastModifiedAt ?description ?functionName ?functionArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" Tags.of_json in
      let vpcConfig = field_map json__ "VpcConfig" VpcConfig.of_json in
      let role = field_map json__ "Role" String_.of_json in
      let functionVersion =
        field_map json__ "FunctionVersion" String_.of_json in
      let revisionId = field_map json__ "RevisionId" String_.of_json in
      let lastModifiedAt =
        field_map json__ "LastModifiedAt" Timestamp.of_json in
      let description = field_map json__ "Description" String_.of_json in
      let functionName = field_map json__ "FunctionName" String_.of_json in
      let functionArn = field_map json__ "FunctionArn" String_.of_json in
      make ?tags ?vpcConfig ?role ?functionVersion ?revisionId
        ?lastModifiedAt ?description ?functionName ?functionArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the Lambda function involved in the finding."]
module RdsDbInstanceDetails =
  struct
    type nonrec t =
      {
      dbInstanceIdentifier: String_.t option
        [@ocaml.doc
          "The identifier associated to the database instance that was involved in the finding."];
      engine: String_.t option
        [@ocaml.doc
          "The database engine of the database instance involved in the finding."];
      engineVersion: String_.t option
        [@ocaml.doc
          "The version of the database engine that was involved in the finding."];
      dbClusterIdentifier: String_.t option
        [@ocaml.doc
          "The identifier of the database cluster that contains the database instance ID involved in the finding."];
      dbInstanceArn: String_.t option
        [@ocaml.doc
          "The Amazon Resource Name (ARN) that identifies the database instance involved in the finding."];
      dbiResourceId: String_.t option
        [@ocaml.doc
          "The unique ID of the database resource involved in the activity that prompted GuardDuty to generate the finding."];
      tags: Tags.t option
        [@ocaml.doc "Information about the tag key-value pairs."]}
    let make ?dbInstanceIdentifier =
      fun ?engine ->
        fun ?engineVersion ->
          fun ?dbClusterIdentifier ->
            fun ?dbInstanceArn ->
              fun ?dbiResourceId ->
                fun ?tags ->
                  fun () ->
                    {
                      dbInstanceIdentifier;
                      engine;
                      engineVersion;
                      dbClusterIdentifier;
                      dbInstanceArn;
                      dbiResourceId;
                      tags
                    }
    let to_value x =
      structure_to_value
        [("dbInstanceIdentifier",
           (Option.map x.dbInstanceIdentifier ~f:String_.to_value));
        ("engine", (Option.map x.engine ~f:String_.to_value));
        ("engineVersion", (Option.map x.engineVersion ~f:String_.to_value));
        ("dbClusterIdentifier",
          (Option.map x.dbClusterIdentifier ~f:String_.to_value));
        ("dbInstanceArn", (Option.map x.dbInstanceArn ~f:String_.to_value));
        ("dbiResourceId", (Option.map x.dbiResourceId ~f:String_.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let dbiResourceId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "dbiResourceId") in
      let dbInstanceArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "dbInstanceArn") in
      let dbClusterIdentifier =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "dbClusterIdentifier") in
      let engineVersion =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "engineVersion") in
      let engine =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "engine") in
      let dbInstanceIdentifier =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "dbInstanceIdentifier") in
      make ?tags ?dbiResourceId ?dbInstanceArn ?dbClusterIdentifier
        ?engineVersion ?engine ?dbInstanceIdentifier ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" Tags.of_json in
      let dbiResourceId = field_map json__ "DbiResourceId" String_.of_json in
      let dbInstanceArn = field_map json__ "DbInstanceArn" String_.of_json in
      let dbClusterIdentifier =
        field_map json__ "DbClusterIdentifier" String_.of_json in
      let engineVersion = field_map json__ "EngineVersion" String_.of_json in
      let engine = field_map json__ "Engine" String_.of_json in
      let dbInstanceIdentifier =
        field_map json__ "DbInstanceIdentifier" String_.of_json in
      make ?tags ?dbiResourceId ?dbInstanceArn ?dbClusterIdentifier
        ?engineVersion ?engine ?dbInstanceIdentifier ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the resource type RDSDBInstance involved in a GuardDuty finding."]
module RdsDbUserDetails =
  struct
    type nonrec t =
      {
      user: String_.t option
        [@ocaml.doc "The user name used in the anomalous login attempt."];
      application: String_.t option
        [@ocaml.doc
          "The application name used in the anomalous login attempt."];
      database: String_.t option
        [@ocaml.doc
          "The name of the database instance involved in the anomalous login attempt."];
      ssl: String_.t option
        [@ocaml.doc
          "The version of the Secure Socket Layer (SSL) used for the network."];
      authMethod: String_.t option
        [@ocaml.doc
          "The authentication method used by the user involved in the finding."]}
    let make ?user =
      fun ?application ->
        fun ?database ->
          fun ?ssl ->
            fun ?authMethod ->
              fun () -> { user; application; database; ssl; authMethod }
    let to_value x =
      structure_to_value
        [("user", (Option.map x.user ~f:String_.to_value));
        ("application", (Option.map x.application ~f:String_.to_value));
        ("database", (Option.map x.database ~f:String_.to_value));
        ("ssl", (Option.map x.ssl ~f:String_.to_value));
        ("authMethod", (Option.map x.authMethod ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let authMethod =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "authMethod") in
      let ssl = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "ssl") in
      let database =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "database") in
      let application =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "application") in
      let user = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "user") in
      make ?authMethod ?ssl ?database ?application ?user ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let authMethod = field_map json__ "AuthMethod" String_.of_json in
      let ssl = field_map json__ "Ssl" String_.of_json in
      let database = field_map json__ "Database" String_.of_json in
      let application = field_map json__ "Application" String_.of_json in
      let user = field_map json__ "User" String_.of_json in
      make ?authMethod ?ssl ?database ?application ?user ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the user and authentication details for a database instance involved in the finding."]
module RdsLimitlessDbDetails =
  struct
    type nonrec t =
      {
      dbShardGroupIdentifier: String_.t option
        [@ocaml.doc "The name associated with the Limitless DB shard group."];
      dbShardGroupResourceId: String_.t option
        [@ocaml.doc
          "The resource identifier of the DB shard group within the Limitless Database."];
      dbShardGroupArn: String_.t option
        [@ocaml.doc
          "The Amazon Resource Name (ARN) that identifies the DB shard group."];
      engine: String_.t option
        [@ocaml.doc
          "The database engine of the database instance involved in the finding."];
      engineVersion: String_.t option
        [@ocaml.doc "The version of the database engine."];
      dbClusterIdentifier: String_.t option
        [@ocaml.doc
          "The name of the database cluster that is a part of the Limitless Database."];
      tags: Tags.t option
        [@ocaml.doc "Information about the tag key-value pair."]}
    let make ?dbShardGroupIdentifier =
      fun ?dbShardGroupResourceId ->
        fun ?dbShardGroupArn ->
          fun ?engine ->
            fun ?engineVersion ->
              fun ?dbClusterIdentifier ->
                fun ?tags ->
                  fun () ->
                    {
                      dbShardGroupIdentifier;
                      dbShardGroupResourceId;
                      dbShardGroupArn;
                      engine;
                      engineVersion;
                      dbClusterIdentifier;
                      tags
                    }
    let to_value x =
      structure_to_value
        [("dbShardGroupIdentifier",
           (Option.map x.dbShardGroupIdentifier ~f:String_.to_value));
        ("dbShardGroupResourceId",
          (Option.map x.dbShardGroupResourceId ~f:String_.to_value));
        ("dbShardGroupArn",
          (Option.map x.dbShardGroupArn ~f:String_.to_value));
        ("engine", (Option.map x.engine ~f:String_.to_value));
        ("engineVersion", (Option.map x.engineVersion ~f:String_.to_value));
        ("dbClusterIdentifier",
          (Option.map x.dbClusterIdentifier ~f:String_.to_value));
        ("tags", (Option.map x.tags ~f:Tags.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:Tags.of_xml) (Xml.child xml_arg0 "tags") in
      let dbClusterIdentifier =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "dbClusterIdentifier") in
      let engineVersion =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "engineVersion") in
      let engine =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "engine") in
      let dbShardGroupArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "dbShardGroupArn") in
      let dbShardGroupResourceId =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "dbShardGroupResourceId") in
      let dbShardGroupIdentifier =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "dbShardGroupIdentifier") in
      make ?tags ?dbClusterIdentifier ?engineVersion ?engine ?dbShardGroupArn
        ?dbShardGroupResourceId ?dbShardGroupIdentifier ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" Tags.of_json in
      let dbClusterIdentifier =
        field_map json__ "DbClusterIdentifier" String_.of_json in
      let engineVersion = field_map json__ "EngineVersion" String_.of_json in
      let engine = field_map json__ "Engine" String_.of_json in
      let dbShardGroupArn =
        field_map json__ "DbShardGroupArn" String_.of_json in
      let dbShardGroupResourceId =
        field_map json__ "DbShardGroupResourceId" String_.of_json in
      let dbShardGroupIdentifier =
        field_map json__ "DbShardGroupIdentifier" String_.of_json in
      make ?tags ?dbClusterIdentifier ?engineVersion ?engine ?dbShardGroupArn
        ?dbShardGroupResourceId ?dbShardGroupIdentifier ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the resource type RDSLimitlessDB that is involved in a GuardDuty finding."]
module RecoveryPointDetails =
  struct
    type nonrec t =
      {
      recoveryPointArn: String_.t option
        [@ocaml.doc "The Amazon Resource Name (ARN) of the recovery point."];
      backupVaultName: String_.t option
        [@ocaml.doc
          "The name of the backup vault containing the recovery point."]}
    let make ?recoveryPointArn =
      fun ?backupVaultName -> fun () -> { recoveryPointArn; backupVaultName }
    let to_value x =
      structure_to_value
        [("recoveryPointArn",
           (Option.map x.recoveryPointArn ~f:String_.to_value));
        ("backupVaultName",
          (Option.map x.backupVaultName ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let backupVaultName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "backupVaultName") in
      let recoveryPointArn =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "recoveryPointArn") in
      make ?backupVaultName ?recoveryPointArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let backupVaultName =
        field_map json__ "BackupVaultName" String_.of_json in
      let recoveryPointArn =
        field_map json__ "RecoveryPointArn" String_.of_json in
      make ?backupVaultName ?recoveryPointArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains details about the backup recovery point."]
module S3BucketDetails =
  struct
    type nonrec t = S3BucketDetail.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:S3BucketDetail.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:S3BucketDetail.of_xml)
    let of_json j =
      list_of_json ~kind:"S3BucketDetails" ~of_json:S3BucketDetail.of_json j
    let to_json v = composed_to_json to_value v
  end
module Action =
  struct
    type nonrec t =
      {
      actionType: String_.t option
        [@ocaml.doc "The GuardDuty finding activity type."];
      awsApiCallAction: AwsApiCallAction.t option
        [@ocaml.doc
          "Information about the AWS_API_CALL action described in this finding."];
      dnsRequestAction: DnsRequestAction.t option
        [@ocaml.doc
          "Information about the DNS_REQUEST action described in this finding."];
      networkConnectionAction: NetworkConnectionAction.t option
        [@ocaml.doc
          "Information about the NETWORK_CONNECTION action described in this finding."];
      portProbeAction: PortProbeAction.t option
        [@ocaml.doc
          "Information about the PORT_PROBE action described in this finding."];
      kubernetesApiCallAction: KubernetesApiCallAction.t option
        [@ocaml.doc
          "Information about the Kubernetes API call action described in this finding."];
      kubernetesPermissionCheckedDetails:
        KubernetesPermissionCheckedDetails.t option
        [@ocaml.doc
          "Information whether the user has the permission to use a specific Kubernetes API."];
      kubernetesRoleBindingDetails: KubernetesRoleBindingDetails.t option
        [@ocaml.doc
          "Information about the role binding that grants the permission defined in a Kubernetes role."];
      kubernetesRoleDetails: KubernetesRoleDetails.t option
        [@ocaml.doc
          "Information about the Kubernetes role name and role type."];
      rdsLoginAttemptAction: RdsLoginAttemptAction.t option
        [@ocaml.doc
          "Information about RDS_LOGIN_ATTEMPT action described in this finding."]}
    let make ?actionType =
      fun ?awsApiCallAction ->
        fun ?dnsRequestAction ->
          fun ?networkConnectionAction ->
            fun ?portProbeAction ->
              fun ?kubernetesApiCallAction ->
                fun ?kubernetesPermissionCheckedDetails ->
                  fun ?kubernetesRoleBindingDetails ->
                    fun ?kubernetesRoleDetails ->
                      fun ?rdsLoginAttemptAction ->
                        fun () ->
                          {
                            actionType;
                            awsApiCallAction;
                            dnsRequestAction;
                            networkConnectionAction;
                            portProbeAction;
                            kubernetesApiCallAction;
                            kubernetesPermissionCheckedDetails;
                            kubernetesRoleBindingDetails;
                            kubernetesRoleDetails;
                            rdsLoginAttemptAction
                          }
    let to_value x =
      structure_to_value
        [("actionType", (Option.map x.actionType ~f:String_.to_value));
        ("awsApiCallAction",
          (Option.map x.awsApiCallAction ~f:AwsApiCallAction.to_value));
        ("dnsRequestAction",
          (Option.map x.dnsRequestAction ~f:DnsRequestAction.to_value));
        ("networkConnectionAction",
          (Option.map x.networkConnectionAction
             ~f:NetworkConnectionAction.to_value));
        ("portProbeAction",
          (Option.map x.portProbeAction ~f:PortProbeAction.to_value));
        ("kubernetesApiCallAction",
          (Option.map x.kubernetesApiCallAction
             ~f:KubernetesApiCallAction.to_value));
        ("kubernetesPermissionCheckedDetails",
          (Option.map x.kubernetesPermissionCheckedDetails
             ~f:KubernetesPermissionCheckedDetails.to_value));
        ("kubernetesRoleBindingDetails",
          (Option.map x.kubernetesRoleBindingDetails
             ~f:KubernetesRoleBindingDetails.to_value));
        ("kubernetesRoleDetails",
          (Option.map x.kubernetesRoleDetails
             ~f:KubernetesRoleDetails.to_value));
        ("rdsLoginAttemptAction",
          (Option.map x.rdsLoginAttemptAction
             ~f:RdsLoginAttemptAction.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let rdsLoginAttemptAction =
        (Option.map ~f:RdsLoginAttemptAction.of_xml)
          (Xml.child xml_arg0 "rdsLoginAttemptAction") in
      let kubernetesRoleDetails =
        (Option.map ~f:KubernetesRoleDetails.of_xml)
          (Xml.child xml_arg0 "kubernetesRoleDetails") in
      let kubernetesRoleBindingDetails =
        (Option.map ~f:KubernetesRoleBindingDetails.of_xml)
          (Xml.child xml_arg0 "kubernetesRoleBindingDetails") in
      let kubernetesPermissionCheckedDetails =
        (Option.map ~f:KubernetesPermissionCheckedDetails.of_xml)
          (Xml.child xml_arg0 "kubernetesPermissionCheckedDetails") in
      let kubernetesApiCallAction =
        (Option.map ~f:KubernetesApiCallAction.of_xml)
          (Xml.child xml_arg0 "kubernetesApiCallAction") in
      let portProbeAction =
        (Option.map ~f:PortProbeAction.of_xml)
          (Xml.child xml_arg0 "portProbeAction") in
      let networkConnectionAction =
        (Option.map ~f:NetworkConnectionAction.of_xml)
          (Xml.child xml_arg0 "networkConnectionAction") in
      let dnsRequestAction =
        (Option.map ~f:DnsRequestAction.of_xml)
          (Xml.child xml_arg0 "dnsRequestAction") in
      let awsApiCallAction =
        (Option.map ~f:AwsApiCallAction.of_xml)
          (Xml.child xml_arg0 "awsApiCallAction") in
      let actionType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "actionType") in
      make ?rdsLoginAttemptAction ?kubernetesRoleDetails
        ?kubernetesRoleBindingDetails ?kubernetesPermissionCheckedDetails
        ?kubernetesApiCallAction ?portProbeAction ?networkConnectionAction
        ?dnsRequestAction ?awsApiCallAction ?actionType ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let rdsLoginAttemptAction =
        field_map json__ "RdsLoginAttemptAction"
          RdsLoginAttemptAction.of_json in
      let kubernetesRoleDetails =
        field_map json__ "KubernetesRoleDetails"
          KubernetesRoleDetails.of_json in
      let kubernetesRoleBindingDetails =
        field_map json__ "KubernetesRoleBindingDetails"
          KubernetesRoleBindingDetails.of_json in
      let kubernetesPermissionCheckedDetails =
        field_map json__ "KubernetesPermissionCheckedDetails"
          KubernetesPermissionCheckedDetails.of_json in
      let kubernetesApiCallAction =
        field_map json__ "KubernetesApiCallAction"
          KubernetesApiCallAction.of_json in
      let portProbeAction =
        field_map json__ "PortProbeAction" PortProbeAction.of_json in
      let networkConnectionAction =
        field_map json__ "NetworkConnectionAction"
          NetworkConnectionAction.of_json in
      let dnsRequestAction =
        field_map json__ "DnsRequestAction" DnsRequestAction.of_json in
      let awsApiCallAction =
        field_map json__ "AwsApiCallAction" AwsApiCallAction.of_json in
      let actionType = field_map json__ "ActionType" String_.of_json in
      make ?rdsLoginAttemptAction ?kubernetesRoleDetails
        ?kubernetesRoleBindingDetails ?kubernetesPermissionCheckedDetails
        ?kubernetesApiCallAction ?portProbeAction ?networkConnectionAction
        ?dnsRequestAction ?awsApiCallAction ?actionType ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about actions."]
module Detection =
  struct
    type nonrec t =
      {
      anomaly: Anomaly.t option
        [@ocaml.doc
          "The details about the anomalous activity that caused GuardDuty to generate the finding."];
      sequence: Sequence.t option
        [@ocaml.doc "The details about the attack sequence."]}
    let make ?anomaly = fun ?sequence -> fun () -> { anomaly; sequence }
    let to_value x =
      structure_to_value
        [("anomaly", (Option.map x.anomaly ~f:Anomaly.to_value));
        ("sequence", (Option.map x.sequence ~f:Sequence.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let sequence =
        (Option.map ~f:Sequence.of_xml) (Xml.child xml_arg0 "sequence") in
      let anomaly =
        (Option.map ~f:Anomaly.of_xml) (Xml.child xml_arg0 "anomaly") in
      make ?sequence ?anomaly ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let sequence = field_map json__ "Sequence" Sequence.of_json in
      let anomaly = field_map json__ "Anomaly" Anomaly.of_json in
      make ?sequence ?anomaly ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the detected behavior."]
module DetectorId =
  struct
    type nonrec t = string
    let context_ = "DetectorId"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:300) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"DetectorId" j
    let to_json = simple_to_json to_value
  end
module EbsVolumeScanDetails =
  struct
    type nonrec t =
      {
      scanId: String_.t option
        [@ocaml.doc
          "Unique Id of the malware scan that generated the finding."];
      scanStartedAt: Timestamp.t option
        [@ocaml.doc "Returns the start date and time of the malware scan."];
      scanCompletedAt: Timestamp.t option
        [@ocaml.doc
          "Returns the completion date and time of the malware scan."];
      triggerFindingId: String_.t option
        [@ocaml.doc "GuardDuty finding ID that triggered a malware scan."];
      sources: Sources.t option
        [@ocaml.doc
          "Contains list of threat intelligence sources used to detect threats."];
      scanDetections: ScanDetections.t option
        [@ocaml.doc
          "Contains a complete view providing malware scan result details."];
      scanType: ScanType.t option
        [@ocaml.doc "Specifies the scan type that invoked the malware scan."]}
    let make ?scanId =
      fun ?scanStartedAt ->
        fun ?scanCompletedAt ->
          fun ?triggerFindingId ->
            fun ?sources ->
              fun ?scanDetections ->
                fun ?scanType ->
                  fun () ->
                    {
                      scanId;
                      scanStartedAt;
                      scanCompletedAt;
                      triggerFindingId;
                      sources;
                      scanDetections;
                      scanType
                    }
    let to_value x =
      structure_to_value
        [("scanId", (Option.map x.scanId ~f:String_.to_value));
        ("scanStartedAt", (Option.map x.scanStartedAt ~f:Timestamp.to_value));
        ("scanCompletedAt",
          (Option.map x.scanCompletedAt ~f:Timestamp.to_value));
        ("triggerFindingId",
          (Option.map x.triggerFindingId ~f:String_.to_value));
        ("sources", (Option.map x.sources ~f:Sources.to_value));
        ("scanDetections",
          (Option.map x.scanDetections ~f:ScanDetections.to_value));
        ("scanType", (Option.map x.scanType ~f:ScanType.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanType =
        (Option.map ~f:ScanType.of_xml) (Xml.child xml_arg0 "scanType") in
      let scanDetections =
        (Option.map ~f:ScanDetections.of_xml)
          (Xml.child xml_arg0 "scanDetections") in
      let sources =
        (Option.map ~f:Sources.of_xml) (Xml.child xml_arg0 "sources") in
      let triggerFindingId =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "triggerFindingId") in
      let scanCompletedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "scanCompletedAt") in
      let scanStartedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "scanStartedAt") in
      let scanId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "scanId") in
      make ?scanType ?scanDetections ?sources ?triggerFindingId
        ?scanCompletedAt ?scanStartedAt ?scanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanType = field_map json__ "ScanType" ScanType.of_json in
      let scanDetections =
        field_map json__ "ScanDetections" ScanDetections.of_json in
      let sources = field_map json__ "Sources" Sources.of_json in
      let triggerFindingId =
        field_map json__ "TriggerFindingId" String_.of_json in
      let scanCompletedAt =
        field_map json__ "ScanCompletedAt" Timestamp.of_json in
      let scanStartedAt = field_map json__ "ScanStartedAt" Timestamp.of_json in
      let scanId = field_map json__ "ScanId" String_.of_json in
      make ?scanType ?scanDetections ?sources ?triggerFindingId
        ?scanCompletedAt ?scanStartedAt ?scanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains details from the malware scan that created a finding."]
module Evidence =
  struct
    type nonrec t =
      {
      threatIntelligenceDetails: ThreatIntelligenceDetails.t option
        [@ocaml.doc
          "A list of threat intelligence details related to the evidence."]}
    let make ?threatIntelligenceDetails =
      fun () -> { threatIntelligenceDetails }
    let to_value x =
      structure_to_value
        [("threatIntelligenceDetails",
           (Option.map x.threatIntelligenceDetails
              ~f:ThreatIntelligenceDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatIntelligenceDetails =
        (Option.map ~f:ThreatIntelligenceDetails.of_xml)
          (Xml.child xml_arg0 "threatIntelligenceDetails") in
      make ?threatIntelligenceDetails ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatIntelligenceDetails =
        field_map json__ "ThreatIntelligenceDetails"
          ThreatIntelligenceDetails.of_json in
      make ?threatIntelligenceDetails ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the reason that the finding was generated."]
module MalwareScanDetails =
  struct
    type nonrec t =
      {
      threats: Threats.t option
        [@ocaml.doc
          "Information about the detected threats associated with the generated GuardDuty finding."];
      scanId: String_.t option
        [@ocaml.doc "The unique identifier for the malware scan."];
      scanType: MalwareProtectionScanType.t option
        [@ocaml.doc "The type of malware scan performed."];
      scanCategory: ScanCategory.t option
        [@ocaml.doc "The category of the malware scan."];
      scanConfiguration: MalwareProtectionFindingsScanConfiguration.t option
        [@ocaml.doc "The configuration settings used for the malware scan."];
      uniqueThreatCount: Integer.t option
        [@ocaml.doc
          "The number of unique malware threats detected during the scan."]}
    let make ?threats =
      fun ?scanId ->
        fun ?scanType ->
          fun ?scanCategory ->
            fun ?scanConfiguration ->
              fun ?uniqueThreatCount ->
                fun () ->
                  {
                    threats;
                    scanId;
                    scanType;
                    scanCategory;
                    scanConfiguration;
                    uniqueThreatCount
                  }
    let to_value x =
      structure_to_value
        [("threats", (Option.map x.threats ~f:Threats.to_value));
        ("scanId", (Option.map x.scanId ~f:String_.to_value));
        ("scanType",
          (Option.map x.scanType ~f:MalwareProtectionScanType.to_value));
        ("scanCategory",
          (Option.map x.scanCategory ~f:ScanCategory.to_value));
        ("scanConfiguration",
          (Option.map x.scanConfiguration
             ~f:MalwareProtectionFindingsScanConfiguration.to_value));
        ("uniqueThreatCount",
          (Option.map x.uniqueThreatCount ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let uniqueThreatCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "uniqueThreatCount") in
      let scanConfiguration =
        (Option.map ~f:MalwareProtectionFindingsScanConfiguration.of_xml)
          (Xml.child xml_arg0 "scanConfiguration") in
      let scanCategory =
        (Option.map ~f:ScanCategory.of_xml)
          (Xml.child xml_arg0 "scanCategory") in
      let scanType =
        (Option.map ~f:MalwareProtectionScanType.of_xml)
          (Xml.child xml_arg0 "scanType") in
      let scanId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "scanId") in
      let threats =
        (Option.map ~f:Threats.of_xml) (Xml.child xml_arg0 "threats") in
      make ?uniqueThreatCount ?scanConfiguration ?scanCategory ?scanType
        ?scanId ?threats ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let uniqueThreatCount =
        field_map json__ "UniqueThreatCount" Integer.of_json in
      let scanConfiguration =
        field_map json__ "ScanConfiguration"
          MalwareProtectionFindingsScanConfiguration.of_json in
      let scanCategory = field_map json__ "ScanCategory" ScanCategory.of_json in
      let scanType =
        field_map json__ "ScanType" MalwareProtectionScanType.of_json in
      let scanId = field_map json__ "ScanId" String_.of_json in
      let threats = field_map json__ "Threats" Threats.of_json in
      make ?uniqueThreatCount ?scanConfiguration ?scanCategory ?scanType
        ?scanId ?threats ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the malware scan that generated a GuardDuty finding."]
module RuntimeDetails =
  struct
    type nonrec t =
      {
      process: ProcessDetails.t option
        [@ocaml.doc "Information about the observed process."];
      context: RuntimeContext.t option
        [@ocaml.doc "Additional information about the suspicious activity."]}
    let make ?process = fun ?context -> fun () -> { process; context }
    let to_value x =
      structure_to_value
        [("process", (Option.map x.process ~f:ProcessDetails.to_value));
        ("context", (Option.map x.context ~f:RuntimeContext.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let context =
        (Option.map ~f:RuntimeContext.of_xml) (Xml.child xml_arg0 "context") in
      let process =
        (Option.map ~f:ProcessDetails.of_xml) (Xml.child xml_arg0 "process") in
      make ?context ?process ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let context = field_map json__ "Context" RuntimeContext.of_json in
      let process = field_map json__ "Process" ProcessDetails.of_json in
      make ?context ?process ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the process and any required context values for a specific finding."]
module ServiceAdditionalInfo =
  struct
    type nonrec t =
      {
      value: String_.t option
        [@ocaml.doc
          "This field specifies the value of the additional information."];
      type_: String_.t option
        [@ocaml.doc "Describes the type of the additional information."]}
    let make ?value = fun ?type_ -> fun () -> { value; type_ }
    let to_value x =
      structure_to_value
        [("value", (Option.map x.value ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let value = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "value") in
      make ?type_ ?value ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let type_ = field_map json__ "Type" String_.of_json in
      let value = field_map json__ "Value" String_.of_json in
      make ?type_ ?value ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Additional information about the generated finding."]
module DetectorAdditionalConfigurationResult =
  struct
    type nonrec t =
      {
      name: FeatureAdditionalConfiguration.t option
        [@ocaml.doc "Name of the additional configuration."];
      status: FeatureStatus.t option
        [@ocaml.doc "Status of the additional configuration."];
      updatedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the additional configuration was last updated. This is in UTC format."]}
    let make ?name =
      fun ?status -> fun ?updatedAt -> fun () -> { name; status; updatedAt }
    let to_value x =
      structure_to_value
        [("name",
           (Option.map x.name ~f:FeatureAdditionalConfiguration.to_value));
        ("status", (Option.map x.status ~f:FeatureStatus.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let status =
        (Option.map ~f:FeatureStatus.of_xml) (Xml.child xml_arg0 "status") in
      let name =
        (Option.map ~f:FeatureAdditionalConfiguration.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?updatedAt ?status ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      let status = field_map json__ "Status" FeatureStatus.of_json in
      let name =
        field_map json__ "Name" FeatureAdditionalConfiguration.of_json in
      make ?updatedAt ?status ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the additional configuration."]
module OrganizationEbsVolumesResult =
  struct
    type nonrec t =
      {
      autoEnable: Boolean.t option
        [@ocaml.doc
          "An object that contains the status of whether scanning EBS volumes should be auto-enabled for new members joining the organization."]}
    let make ?autoEnable = fun () -> { autoEnable }
    let to_value x =
      structure_to_value
        [("autoEnable", (Option.map x.autoEnable ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnable =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "autoEnable") in
      make ?autoEnable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnable = field_map json__ "AutoEnable" Boolean.of_json in
      make ?autoEnable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "An object that contains information on the status of whether EBS volumes scanning will be enabled as a data source for an organization."]
module OrganizationAdditionalConfigurationResult =
  struct
    type nonrec t =
      {
      name: OrgFeatureAdditionalConfiguration.t option
        [@ocaml.doc
          "The name of the additional configuration that is configured for the member accounts within the organization. These values are applicable to only Runtime Monitoring protection plan."];
      autoEnable: OrgFeatureStatus.t option
        [@ocaml.doc
          "Describes the status of the additional configuration that is configured for the member accounts within the organization. One of the following values is the status for the entire organization: NEW: Indicates that when a new account joins the organization, they will have the additional configuration enabled automatically. ALL: Indicates that all accounts in the organization have the additional configuration enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. It may take up to 24 hours to update the configuration for all the member accounts. NONE: Indicates that the additional configuration will not be automatically enabled for any account in the organization. The administrator must manage the additional configuration for each account individually."]}
    let make ?name = fun ?autoEnable -> fun () -> { name; autoEnable }
    let to_value x =
      structure_to_value
        [("name",
           (Option.map x.name ~f:OrgFeatureAdditionalConfiguration.to_value));
        ("autoEnable",
          (Option.map x.autoEnable ~f:OrgFeatureStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnable =
        (Option.map ~f:OrgFeatureStatus.of_xml)
          (Xml.child xml_arg0 "autoEnable") in
      let name =
        (Option.map ~f:OrgFeatureAdditionalConfiguration.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?autoEnable ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnable = field_map json__ "AutoEnable" OrgFeatureStatus.of_json in
      let name =
        field_map json__ "Name" OrgFeatureAdditionalConfiguration.of_json in
      make ?autoEnable ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "A list of additional configuration which will be configured for the organization."]
module InstanceArn =
  struct
    type nonrec t = string
    let context_ = "InstanceArn"
    let make i =
      let open Result in
        ok_or_failwith
          (check_pattern i
             ~pattern:"arn:(aws|aws-cn|aws-us-gov):[a-z]+:[a-z]+(-[0-9]+|-[a-z]+)+:([0-9]{12}):[a-z\\-]+\\/[a-zA-Z0-9]*");
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"InstanceArn" j
    let to_json = simple_to_json to_value
  end
module ScanResult =
  struct
    type nonrec t =
      | CLEAN 
      | INFECTED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | CLEAN -> "CLEAN"
      | INFECTED -> "INFECTED"
      | Non_static_id s -> s
    let of_string =
      function
      | "CLEAN" -> CLEAN
      | "INFECTED" -> INFECTED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ScanResult" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ScanResult" j)
    let to_json = simple_to_json to_value
  end
module CriterionKey =
  struct
    type nonrec t =
      | EC2_INSTANCE_ARN 
      | SCAN_ID 
      | ACCOUNT_ID 
      | GUARDDUTY_FINDING_ID 
      | SCAN_START_TIME 
      | SCAN_STATUS 
      | SCAN_TYPE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | EC2_INSTANCE_ARN -> "EC2_INSTANCE_ARN"
      | SCAN_ID -> "SCAN_ID"
      | ACCOUNT_ID -> "ACCOUNT_ID"
      | GUARDDUTY_FINDING_ID -> "GUARDDUTY_FINDING_ID"
      | SCAN_START_TIME -> "SCAN_START_TIME"
      | SCAN_STATUS -> "SCAN_STATUS"
      | SCAN_TYPE -> "SCAN_TYPE"
      | Non_static_id s -> s
    let of_string =
      function
      | "EC2_INSTANCE_ARN" -> EC2_INSTANCE_ARN
      | "SCAN_ID" -> SCAN_ID
      | "ACCOUNT_ID" -> ACCOUNT_ID
      | "GUARDDUTY_FINDING_ID" -> GUARDDUTY_FINDING_ID
      | "SCAN_START_TIME" -> SCAN_START_TIME
      | "SCAN_STATUS" -> SCAN_STATUS
      | "SCAN_TYPE" -> SCAN_TYPE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration CriterionKey" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"CriterionKey" j)
    let to_json = simple_to_json to_value
  end
module OrganizationKubernetesAuditLogsConfiguration =
  struct
    type nonrec t =
      {
      autoEnable: Boolean.t
        [@ocaml.doc
          "A value that contains information on whether Kubernetes audit logs should be enabled automatically as a data source for the organization."]}
    let context_ = "OrganizationKubernetesAuditLogsConfiguration"
    let make ~autoEnable = fun () -> { autoEnable }
    let to_value x =
      structure_to_value
        [("autoEnable", (Some (Boolean.to_value x.autoEnable)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnable =
        Boolean.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "autoEnable") in
      make ~autoEnable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnable = field_map_exn json__ "AutoEnable" Boolean.of_json in
      make ~autoEnable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Organization-wide Kubernetes audit logs configuration."]
module OrganizationScanEc2InstanceWithFindings =
  struct
    type nonrec t =
      {
      ebsVolumes: OrganizationEbsVolumes.t option
        [@ocaml.doc
          "Whether scanning EBS volumes should be auto-enabled for new members joining the organization."]}
    let make ?ebsVolumes = fun () -> { ebsVolumes }
    let to_value x =
      structure_to_value
        [("ebsVolumes",
           (Option.map x.ebsVolumes ~f:OrganizationEbsVolumes.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ebsVolumes =
        (Option.map ~f:OrganizationEbsVolumes.of_xml)
          (Xml.child xml_arg0 "ebsVolumes") in
      make ?ebsVolumes ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ebsVolumes =
        field_map json__ "EbsVolumes" OrganizationEbsVolumes.of_json in
      make ?ebsVolumes ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Organization-wide EC2 instances with findings scan configuration."]
module OrganizationAdditionalConfigurations =
  struct
    type nonrec t = OrganizationAdditionalConfiguration.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:OrganizationAdditionalConfiguration.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:OrganizationAdditionalConfiguration.of_xml)
    let of_json j =
      list_of_json ~kind:"OrganizationAdditionalConfigurations"
        ~of_json:OrganizationAdditionalConfiguration.of_json j
    let to_json v = composed_to_json to_value v
  end
module KubernetesAuditLogsConfiguration =
  struct
    type nonrec t =
      {
      enable: Boolean.t
        [@ocaml.doc "The status of Kubernetes audit logs as a data source."]}
    let context_ = "KubernetesAuditLogsConfiguration"
    let make ~enable = fun () -> { enable }
    let to_value x =
      structure_to_value [("enable", (Some (Boolean.to_value x.enable)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let enable =
        Boolean.of_xml (Xml.child_exn ~context:context_ xml_arg0 "enable") in
      make ~enable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let enable = field_map_exn json__ "Enable" Boolean.of_json in
      make ~enable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether Kubernetes audit logs are enabled as a data source."]
module ScanEc2InstanceWithFindings =
  struct
    type nonrec t =
      {
      ebsVolumes: Boolean.t option
        [@ocaml.doc
          "Describes the configuration for scanning EBS volumes as data source."]}
    let make ?ebsVolumes = fun () -> { ebsVolumes }
    let to_value x =
      structure_to_value
        [("ebsVolumes", (Option.map x.ebsVolumes ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ebsVolumes =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "ebsVolumes") in
      make ?ebsVolumes ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ebsVolumes = field_map json__ "EbsVolumes" Boolean.of_json in
      make ?ebsVolumes ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether Malware Protection for EC2 instances with findings will be enabled as a data source."]
module MemberAdditionalConfigurations =
  struct
    type nonrec t = MemberAdditionalConfiguration.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:MemberAdditionalConfiguration.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:MemberAdditionalConfiguration.of_xml)
    let of_json j =
      list_of_json ~kind:"MemberAdditionalConfigurations"
        ~of_json:MemberAdditionalConfiguration.of_json j
    let to_json v = composed_to_json to_value v
  end
module ScanCondition =
  struct
    type nonrec t =
      {
      mapEquals: MapEquals.t
        [@ocaml.doc
          "Represents an mapEqual condition to be applied to a single field when triggering for malware scan."]}
    let context_ = "ScanCondition"
    let make ~mapEquals = fun () -> { mapEquals }
    let to_value x =
      structure_to_value
        [("mapEquals", (Some (MapEquals.to_value x.mapEquals)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let mapEquals =
        MapEquals.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "mapEquals") in
      make ~mapEquals ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let mapEquals = field_map_exn json__ "MapEquals" MapEquals.of_json in
      make ~mapEquals ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the condition."]
module ScanCriterionKey =
  struct
    type nonrec t =
      | EC2_INSTANCE_TAG 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | EC2_INSTANCE_TAG -> "EC2_INSTANCE_TAG"
      | Non_static_id s -> s
    let of_string =
      function
      | "EC2_INSTANCE_TAG" -> EC2_INSTANCE_TAG
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ScanCriterionKey" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ScanCriterionKey" j)
    let to_json = simple_to_json to_value
  end
module MalwareProtectionPlanTaggingActionStatus =
  struct
    type nonrec t =
      | ENABLED 
      | DISABLED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ENABLED -> "ENABLED"
      | DISABLED -> "DISABLED"
      | Non_static_id s -> s
    let of_string =
      function
      | "ENABLED" -> ENABLED
      | "DISABLED" -> DISABLED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml
           ~kind:"enumeration MalwareProtectionPlanTaggingActionStatus"
           xml_arg0)
    let of_json j =
      of_string
        (string_of_json ~kind:"MalwareProtectionPlanTaggingActionStatus" j)
    let to_json = simple_to_json to_value
  end
module MalwareProtectionPlanObjectPrefixesList =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:5) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"MalwareProtectionPlanObjectPrefixesList"
        ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module Condition =
  struct
    type nonrec t =
      {
      eq: Eq.t option
        [@ocaml.doc
          "Represents the equal condition to be applied to a single field when querying for findings. Max values: 50"];
      neq: Neq.t option
        [@ocaml.doc
          "Represents the not equal condition to be applied to a single field when querying for findings. Max values: 50"];
      gt: Integer.t option
        [@ocaml.doc
          "Represents a greater than condition to be applied to a single field when querying for findings."];
      gte: Integer.t option
        [@ocaml.doc
          "Represents a greater than or equal condition to be applied to a single field when querying for findings."];
      lt: Integer.t option
        [@ocaml.doc
          "Represents a less than condition to be applied to a single field when querying for findings."];
      lte: Integer.t option
        [@ocaml.doc
          "Represents a less than or equal condition to be applied to a single field when querying for findings."];
      equals: Equals.t option
        [@ocaml.doc
          "Represents an equal condition to be applied to a single field when querying for findings. Max values: 50"];
      notEquals: NotEquals.t option
        [@ocaml.doc
          "Represents a not equal condition to be applied to a single field when querying for findings. Max values: 50"];
      greaterThan: Long.t option
        [@ocaml.doc
          "Represents a greater than condition to be applied to a single field when querying for findings."];
      greaterThanOrEqual: Long.t option
        [@ocaml.doc
          "Represents a greater than or equal condition to be applied to a single field when querying for findings."];
      lessThan: Long.t option
        [@ocaml.doc
          "Represents a less than condition to be applied to a single field when querying for findings."];
      lessThanOrEqual: Long.t option
        [@ocaml.doc
          "Represents a less than or equal condition to be applied to a single field when querying for findings."];
      matches: Matches.t option
        [@ocaml.doc
          "Represents the match condition to be applied to a single field when querying for findings. The matches condition is available only for create-filter and update-filter APIs."];
      notMatches: NotMatches.t option
        [@ocaml.doc
          "Represents the not match condition to be applied to a single field when querying for findings. The not-matches condition is available only for create-filter and update-filter APIs."]}
    let make ?eq =
      fun ?neq ->
        fun ?gt ->
          fun ?gte ->
            fun ?lt ->
              fun ?lte ->
                fun ?equals ->
                  fun ?notEquals ->
                    fun ?greaterThan ->
                      fun ?greaterThanOrEqual ->
                        fun ?lessThan ->
                          fun ?lessThanOrEqual ->
                            fun ?matches ->
                              fun ?notMatches ->
                                fun () ->
                                  {
                                    eq;
                                    neq;
                                    gt;
                                    gte;
                                    lt;
                                    lte;
                                    equals;
                                    notEquals;
                                    greaterThan;
                                    greaterThanOrEqual;
                                    lessThan;
                                    lessThanOrEqual;
                                    matches;
                                    notMatches
                                  }
    let to_value x =
      structure_to_value
        [("eq", (Option.map x.eq ~f:Eq.to_value));
        ("neq", (Option.map x.neq ~f:Neq.to_value));
        ("gt", (Option.map x.gt ~f:Integer.to_value));
        ("gte", (Option.map x.gte ~f:Integer.to_value));
        ("lt", (Option.map x.lt ~f:Integer.to_value));
        ("lte", (Option.map x.lte ~f:Integer.to_value));
        ("equals", (Option.map x.equals ~f:Equals.to_value));
        ("notEquals", (Option.map x.notEquals ~f:NotEquals.to_value));
        ("greaterThan", (Option.map x.greaterThan ~f:Long.to_value));
        ("greaterThanOrEqual",
          (Option.map x.greaterThanOrEqual ~f:Long.to_value));
        ("lessThan", (Option.map x.lessThan ~f:Long.to_value));
        ("lessThanOrEqual", (Option.map x.lessThanOrEqual ~f:Long.to_value));
        ("matches", (Option.map x.matches ~f:Matches.to_value));
        ("notMatches", (Option.map x.notMatches ~f:NotMatches.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let notMatches =
        (Option.map ~f:NotMatches.of_xml) (Xml.child xml_arg0 "notMatches") in
      let matches =
        (Option.map ~f:Matches.of_xml) (Xml.child xml_arg0 "matches") in
      let lessThanOrEqual =
        (Option.map ~f:Long.of_xml) (Xml.child xml_arg0 "lessThanOrEqual") in
      let lessThan =
        (Option.map ~f:Long.of_xml) (Xml.child xml_arg0 "lessThan") in
      let greaterThanOrEqual =
        (Option.map ~f:Long.of_xml) (Xml.child xml_arg0 "greaterThanOrEqual") in
      let greaterThan =
        (Option.map ~f:Long.of_xml) (Xml.child xml_arg0 "greaterThan") in
      let notEquals =
        (Option.map ~f:NotEquals.of_xml) (Xml.child xml_arg0 "notEquals") in
      let equals =
        (Option.map ~f:Equals.of_xml) (Xml.child xml_arg0 "equals") in
      let lte = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "lte") in
      let lt = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "lt") in
      let gte = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "gte") in
      let gt = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "gt") in
      let neq = (Option.map ~f:Neq.of_xml) (Xml.child xml_arg0 "neq") in
      let eq = (Option.map ~f:Eq.of_xml) (Xml.child xml_arg0 "eq") in
      make ?notMatches ?matches ?lessThanOrEqual ?lessThan
        ?greaterThanOrEqual ?greaterThan ?notEquals ?equals ?lte ?lt ?gte ?gt
        ?neq ?eq ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let notMatches = field_map json__ "NotMatches" NotMatches.of_json in
      let matches = field_map json__ "Matches" Matches.of_json in
      let lessThanOrEqual = field_map json__ "LessThanOrEqual" Long.of_json in
      let lessThan = field_map json__ "LessThan" Long.of_json in
      let greaterThanOrEqual =
        field_map json__ "GreaterThanOrEqual" Long.of_json in
      let greaterThan = field_map json__ "GreaterThan" Long.of_json in
      let notEquals = field_map json__ "NotEquals" NotEquals.of_json in
      let equals = field_map json__ "Equals" Equals.of_json in
      let lte = field_map json__ "Lte" Integer.of_json in
      let lt = field_map json__ "Lt" Integer.of_json in
      let gte = field_map json__ "Gte" Integer.of_json in
      let gt = field_map json__ "Gt" Integer.of_json in
      let neq = field_map json__ "Neq" Neq.of_json in
      let eq = field_map json__ "Eq" Eq.of_json in
      make ?notMatches ?matches ?lessThanOrEqual ?lessThan
        ?greaterThanOrEqual ?greaterThan ?notEquals ?equals ?lte ?lt ?gte ?gt
        ?neq ?eq ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the condition."]
module DetectorAdditionalConfigurations =
  struct
    type nonrec t = DetectorAdditionalConfiguration.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:DetectorAdditionalConfiguration.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:DetectorAdditionalConfiguration.of_xml)
    let of_json j =
      list_of_json ~kind:"DetectorAdditionalConfigurations"
        ~of_json:DetectorAdditionalConfiguration.of_json j
    let to_json v = composed_to_json to_value v
  end
module DetectorFeature =
  struct
    type nonrec t =
      | S3_DATA_EVENTS 
      | EKS_AUDIT_LOGS 
      | EBS_MALWARE_PROTECTION 
      | RDS_LOGIN_EVENTS 
      | LAMBDA_NETWORK_LOGS 
      | EKS_RUNTIME_MONITORING 
      | RUNTIME_MONITORING 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | S3_DATA_EVENTS -> "S3_DATA_EVENTS"
      | EKS_AUDIT_LOGS -> "EKS_AUDIT_LOGS"
      | EBS_MALWARE_PROTECTION -> "EBS_MALWARE_PROTECTION"
      | RDS_LOGIN_EVENTS -> "RDS_LOGIN_EVENTS"
      | LAMBDA_NETWORK_LOGS -> "LAMBDA_NETWORK_LOGS"
      | EKS_RUNTIME_MONITORING -> "EKS_RUNTIME_MONITORING"
      | RUNTIME_MONITORING -> "RUNTIME_MONITORING"
      | Non_static_id s -> s
    let of_string =
      function
      | "S3_DATA_EVENTS" -> S3_DATA_EVENTS
      | "EKS_AUDIT_LOGS" -> EKS_AUDIT_LOGS
      | "EBS_MALWARE_PROTECTION" -> EBS_MALWARE_PROTECTION
      | "RDS_LOGIN_EVENTS" -> RDS_LOGIN_EVENTS
      | "LAMBDA_NETWORK_LOGS" -> LAMBDA_NETWORK_LOGS
      | "EKS_RUNTIME_MONITORING" -> EKS_RUNTIME_MONITORING
      | "RUNTIME_MONITORING" -> RUNTIME_MONITORING
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration DetectorFeature" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"DetectorFeature" j)
    let to_json = simple_to_json to_value
  end
module DestinationType =
  struct
    type nonrec t =
      | S3 
      | Non_static_id of string 
    let make i = i
    let to_string = function | S3 -> "S3" | Non_static_id s -> s
    let of_string = function | "S3" -> S3 | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration DestinationType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"DestinationType" j)
    let to_json = simple_to_json to_value
  end
module PublishingStatus =
  struct
    type nonrec t =
      | PENDING_VERIFICATION 
      | PUBLISHING 
      | UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY 
      | STOPPED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | PENDING_VERIFICATION -> "PENDING_VERIFICATION"
      | PUBLISHING -> "PUBLISHING"
      | UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY ->
          "UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY"
      | STOPPED -> "STOPPED"
      | Non_static_id s -> s
    let of_string =
      function
      | "PENDING_VERIFICATION" -> PENDING_VERIFICATION
      | "PUBLISHING" -> PUBLISHING
      | "UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY" ->
          UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY
      | "STOPPED" -> STOPPED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration PublishingStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"PublishingStatus" j)
    let to_json = simple_to_json to_value
  end
module AdminStatus =
  struct
    type nonrec t =
      | ENABLED 
      | DISABLE_IN_PROGRESS 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ENABLED -> "ENABLED"
      | DISABLE_IN_PROGRESS -> "DISABLE_IN_PROGRESS"
      | Non_static_id s -> s
    let of_string =
      function
      | "ENABLED" -> ENABLED
      | "DISABLE_IN_PROGRESS" -> DISABLE_IN_PROGRESS
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration AdminStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"AdminStatus" j)
    let to_json = simple_to_json to_value
  end
module Email =
  struct
    type nonrec t = string
    let context_ = "Email"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:64) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"Email" j
    let to_json = simple_to_json to_value
  end
module MalwareProtectionResourceType =
  struct
    type nonrec t =
      | EBS_RECOVERY_POINT 
      | EBS_SNAPSHOT 
      | EBS_VOLUME 
      | EC2_AMI 
      | EC2_INSTANCE 
      | EC2_RECOVERY_POINT 
      | S3_RECOVERY_POINT 
      | S3_BUCKET 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | EBS_RECOVERY_POINT -> "EBS_RECOVERY_POINT"
      | EBS_SNAPSHOT -> "EBS_SNAPSHOT"
      | EBS_VOLUME -> "EBS_VOLUME"
      | EC2_AMI -> "EC2_AMI"
      | EC2_INSTANCE -> "EC2_INSTANCE"
      | EC2_RECOVERY_POINT -> "EC2_RECOVERY_POINT"
      | S3_RECOVERY_POINT -> "S3_RECOVERY_POINT"
      | S3_BUCKET -> "S3_BUCKET"
      | Non_static_id s -> s
    let of_string =
      function
      | "EBS_RECOVERY_POINT" -> EBS_RECOVERY_POINT
      | "EBS_SNAPSHOT" -> EBS_SNAPSHOT
      | "EBS_VOLUME" -> EBS_VOLUME
      | "EC2_AMI" -> EC2_AMI
      | "EC2_INSTANCE" -> EC2_INSTANCE
      | "EC2_RECOVERY_POINT" -> EC2_RECOVERY_POINT
      | "S3_RECOVERY_POINT" -> S3_RECOVERY_POINT
      | "S3_BUCKET" -> S3_BUCKET
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration MalwareProtectionResourceType"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"MalwareProtectionResourceType" j)
    let to_json = simple_to_json to_value
  end
module MalwareProtectionScanStatus =
  struct
    type nonrec t =
      | RUNNING 
      | COMPLETED 
      | COMPLETED_WITH_ISSUES 
      | FAILED 
      | SKIPPED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | RUNNING -> "RUNNING"
      | COMPLETED -> "COMPLETED"
      | COMPLETED_WITH_ISSUES -> "COMPLETED_WITH_ISSUES"
      | FAILED -> "FAILED"
      | SKIPPED -> "SKIPPED"
      | Non_static_id s -> s
    let of_string =
      function
      | "RUNNING" -> RUNNING
      | "COMPLETED" -> COMPLETED
      | "COMPLETED_WITH_ISSUES" -> COMPLETED_WITH_ISSUES
      | "FAILED" -> FAILED
      | "SKIPPED" -> SKIPPED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration MalwareProtectionScanStatus"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"MalwareProtectionScanStatus" j)
    let to_json = simple_to_json to_value
  end
module ScanResultStatus =
  struct
    type nonrec t =
      | NO_THREATS_FOUND 
      | THREATS_FOUND 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | NO_THREATS_FOUND -> "NO_THREATS_FOUND"
      | THREATS_FOUND -> "THREATS_FOUND"
      | Non_static_id s -> s
    let of_string =
      function
      | "NO_THREATS_FOUND" -> NO_THREATS_FOUND
      | "THREATS_FOUND" -> THREATS_FOUND
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ScanResultStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ScanResultStatus" j)
    let to_json = simple_to_json to_value
  end
module ListMalwareScansFilterCriterion =
  struct
    type nonrec t =
      {
      listMalwareScansCriterionKey: ListMalwareScansCriterionKey.t option
        [@ocaml.doc
          "An enum value representing possible scan properties to match with given scan entries."];
      filterCondition: FilterCondition.t option
        [@ocaml.doc "Contains information about the condition."]}
    let make ?listMalwareScansCriterionKey =
      fun ?filterCondition ->
        fun () -> { listMalwareScansCriterionKey; filterCondition }
    let to_value x =
      structure_to_value
        [("criterionKey",
           (Option.map x.listMalwareScansCriterionKey
              ~f:ListMalwareScansCriterionKey.to_value));
        ("filterCondition",
          (Option.map x.filterCondition ~f:FilterCondition.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let filterCondition =
        (Option.map ~f:FilterCondition.of_xml)
          (Xml.child xml_arg0 "filterCondition") in
      let listMalwareScansCriterionKey =
        (Option.map ~f:ListMalwareScansCriterionKey.of_xml)
          (Xml.child xml_arg0 "criterionKey") in
      make ?filterCondition ?listMalwareScansCriterionKey ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let filterCondition =
        field_map json__ "FilterCondition" FilterCondition.of_json in
      let listMalwareScansCriterionKey =
        field_map json__ "ListMalwareScansCriterionKey"
          ListMalwareScansCriterionKey.of_json in
      make ?filterCondition ?listMalwareScansCriterionKey ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents a condition that when matched will be added to the response of the operation. Irrespective of using any filter criteria, an administrator account can view the scan entries for all of its member accounts. However, each member account can view the scan entries only for their own account."]
module CoverageResourceDetails =
  struct
    type nonrec t =
      {
      eksClusterDetails: CoverageEksClusterDetails.t option
        [@ocaml.doc
          "EKS cluster details involved in the coverage statistics."];
      ecsClusterDetails: CoverageEcsClusterDetails.t option
        [@ocaml.doc
          "Information about the Amazon ECS cluster that is assessed for runtime coverage."];
      ec2InstanceDetails: CoverageEc2InstanceDetails.t option
        [@ocaml.doc
          "Information about the Amazon EC2 instance assessed for runtime coverage."];
      resourceType: ResourceType.t option
        [@ocaml.doc "The type of Amazon Web Services resource."]}
    let make ?eksClusterDetails =
      fun ?ecsClusterDetails ->
        fun ?ec2InstanceDetails ->
          fun ?resourceType ->
            fun () ->
              {
                eksClusterDetails;
                ecsClusterDetails;
                ec2InstanceDetails;
                resourceType
              }
    let to_value x =
      structure_to_value
        [("eksClusterDetails",
           (Option.map x.eksClusterDetails
              ~f:CoverageEksClusterDetails.to_value));
        ("ecsClusterDetails",
          (Option.map x.ecsClusterDetails
             ~f:CoverageEcsClusterDetails.to_value));
        ("ec2InstanceDetails",
          (Option.map x.ec2InstanceDetails
             ~f:CoverageEc2InstanceDetails.to_value));
        ("resourceType",
          (Option.map x.resourceType ~f:ResourceType.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let resourceType =
        (Option.map ~f:ResourceType.of_xml)
          (Xml.child xml_arg0 "resourceType") in
      let ec2InstanceDetails =
        (Option.map ~f:CoverageEc2InstanceDetails.of_xml)
          (Xml.child xml_arg0 "ec2InstanceDetails") in
      let ecsClusterDetails =
        (Option.map ~f:CoverageEcsClusterDetails.of_xml)
          (Xml.child xml_arg0 "ecsClusterDetails") in
      let eksClusterDetails =
        (Option.map ~f:CoverageEksClusterDetails.of_xml)
          (Xml.child xml_arg0 "eksClusterDetails") in
      make ?resourceType ?ec2InstanceDetails ?ecsClusterDetails
        ?eksClusterDetails ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let resourceType = field_map json__ "ResourceType" ResourceType.of_json in
      let ec2InstanceDetails =
        field_map json__ "Ec2InstanceDetails"
          CoverageEc2InstanceDetails.of_json in
      let ecsClusterDetails =
        field_map json__ "EcsClusterDetails"
          CoverageEcsClusterDetails.of_json in
      let eksClusterDetails =
        field_map json__ "EksClusterDetails"
          CoverageEksClusterDetails.of_json in
      make ?resourceType ?ec2InstanceDetails ?ecsClusterDetails
        ?eksClusterDetails ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the resource for each individual EKS cluster."]
module CoverageStatus =
  struct
    type nonrec t =
      | HEALTHY 
      | UNHEALTHY 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | HEALTHY -> "HEALTHY"
      | UNHEALTHY -> "UNHEALTHY"
      | Non_static_id s -> s
    let of_string =
      function
      | "HEALTHY" -> HEALTHY
      | "UNHEALTHY" -> UNHEALTHY
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration CoverageStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"CoverageStatus" j)
    let to_json = simple_to_json to_value
  end
module CoverageFilterCriterion =
  struct
    type nonrec t =
      {
      criterionKey: CoverageFilterCriterionKey.t option
        [@ocaml.doc
          "An enum value representing possible filter fields. Replace the enum value CLUSTER_NAME with EKS_CLUSTER_NAME. CLUSTER_NAME has been deprecated."];
      filterCondition: CoverageFilterCondition.t option
        [@ocaml.doc "Contains information about the condition."]}
    let make ?criterionKey =
      fun ?filterCondition -> fun () -> { criterionKey; filterCondition }
    let to_value x =
      structure_to_value
        [("criterionKey",
           (Option.map x.criterionKey ~f:CoverageFilterCriterionKey.to_value));
        ("filterCondition",
          (Option.map x.filterCondition ~f:CoverageFilterCondition.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let filterCondition =
        (Option.map ~f:CoverageFilterCondition.of_xml)
          (Xml.child xml_arg0 "filterCondition") in
      let criterionKey =
        (Option.map ~f:CoverageFilterCriterionKey.of_xml)
          (Xml.child xml_arg0 "criterionKey") in
      make ?filterCondition ?criterionKey ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let filterCondition =
        field_map json__ "FilterCondition" CoverageFilterCondition.of_json in
      let criterionKey =
        field_map json__ "CriterionKey" CoverageFilterCriterionKey.of_json in
      make ?filterCondition ?criterionKey ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents a condition that when matched will be added to the response of the operation."]
module UsageAccountResult =
  struct
    type nonrec t =
      {
      accountId: AccountId.t option
        [@ocaml.doc "The Account ID that generated usage."];
      total: Total.t option
        [@ocaml.doc "Represents the total of usage for the Account ID."]}
    let make ?accountId = fun ?total -> fun () -> { accountId; total }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("total", (Option.map x.total ~f:Total.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let total = (Option.map ~f:Total.of_xml) (Xml.child xml_arg0 "total") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?total ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let total = field_map json__ "Total" Total.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      make ?total ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the total of usage based on account IDs."]
module UsageDataSourceResult =
  struct
    type nonrec t =
      {
      dataSource: DataSource.t option
        [@ocaml.doc "The data source type that generated usage."];
      total: Total.t option
        [@ocaml.doc
          "Represents the total of usage for the specified data source."]}
    let make ?dataSource = fun ?total -> fun () -> { dataSource; total }
    let to_value x =
      structure_to_value
        [("dataSource", (Option.map x.dataSource ~f:DataSource.to_value));
        ("total", (Option.map x.total ~f:Total.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let total = (Option.map ~f:Total.of_xml) (Xml.child xml_arg0 "total") in
      let dataSource =
        (Option.map ~f:DataSource.of_xml) (Xml.child xml_arg0 "dataSource") in
      make ?total ?dataSource ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let total = field_map json__ "Total" Total.of_json in
      let dataSource = field_map json__ "DataSource" DataSource.of_json in
      make ?total ?dataSource ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the result of usage based on data source type."]
module UsageFeatureResult =
  struct
    type nonrec t =
      {
      feature: UsageFeature.t option
        [@ocaml.doc "The feature that generated the usage cost."];
      total: Total.t option }
    let make ?feature = fun ?total -> fun () -> { feature; total }
    let to_value x =
      structure_to_value
        [("feature", (Option.map x.feature ~f:UsageFeature.to_value));
        ("total", (Option.map x.total ~f:Total.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let total = (Option.map ~f:Total.of_xml) (Xml.child xml_arg0 "total") in
      let feature =
        (Option.map ~f:UsageFeature.of_xml) (Xml.child xml_arg0 "feature") in
      make ?total ?feature ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let total = field_map json__ "Total" Total.of_json in
      let feature = field_map json__ "Feature" UsageFeature.of_json in
      make ?total ?feature ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the result of the total usage based on the feature."]
module UsageResourceResult =
  struct
    type nonrec t =
      {
      resource: String_.t option
        [@ocaml.doc "The Amazon Web Services resource that generated usage."];
      total: Total.t option
        [@ocaml.doc
          "Represents the sum total of usage for the specified resource type."]}
    let make ?resource = fun ?total -> fun () -> { resource; total }
    let to_value x =
      structure_to_value
        [("resource", (Option.map x.resource ~f:String_.to_value));
        ("total", (Option.map x.total ~f:Total.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let total = (Option.map ~f:Total.of_xml) (Xml.child xml_arg0 "total") in
      let resource =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resource") in
      make ?total ?resource ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let total = field_map json__ "Total" Total.of_json in
      let resource = field_map json__ "Resource" String_.of_json in
      make ?total ?resource ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the sum of usage based on an Amazon Web Services resource."]
module UsageTopAccountsResult =
  struct
    type nonrec t =
      {
      feature: UsageFeature.t option
        [@ocaml.doc
          "Features by which you can generate the usage statistics. RDS_LOGIN_EVENTS is currently not supported with topAccountsByFeature."];
      accounts: UsageTopAccountsByFeatureList.t option
        [@ocaml.doc "The accounts that contributed to the total usage cost."]}
    let make ?feature = fun ?accounts -> fun () -> { feature; accounts }
    let to_value x =
      structure_to_value
        [("feature", (Option.map x.feature ~f:UsageFeature.to_value));
        ("accounts",
          (Option.map x.accounts ~f:UsageTopAccountsByFeatureList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accounts =
        (Option.map ~f:UsageTopAccountsByFeatureList.of_xml)
          (Xml.child xml_arg0 "accounts") in
      let feature =
        (Option.map ~f:UsageFeature.of_xml) (Xml.child xml_arg0 "feature") in
      make ?accounts ?feature ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accounts =
        field_map json__ "Accounts" UsageTopAccountsByFeatureList.of_json in
      let feature = field_map json__ "Feature" UsageFeature.of_json in
      make ?accounts ?feature ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the usage statistics, calculated by top accounts by feature."]
module DataSourcesFreeTrial =
  struct
    type nonrec t =
      {
      cloudTrail: DataSourceFreeTrial.t option
        [@ocaml.doc
          "Describes whether any Amazon Web Services CloudTrail management event logs are enabled as data sources."];
      dnsLogs: DataSourceFreeTrial.t option
        [@ocaml.doc
          "Describes whether any DNS logs are enabled as data sources."];
      flowLogs: DataSourceFreeTrial.t option
        [@ocaml.doc
          "Describes whether any VPC Flow logs are enabled as data sources."];
      s3Logs: DataSourceFreeTrial.t option
        [@ocaml.doc
          "Describes whether any S3 data event logs are enabled as data sources."];
      kubernetes: KubernetesDataSourceFreeTrial.t option
        [@ocaml.doc
          "Describes whether any Kubernetes logs are enabled as data sources."];
      malwareProtection: MalwareProtectionDataSourceFreeTrial.t option
        [@ocaml.doc
          "Describes whether Malware Protection is enabled as a data source."]}
    let make ?cloudTrail =
      fun ?dnsLogs ->
        fun ?flowLogs ->
          fun ?s3Logs ->
            fun ?kubernetes ->
              fun ?malwareProtection ->
                fun () ->
                  {
                    cloudTrail;
                    dnsLogs;
                    flowLogs;
                    s3Logs;
                    kubernetes;
                    malwareProtection
                  }
    let to_value x =
      structure_to_value
        [("cloudTrail",
           (Option.map x.cloudTrail ~f:DataSourceFreeTrial.to_value));
        ("dnsLogs", (Option.map x.dnsLogs ~f:DataSourceFreeTrial.to_value));
        ("flowLogs", (Option.map x.flowLogs ~f:DataSourceFreeTrial.to_value));
        ("s3Logs", (Option.map x.s3Logs ~f:DataSourceFreeTrial.to_value));
        ("kubernetes",
          (Option.map x.kubernetes ~f:KubernetesDataSourceFreeTrial.to_value));
        ("malwareProtection",
          (Option.map x.malwareProtection
             ~f:MalwareProtectionDataSourceFreeTrial.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtection =
        (Option.map ~f:MalwareProtectionDataSourceFreeTrial.of_xml)
          (Xml.child xml_arg0 "malwareProtection") in
      let kubernetes =
        (Option.map ~f:KubernetesDataSourceFreeTrial.of_xml)
          (Xml.child xml_arg0 "kubernetes") in
      let s3Logs =
        (Option.map ~f:DataSourceFreeTrial.of_xml)
          (Xml.child xml_arg0 "s3Logs") in
      let flowLogs =
        (Option.map ~f:DataSourceFreeTrial.of_xml)
          (Xml.child xml_arg0 "flowLogs") in
      let dnsLogs =
        (Option.map ~f:DataSourceFreeTrial.of_xml)
          (Xml.child xml_arg0 "dnsLogs") in
      let cloudTrail =
        (Option.map ~f:DataSourceFreeTrial.of_xml)
          (Xml.child xml_arg0 "cloudTrail") in
      make ?malwareProtection ?kubernetes ?s3Logs ?flowLogs ?dnsLogs
        ?cloudTrail ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtection =
        field_map json__ "MalwareProtection"
          MalwareProtectionDataSourceFreeTrial.of_json in
      let kubernetes =
        field_map json__ "Kubernetes" KubernetesDataSourceFreeTrial.of_json in
      let s3Logs = field_map json__ "S3Logs" DataSourceFreeTrial.of_json in
      let flowLogs = field_map json__ "FlowLogs" DataSourceFreeTrial.of_json in
      let dnsLogs = field_map json__ "DnsLogs" DataSourceFreeTrial.of_json in
      let cloudTrail =
        field_map json__ "CloudTrail" DataSourceFreeTrial.of_json in
      make ?malwareProtection ?kubernetes ?s3Logs ?flowLogs ?dnsLogs
        ?cloudTrail ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about which data sources are enabled for the GuardDuty member account."]
module FreeTrialFeatureConfigurationsResults =
  struct
    type nonrec t = FreeTrialFeatureConfigurationResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:FreeTrialFeatureConfigurationResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:FreeTrialFeatureConfigurationResult.of_xml)
    let of_json j =
      list_of_json ~kind:"FreeTrialFeatureConfigurationsResults"
        ~of_json:FreeTrialFeatureConfigurationResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module OrganizationFeatureStatisticsResults =
  struct
    type nonrec t = OrganizationFeatureStatistics.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:OrganizationFeatureStatistics.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:OrganizationFeatureStatistics.of_xml)
    let of_json j =
      list_of_json ~kind:"OrganizationFeatureStatisticsResults"
        ~of_json:OrganizationFeatureStatistics.of_json j
    let to_json v = composed_to_json to_value v
  end
module DataSourceConfigurationsResult =
  struct
    type nonrec t =
      {
      cloudTrail: CloudTrailConfigurationResult.t option
        [@ocaml.doc
          "An object that contains information on the status of CloudTrail as a data source."];
      dNSLogs: DNSLogsConfigurationResult.t option
        [@ocaml.doc
          "An object that contains information on the status of DNS logs as a data source."];
      flowLogs: FlowLogsConfigurationResult.t option
        [@ocaml.doc
          "An object that contains information on the status of VPC flow logs as a data source."];
      s3Logs: S3LogsConfigurationResult.t option
        [@ocaml.doc
          "An object that contains information on the status of S3 Data event logs as a data source."];
      kubernetes: KubernetesConfigurationResult.t option
        [@ocaml.doc
          "An object that contains information on the status of all Kubernetes data sources."];
      malwareProtection: MalwareProtectionConfigurationResult.t option
        [@ocaml.doc
          "Describes the configuration of Malware Protection data sources."]}
    let make ?cloudTrail =
      fun ?dNSLogs ->
        fun ?flowLogs ->
          fun ?s3Logs ->
            fun ?kubernetes ->
              fun ?malwareProtection ->
                fun () ->
                  {
                    cloudTrail;
                    dNSLogs;
                    flowLogs;
                    s3Logs;
                    kubernetes;
                    malwareProtection
                  }
    let to_value x =
      structure_to_value
        [("cloudTrail",
           (Option.map x.cloudTrail ~f:CloudTrailConfigurationResult.to_value));
        ("dnsLogs",
          (Option.map x.dNSLogs ~f:DNSLogsConfigurationResult.to_value));
        ("flowLogs",
          (Option.map x.flowLogs ~f:FlowLogsConfigurationResult.to_value));
        ("s3Logs",
          (Option.map x.s3Logs ~f:S3LogsConfigurationResult.to_value));
        ("kubernetes",
          (Option.map x.kubernetes ~f:KubernetesConfigurationResult.to_value));
        ("malwareProtection",
          (Option.map x.malwareProtection
             ~f:MalwareProtectionConfigurationResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtection =
        (Option.map ~f:MalwareProtectionConfigurationResult.of_xml)
          (Xml.child xml_arg0 "malwareProtection") in
      let kubernetes =
        (Option.map ~f:KubernetesConfigurationResult.of_xml)
          (Xml.child xml_arg0 "kubernetes") in
      let s3Logs =
        (Option.map ~f:S3LogsConfigurationResult.of_xml)
          (Xml.child xml_arg0 "s3Logs") in
      let flowLogs =
        (Option.map ~f:FlowLogsConfigurationResult.of_xml)
          (Xml.child xml_arg0 "flowLogs") in
      let dNSLogs =
        (Option.map ~f:DNSLogsConfigurationResult.of_xml)
          (Xml.child xml_arg0 "dnsLogs") in
      let cloudTrail =
        (Option.map ~f:CloudTrailConfigurationResult.of_xml)
          (Xml.child xml_arg0 "cloudTrail") in
      make ?malwareProtection ?kubernetes ?s3Logs ?flowLogs ?dNSLogs
        ?cloudTrail ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtection =
        field_map json__ "MalwareProtection"
          MalwareProtectionConfigurationResult.of_json in
      let kubernetes =
        field_map json__ "Kubernetes" KubernetesConfigurationResult.of_json in
      let s3Logs =
        field_map json__ "S3Logs" S3LogsConfigurationResult.of_json in
      let flowLogs =
        field_map json__ "FlowLogs" FlowLogsConfigurationResult.of_json in
      let dNSLogs =
        field_map json__ "DNSLogs" DNSLogsConfigurationResult.of_json in
      let cloudTrail =
        field_map json__ "CloudTrail" CloudTrailConfigurationResult.of_json in
      make ?malwareProtection ?kubernetes ?s3Logs ?flowLogs ?dNSLogs
        ?cloudTrail ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on the status of data sources for the detector."]
module MemberFeaturesConfigurationsResults =
  struct
    type nonrec t = MemberFeaturesConfigurationResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:MemberFeaturesConfigurationResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:MemberFeaturesConfigurationResult.of_xml)
    let of_json j =
      list_of_json ~kind:"MemberFeaturesConfigurationsResults"
        ~of_json:MemberFeaturesConfigurationResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module ScanResultThreat =
  struct
    type nonrec t =
      {
      name: NonEmptyString.t option
        [@ocaml.doc "The name of the detected threat."];
      source: DetectionSource.t option
        [@ocaml.doc "The source that detected this threat."];
      count: PositiveLong.t option
        [@ocaml.doc
          "The number of instances of this threat that were detected."];
      hash: NonEmptyString.t option
        [@ocaml.doc "The hash value associated with the detected threat."];
      itemDetails: ItemDetailsList.t option
        [@ocaml.doc
          "Additional information about where this threat was detected."]}
    let make ?name =
      fun ?source ->
        fun ?count ->
          fun ?hash ->
            fun ?itemDetails ->
              fun () -> { name; source; count; hash; itemDetails }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:NonEmptyString.to_value));
        ("source", (Option.map x.source ~f:DetectionSource.to_value));
        ("count", (Option.map x.count ~f:PositiveLong.to_value));
        ("hash", (Option.map x.hash ~f:NonEmptyString.to_value));
        ("itemDetails",
          (Option.map x.itemDetails ~f:ItemDetailsList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let itemDetails =
        (Option.map ~f:ItemDetailsList.of_xml)
          (Xml.child xml_arg0 "itemDetails") in
      let hash =
        (Option.map ~f:NonEmptyString.of_xml) (Xml.child xml_arg0 "hash") in
      let count =
        (Option.map ~f:PositiveLong.of_xml) (Xml.child xml_arg0 "count") in
      let source =
        (Option.map ~f:DetectionSource.of_xml) (Xml.child xml_arg0 "source") in
      let name =
        (Option.map ~f:NonEmptyString.of_xml) (Xml.child xml_arg0 "name") in
      make ?itemDetails ?hash ?count ?source ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let itemDetails =
        field_map json__ "ItemDetails" ItemDetailsList.of_json in
      let hash = field_map json__ "Hash" NonEmptyString.of_json in
      let count = field_map json__ "Count" PositiveLong.of_json in
      let source = field_map json__ "Source" DetectionSource.of_json in
      let name = field_map json__ "Name" NonEmptyString.of_json in
      make ?itemDetails ?hash ?count ?source ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about a specific threat that was detected during the malware scan."]
module ScanStatusReason =
  struct
    type nonrec t =
      | ACCESS_DENIED 
      | RESOURCE_NOT_FOUND 
      | SNAPSHOT_SIZE_LIMIT_EXCEEDED 
      | RESOURCE_UNAVAILABLE 
      | INCONSISTENT_SOURCE 
      | INCREMENTAL_NO_DIFFERENCE 
      | NO_EBS_VOLUMES_FOUND 
      | UNSUPPORTED_PRODUCT_CODE_TYPE 
      | AMI_SNAPSHOT_LIMIT_EXCEEDED 
      | UNRELATED_RESOURCES 
      | BASE_RESOURCE_NOT_SCANNED 
      | BASE_CREATED_AFTER_TARGET 
      | UNSUPPORTED_FOR_INCREMENTAL 
      | UNSUPPORTED_AMI 
      | UNSUPPORTED_SNAPSHOT 
      | UNSUPPORTED_COMPOSITE_RECOVERY_POINT 
      | ALL_FILES_SKIPPED_OR_FAILED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ACCESS_DENIED -> "ACCESS_DENIED"
      | RESOURCE_NOT_FOUND -> "RESOURCE_NOT_FOUND"
      | SNAPSHOT_SIZE_LIMIT_EXCEEDED -> "SNAPSHOT_SIZE_LIMIT_EXCEEDED"
      | RESOURCE_UNAVAILABLE -> "RESOURCE_UNAVAILABLE"
      | INCONSISTENT_SOURCE -> "INCONSISTENT_SOURCE"
      | INCREMENTAL_NO_DIFFERENCE -> "INCREMENTAL_NO_DIFFERENCE"
      | NO_EBS_VOLUMES_FOUND -> "NO_EBS_VOLUMES_FOUND"
      | UNSUPPORTED_PRODUCT_CODE_TYPE -> "UNSUPPORTED_PRODUCT_CODE_TYPE"
      | AMI_SNAPSHOT_LIMIT_EXCEEDED -> "AMI_SNAPSHOT_LIMIT_EXCEEDED"
      | UNRELATED_RESOURCES -> "UNRELATED_RESOURCES"
      | BASE_RESOURCE_NOT_SCANNED -> "BASE_RESOURCE_NOT_SCANNED"
      | BASE_CREATED_AFTER_TARGET -> "BASE_CREATED_AFTER_TARGET"
      | UNSUPPORTED_FOR_INCREMENTAL -> "UNSUPPORTED_FOR_INCREMENTAL"
      | UNSUPPORTED_AMI -> "UNSUPPORTED_AMI"
      | UNSUPPORTED_SNAPSHOT -> "UNSUPPORTED_SNAPSHOT"
      | UNSUPPORTED_COMPOSITE_RECOVERY_POINT ->
          "UNSUPPORTED_COMPOSITE_RECOVERY_POINT"
      | ALL_FILES_SKIPPED_OR_FAILED -> "ALL_FILES_SKIPPED_OR_FAILED"
      | Non_static_id s -> s
    let of_string =
      function
      | "ACCESS_DENIED" -> ACCESS_DENIED
      | "RESOURCE_NOT_FOUND" -> RESOURCE_NOT_FOUND
      | "SNAPSHOT_SIZE_LIMIT_EXCEEDED" -> SNAPSHOT_SIZE_LIMIT_EXCEEDED
      | "RESOURCE_UNAVAILABLE" -> RESOURCE_UNAVAILABLE
      | "INCONSISTENT_SOURCE" -> INCONSISTENT_SOURCE
      | "INCREMENTAL_NO_DIFFERENCE" -> INCREMENTAL_NO_DIFFERENCE
      | "NO_EBS_VOLUMES_FOUND" -> NO_EBS_VOLUMES_FOUND
      | "UNSUPPORTED_PRODUCT_CODE_TYPE" -> UNSUPPORTED_PRODUCT_CODE_TYPE
      | "AMI_SNAPSHOT_LIMIT_EXCEEDED" -> AMI_SNAPSHOT_LIMIT_EXCEEDED
      | "UNRELATED_RESOURCES" -> UNRELATED_RESOURCES
      | "BASE_RESOURCE_NOT_SCANNED" -> BASE_RESOURCE_NOT_SCANNED
      | "BASE_CREATED_AFTER_TARGET" -> BASE_CREATED_AFTER_TARGET
      | "UNSUPPORTED_FOR_INCREMENTAL" -> UNSUPPORTED_FOR_INCREMENTAL
      | "UNSUPPORTED_AMI" -> UNSUPPORTED_AMI
      | "UNSUPPORTED_SNAPSHOT" -> UNSUPPORTED_SNAPSHOT
      | "UNSUPPORTED_COMPOSITE_RECOVERY_POINT" ->
          UNSUPPORTED_COMPOSITE_RECOVERY_POINT
      | "ALL_FILES_SKIPPED_OR_FAILED" -> ALL_FILES_SKIPPED_OR_FAILED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ScanStatusReason" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ScanStatusReason" j)
    let to_json = simple_to_json to_value
  end
module ScannedResourceDetails =
  struct
    type nonrec t =
      {
      ebsVolume: VolumeDetail.t option
        [@ocaml.doc
          "Contains information about the EBS volume that was scanned."];
      ebsSnapshot: EbsSnapshot.t option
        [@ocaml.doc
          "Contains information about the EBS snapshot that was scanned."]}
    let make ?ebsVolume =
      fun ?ebsSnapshot -> fun () -> { ebsVolume; ebsSnapshot }
    let to_value x =
      structure_to_value
        [("ebsVolume", (Option.map x.ebsVolume ~f:VolumeDetail.to_value));
        ("ebsSnapshot", (Option.map x.ebsSnapshot ~f:EbsSnapshot.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ebsSnapshot =
        (Option.map ~f:EbsSnapshot.of_xml) (Xml.child xml_arg0 "ebsSnapshot") in
      let ebsVolume =
        (Option.map ~f:VolumeDetail.of_xml) (Xml.child xml_arg0 "ebsVolume") in
      make ?ebsSnapshot ?ebsVolume ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ebsSnapshot = field_map json__ "EbsSnapshot" EbsSnapshot.of_json in
      let ebsVolume = field_map json__ "EbsVolume" VolumeDetail.of_json in
      make ?ebsSnapshot ?ebsVolume ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains additional information about a resource that was scanned."]
module AccountStatistics =
  struct
    type nonrec t =
      {
      accountId: String_.t option
        [@ocaml.doc "The ID of the Amazon Web Services account."];
      lastGeneratedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the finding for this account was last generated."];
      totalFindings: Integer.t option
        [@ocaml.doc
          "The total number of findings associated with an account."]}
    let make ?accountId =
      fun ?lastGeneratedAt ->
        fun ?totalFindings ->
          fun () -> { accountId; lastGeneratedAt; totalFindings }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:String_.to_value));
        ("lastGeneratedAt",
          (Option.map x.lastGeneratedAt ~f:Timestamp.to_value));
        ("totalFindings", (Option.map x.totalFindings ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let totalFindings =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "totalFindings") in
      let lastGeneratedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "lastGeneratedAt") in
      let accountId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?totalFindings ?lastGeneratedAt ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let totalFindings = field_map json__ "TotalFindings" Integer.of_json in
      let lastGeneratedAt =
        field_map json__ "LastGeneratedAt" Timestamp.of_json in
      let accountId = field_map json__ "AccountId" String_.of_json in
      make ?totalFindings ?lastGeneratedAt ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents a list of map of accounts with the number of findings associated with each account."]
module DateStatistics =
  struct
    type nonrec t =
      {
      date: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the total findings count is observed. For example, Date would look like \"2024-09-05T17:00:00-07:00\" whereas LastGeneratedAt would look like 2024-09-05T17:12:29-07:00\"."];
      lastGeneratedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the last finding in the findings count, was generated."];
      severity: Double.t option
        [@ocaml.doc "The severity of the findings generated on each date."];
      totalFindings: Integer.t option
        [@ocaml.doc
          "The total number of findings that were generated per severity level on each date."]}
    let make ?date =
      fun ?lastGeneratedAt ->
        fun ?severity ->
          fun ?totalFindings ->
            fun () -> { date; lastGeneratedAt; severity; totalFindings }
    let to_value x =
      structure_to_value
        [("date", (Option.map x.date ~f:Timestamp.to_value));
        ("lastGeneratedAt",
          (Option.map x.lastGeneratedAt ~f:Timestamp.to_value));
        ("severity", (Option.map x.severity ~f:Double.to_value));
        ("totalFindings", (Option.map x.totalFindings ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let totalFindings =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "totalFindings") in
      let severity =
        (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "severity") in
      let lastGeneratedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "lastGeneratedAt") in
      let date = (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "date") in
      make ?totalFindings ?severity ?lastGeneratedAt ?date ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let totalFindings = field_map json__ "TotalFindings" Integer.of_json in
      let severity = field_map json__ "Severity" Double.of_json in
      let lastGeneratedAt =
        field_map json__ "LastGeneratedAt" Timestamp.of_json in
      let date = field_map json__ "Date" Timestamp.of_json in
      make ?totalFindings ?severity ?lastGeneratedAt ?date ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents list a map of dates with a count of total findings generated on each date."]
module FindingTypeStatistics =
  struct
    type nonrec t =
      {
      findingType: String_.t option [@ocaml.doc "Name of the finding type."];
      lastGeneratedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which this finding type was last generated in your environment."];
      totalFindings: Integer.t option
        [@ocaml.doc
          "The total number of findings associated with generated for each distinct finding type."]}
    let make ?findingType =
      fun ?lastGeneratedAt ->
        fun ?totalFindings ->
          fun () -> { findingType; lastGeneratedAt; totalFindings }
    let to_value x =
      structure_to_value
        [("findingType", (Option.map x.findingType ~f:String_.to_value));
        ("lastGeneratedAt",
          (Option.map x.lastGeneratedAt ~f:Timestamp.to_value));
        ("totalFindings", (Option.map x.totalFindings ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let totalFindings =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "totalFindings") in
      let lastGeneratedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "lastGeneratedAt") in
      let findingType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "findingType") in
      make ?totalFindings ?lastGeneratedAt ?findingType ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let totalFindings = field_map json__ "TotalFindings" Integer.of_json in
      let lastGeneratedAt =
        field_map json__ "LastGeneratedAt" Timestamp.of_json in
      let findingType = field_map json__ "FindingType" String_.of_json in
      make ?totalFindings ?lastGeneratedAt ?findingType ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about each finding type associated with the groupedByFindingType statistics."]
module ResourceStatistics =
  struct
    type nonrec t =
      {
      accountId: String_.t option
        [@ocaml.doc "The ID of the Amazon Web Services account."];
      lastGeneratedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the statistics for this resource was last generated."];
      resourceId: String_.t option
        [@ocaml.doc
          "ID associated with each resource. The following list provides the mapping of the resource type and resource ID. Mapping of resource and resource ID AccessKey - resource.accessKeyDetails.accessKeyId Container - resource.containerDetails.id ECSCluster - resource.ecsClusterDetails.name EKSCluster - resource.eksClusterDetails.name Instance - resource.instanceDetails.instanceId KubernetesCluster - resource.kubernetesDetails.kubernetesWorkloadDetails.name Lambda - resource.lambdaDetails.functionName RDSDBInstance - resource.rdsDbInstanceDetails.dbInstanceIdentifier S3Bucket - resource.s3BucketDetails.name S3Object - resource.s3BucketDetails.name"];
      resourceType: String_.t option [@ocaml.doc "The type of resource."];
      totalFindings: Integer.t option
        [@ocaml.doc
          "The total number of findings associated with this resource."]}
    let make ?accountId =
      fun ?lastGeneratedAt ->
        fun ?resourceId ->
          fun ?resourceType ->
            fun ?totalFindings ->
              fun () ->
                {
                  accountId;
                  lastGeneratedAt;
                  resourceId;
                  resourceType;
                  totalFindings
                }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:String_.to_value));
        ("lastGeneratedAt",
          (Option.map x.lastGeneratedAt ~f:Timestamp.to_value));
        ("resourceId", (Option.map x.resourceId ~f:String_.to_value));
        ("resourceType", (Option.map x.resourceType ~f:String_.to_value));
        ("totalFindings", (Option.map x.totalFindings ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let totalFindings =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "totalFindings") in
      let resourceType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resourceType") in
      let resourceId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resourceId") in
      let lastGeneratedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "lastGeneratedAt") in
      let accountId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?totalFindings ?resourceType ?resourceId ?lastGeneratedAt
        ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let totalFindings = field_map json__ "TotalFindings" Integer.of_json in
      let resourceType = field_map json__ "ResourceType" String_.of_json in
      let resourceId = field_map json__ "ResourceId" String_.of_json in
      let lastGeneratedAt =
        field_map json__ "LastGeneratedAt" Timestamp.of_json in
      let accountId = field_map json__ "AccountId" String_.of_json in
      make ?totalFindings ?resourceType ?resourceId ?lastGeneratedAt
        ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about each resource type associated with the groupedByResource statistics."]
module SeverityStatistics =
  struct
    type nonrec t =
      {
      lastGeneratedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which a finding type for a specific severity was last generated."];
      severity: Double.t option
        [@ocaml.doc "The severity level associated with each finding type."];
      totalFindings: Integer.t option
        [@ocaml.doc
          "The total number of findings associated with this severity."]}
    let make ?lastGeneratedAt =
      fun ?severity ->
        fun ?totalFindings ->
          fun () -> { lastGeneratedAt; severity; totalFindings }
    let to_value x =
      structure_to_value
        [("lastGeneratedAt",
           (Option.map x.lastGeneratedAt ~f:Timestamp.to_value));
        ("severity", (Option.map x.severity ~f:Double.to_value));
        ("totalFindings", (Option.map x.totalFindings ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let totalFindings =
        (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "totalFindings") in
      let severity =
        (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "severity") in
      let lastGeneratedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "lastGeneratedAt") in
      make ?totalFindings ?severity ?lastGeneratedAt ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let totalFindings = field_map json__ "TotalFindings" Integer.of_json in
      let severity = field_map json__ "Severity" Double.of_json in
      let lastGeneratedAt =
        field_map json__ "LastGeneratedAt" Timestamp.of_json in
      make ?totalFindings ?severity ?lastGeneratedAt ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about severity level for each finding type."]
module Resource =
  struct
    type nonrec t =
      {
      accessKeyDetails: AccessKeyDetails.t option
        [@ocaml.doc
          "The IAM access key details (user information) of a user that engaged in the activity that prompted GuardDuty to generate a finding."];
      s3BucketDetails: S3BucketDetails.t option
        [@ocaml.doc "Contains information on the S3 bucket."];
      instanceDetails: InstanceDetails.t option
        [@ocaml.doc
          "The information about the EC2 instance associated with the activity that prompted GuardDuty to generate a finding."];
      eksClusterDetails: EksClusterDetails.t option
        [@ocaml.doc
          "Details about the EKS cluster involved in a Kubernetes finding."];
      kubernetesDetails: KubernetesDetails.t option
        [@ocaml.doc
          "Details about the Kubernetes user and workload involved in a Kubernetes finding."];
      resourceType: String_.t option
        [@ocaml.doc "The type of Amazon Web Services resource."];
      ebsVolumeDetails: EbsVolumeDetails.t option
        [@ocaml.doc
          "Contains list of scanned and skipped EBS volumes with details."];
      ecsClusterDetails: EcsClusterDetails.t option
        [@ocaml.doc
          "Contains information about the details of the ECS Cluster."];
      containerDetails: Container.t option ;
      lambdaDetails: LambdaDetails.t option
        [@ocaml.doc
          "Contains information about the Lambda function that was involved in a finding."];
      rdsDbInstanceDetails: RdsDbInstanceDetails.t option
        [@ocaml.doc
          "Contains information about the database instance to which an anomalous login attempt was made."];
      rdsLimitlessDbDetails: RdsLimitlessDbDetails.t option
        [@ocaml.doc
          "Contains information about the RDS Limitless database that was involved in a GuardDuty finding."];
      rdsDbUserDetails: RdsDbUserDetails.t option
        [@ocaml.doc
          "Contains information about the user details through which anomalous login attempt was made."];
      ebsSnapshotDetails: EbsSnapshotDetails.t option
        [@ocaml.doc
          "Contains details about the EBS snapshot that was scanned."];
      ec2ImageDetails: Ec2ImageDetails.t option
        [@ocaml.doc "Contains details about the EC2 image that was scanned."];
      recoveryPointDetails: RecoveryPointDetails.t option
        [@ocaml.doc
          "Contains details about the backup recovery point that was scanned."]}
    let make ?accessKeyDetails =
      fun ?s3BucketDetails ->
        fun ?instanceDetails ->
          fun ?eksClusterDetails ->
            fun ?kubernetesDetails ->
              fun ?resourceType ->
                fun ?ebsVolumeDetails ->
                  fun ?ecsClusterDetails ->
                    fun ?containerDetails ->
                      fun ?lambdaDetails ->
                        fun ?rdsDbInstanceDetails ->
                          fun ?rdsLimitlessDbDetails ->
                            fun ?rdsDbUserDetails ->
                              fun ?ebsSnapshotDetails ->
                                fun ?ec2ImageDetails ->
                                  fun ?recoveryPointDetails ->
                                    fun () ->
                                      {
                                        accessKeyDetails;
                                        s3BucketDetails;
                                        instanceDetails;
                                        eksClusterDetails;
                                        kubernetesDetails;
                                        resourceType;
                                        ebsVolumeDetails;
                                        ecsClusterDetails;
                                        containerDetails;
                                        lambdaDetails;
                                        rdsDbInstanceDetails;
                                        rdsLimitlessDbDetails;
                                        rdsDbUserDetails;
                                        ebsSnapshotDetails;
                                        ec2ImageDetails;
                                        recoveryPointDetails
                                      }
    let to_value x =
      structure_to_value
        [("accessKeyDetails",
           (Option.map x.accessKeyDetails ~f:AccessKeyDetails.to_value));
        ("s3BucketDetails",
          (Option.map x.s3BucketDetails ~f:S3BucketDetails.to_value));
        ("instanceDetails",
          (Option.map x.instanceDetails ~f:InstanceDetails.to_value));
        ("eksClusterDetails",
          (Option.map x.eksClusterDetails ~f:EksClusterDetails.to_value));
        ("kubernetesDetails",
          (Option.map x.kubernetesDetails ~f:KubernetesDetails.to_value));
        ("resourceType", (Option.map x.resourceType ~f:String_.to_value));
        ("ebsVolumeDetails",
          (Option.map x.ebsVolumeDetails ~f:EbsVolumeDetails.to_value));
        ("ecsClusterDetails",
          (Option.map x.ecsClusterDetails ~f:EcsClusterDetails.to_value));
        ("containerDetails",
          (Option.map x.containerDetails ~f:Container.to_value));
        ("lambdaDetails",
          (Option.map x.lambdaDetails ~f:LambdaDetails.to_value));
        ("rdsDbInstanceDetails",
          (Option.map x.rdsDbInstanceDetails ~f:RdsDbInstanceDetails.to_value));
        ("rdsLimitlessDbDetails",
          (Option.map x.rdsLimitlessDbDetails
             ~f:RdsLimitlessDbDetails.to_value));
        ("rdsDbUserDetails",
          (Option.map x.rdsDbUserDetails ~f:RdsDbUserDetails.to_value));
        ("ebsSnapshotDetails",
          (Option.map x.ebsSnapshotDetails ~f:EbsSnapshotDetails.to_value));
        ("ec2ImageDetails",
          (Option.map x.ec2ImageDetails ~f:Ec2ImageDetails.to_value));
        ("recoveryPointDetails",
          (Option.map x.recoveryPointDetails ~f:RecoveryPointDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let recoveryPointDetails =
        (Option.map ~f:RecoveryPointDetails.of_xml)
          (Xml.child xml_arg0 "recoveryPointDetails") in
      let ec2ImageDetails =
        (Option.map ~f:Ec2ImageDetails.of_xml)
          (Xml.child xml_arg0 "ec2ImageDetails") in
      let ebsSnapshotDetails =
        (Option.map ~f:EbsSnapshotDetails.of_xml)
          (Xml.child xml_arg0 "ebsSnapshotDetails") in
      let rdsDbUserDetails =
        (Option.map ~f:RdsDbUserDetails.of_xml)
          (Xml.child xml_arg0 "rdsDbUserDetails") in
      let rdsLimitlessDbDetails =
        (Option.map ~f:RdsLimitlessDbDetails.of_xml)
          (Xml.child xml_arg0 "rdsLimitlessDbDetails") in
      let rdsDbInstanceDetails =
        (Option.map ~f:RdsDbInstanceDetails.of_xml)
          (Xml.child xml_arg0 "rdsDbInstanceDetails") in
      let lambdaDetails =
        (Option.map ~f:LambdaDetails.of_xml)
          (Xml.child xml_arg0 "lambdaDetails") in
      let containerDetails =
        (Option.map ~f:Container.of_xml)
          (Xml.child xml_arg0 "containerDetails") in
      let ecsClusterDetails =
        (Option.map ~f:EcsClusterDetails.of_xml)
          (Xml.child xml_arg0 "ecsClusterDetails") in
      let ebsVolumeDetails =
        (Option.map ~f:EbsVolumeDetails.of_xml)
          (Xml.child xml_arg0 "ebsVolumeDetails") in
      let resourceType =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resourceType") in
      let kubernetesDetails =
        (Option.map ~f:KubernetesDetails.of_xml)
          (Xml.child xml_arg0 "kubernetesDetails") in
      let eksClusterDetails =
        (Option.map ~f:EksClusterDetails.of_xml)
          (Xml.child xml_arg0 "eksClusterDetails") in
      let instanceDetails =
        (Option.map ~f:InstanceDetails.of_xml)
          (Xml.child xml_arg0 "instanceDetails") in
      let s3BucketDetails =
        (Option.map ~f:S3BucketDetails.of_xml)
          (Xml.child xml_arg0 "s3BucketDetails") in
      let accessKeyDetails =
        (Option.map ~f:AccessKeyDetails.of_xml)
          (Xml.child xml_arg0 "accessKeyDetails") in
      make ?recoveryPointDetails ?ec2ImageDetails ?ebsSnapshotDetails
        ?rdsDbUserDetails ?rdsLimitlessDbDetails ?rdsDbInstanceDetails
        ?lambdaDetails ?containerDetails ?ecsClusterDetails ?ebsVolumeDetails
        ?resourceType ?kubernetesDetails ?eksClusterDetails ?instanceDetails
        ?s3BucketDetails ?accessKeyDetails ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let recoveryPointDetails =
        field_map json__ "RecoveryPointDetails" RecoveryPointDetails.of_json in
      let ec2ImageDetails =
        field_map json__ "Ec2ImageDetails" Ec2ImageDetails.of_json in
      let ebsSnapshotDetails =
        field_map json__ "EbsSnapshotDetails" EbsSnapshotDetails.of_json in
      let rdsDbUserDetails =
        field_map json__ "RdsDbUserDetails" RdsDbUserDetails.of_json in
      let rdsLimitlessDbDetails =
        field_map json__ "RdsLimitlessDbDetails"
          RdsLimitlessDbDetails.of_json in
      let rdsDbInstanceDetails =
        field_map json__ "RdsDbInstanceDetails" RdsDbInstanceDetails.of_json in
      let lambdaDetails =
        field_map json__ "LambdaDetails" LambdaDetails.of_json in
      let containerDetails =
        field_map json__ "ContainerDetails" Container.of_json in
      let ecsClusterDetails =
        field_map json__ "EcsClusterDetails" EcsClusterDetails.of_json in
      let ebsVolumeDetails =
        field_map json__ "EbsVolumeDetails" EbsVolumeDetails.of_json in
      let resourceType = field_map json__ "ResourceType" String_.of_json in
      let kubernetesDetails =
        field_map json__ "KubernetesDetails" KubernetesDetails.of_json in
      let eksClusterDetails =
        field_map json__ "EksClusterDetails" EksClusterDetails.of_json in
      let instanceDetails =
        field_map json__ "InstanceDetails" InstanceDetails.of_json in
      let s3BucketDetails =
        field_map json__ "S3BucketDetails" S3BucketDetails.of_json in
      let accessKeyDetails =
        field_map json__ "AccessKeyDetails" AccessKeyDetails.of_json in
      make ?recoveryPointDetails ?ec2ImageDetails ?ebsSnapshotDetails
        ?rdsDbUserDetails ?rdsLimitlessDbDetails ?rdsDbInstanceDetails
        ?lambdaDetails ?containerDetails ?ecsClusterDetails ?ebsVolumeDetails
        ?resourceType ?kubernetesDetails ?eksClusterDetails ?instanceDetails
        ?s3BucketDetails ?accessKeyDetails ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding."]
module Service =
  struct
    type nonrec t =
      {
      action: Action.t option
        [@ocaml.doc
          "Information about the activity that is described in a finding."];
      evidence: Evidence.t option
        [@ocaml.doc "An evidence object associated with the service."];
      archived: Boolean.t option
        [@ocaml.doc "Indicates whether this finding is archived."];
      count: Integer.t option
        [@ocaml.doc
          "The total count of the occurrences of this finding type."];
      detectorId: DetectorId.t option
        [@ocaml.doc "The detector ID for the GuardDuty service."];
      eventFirstSeen: String_.t option
        [@ocaml.doc
          "The first-seen timestamp of the activity that prompted GuardDuty to generate this finding."];
      eventLastSeen: String_.t option
        [@ocaml.doc
          "The last-seen timestamp of the activity that prompted GuardDuty to generate this finding."];
      resourceRole: String_.t option
        [@ocaml.doc "The resource role information for this finding."];
      serviceName: String_.t option
        [@ocaml.doc
          "The name of the Amazon Web Services service (GuardDuty) that generated a finding."];
      userFeedback: String_.t option
        [@ocaml.doc "Feedback that was submitted about the finding."];
      additionalInfo: ServiceAdditionalInfo.t option
        [@ocaml.doc
          "Contains additional information about the generated finding."];
      featureName: String_.t option
        [@ocaml.doc "The name of the feature that generated a finding."];
      ebsVolumeScanDetails: EbsVolumeScanDetails.t option
        [@ocaml.doc
          "Returns details from the malware scan that created a finding."];
      runtimeDetails: RuntimeDetails.t option
        [@ocaml.doc
          "Information about the process and any required context values for a specific finding"];
      detection: Detection.t option
        [@ocaml.doc
          "Contains information about the detected unusual behavior."];
      malwareScanDetails: MalwareScanDetails.t option
        [@ocaml.doc
          "Returns details from the malware scan that generated a GuardDuty finding."]}
    let make ?action =
      fun ?evidence ->
        fun ?archived ->
          fun ?count ->
            fun ?detectorId ->
              fun ?eventFirstSeen ->
                fun ?eventLastSeen ->
                  fun ?resourceRole ->
                    fun ?serviceName ->
                      fun ?userFeedback ->
                        fun ?additionalInfo ->
                          fun ?featureName ->
                            fun ?ebsVolumeScanDetails ->
                              fun ?runtimeDetails ->
                                fun ?detection ->
                                  fun ?malwareScanDetails ->
                                    fun () ->
                                      {
                                        action;
                                        evidence;
                                        archived;
                                        count;
                                        detectorId;
                                        eventFirstSeen;
                                        eventLastSeen;
                                        resourceRole;
                                        serviceName;
                                        userFeedback;
                                        additionalInfo;
                                        featureName;
                                        ebsVolumeScanDetails;
                                        runtimeDetails;
                                        detection;
                                        malwareScanDetails
                                      }
    let to_value x =
      structure_to_value
        [("action", (Option.map x.action ~f:Action.to_value));
        ("evidence", (Option.map x.evidence ~f:Evidence.to_value));
        ("archived", (Option.map x.archived ~f:Boolean.to_value));
        ("count", (Option.map x.count ~f:Integer.to_value));
        ("detectorId", (Option.map x.detectorId ~f:DetectorId.to_value));
        ("eventFirstSeen", (Option.map x.eventFirstSeen ~f:String_.to_value));
        ("eventLastSeen", (Option.map x.eventLastSeen ~f:String_.to_value));
        ("resourceRole", (Option.map x.resourceRole ~f:String_.to_value));
        ("serviceName", (Option.map x.serviceName ~f:String_.to_value));
        ("userFeedback", (Option.map x.userFeedback ~f:String_.to_value));
        ("additionalInfo",
          (Option.map x.additionalInfo ~f:ServiceAdditionalInfo.to_value));
        ("featureName", (Option.map x.featureName ~f:String_.to_value));
        ("ebsVolumeScanDetails",
          (Option.map x.ebsVolumeScanDetails ~f:EbsVolumeScanDetails.to_value));
        ("runtimeDetails",
          (Option.map x.runtimeDetails ~f:RuntimeDetails.to_value));
        ("detection", (Option.map x.detection ~f:Detection.to_value));
        ("malwareScanDetails",
          (Option.map x.malwareScanDetails ~f:MalwareScanDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareScanDetails =
        (Option.map ~f:MalwareScanDetails.of_xml)
          (Xml.child xml_arg0 "malwareScanDetails") in
      let detection =
        (Option.map ~f:Detection.of_xml) (Xml.child xml_arg0 "detection") in
      let runtimeDetails =
        (Option.map ~f:RuntimeDetails.of_xml)
          (Xml.child xml_arg0 "runtimeDetails") in
      let ebsVolumeScanDetails =
        (Option.map ~f:EbsVolumeScanDetails.of_xml)
          (Xml.child xml_arg0 "ebsVolumeScanDetails") in
      let featureName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "featureName") in
      let additionalInfo =
        (Option.map ~f:ServiceAdditionalInfo.of_xml)
          (Xml.child xml_arg0 "additionalInfo") in
      let userFeedback =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "userFeedback") in
      let serviceName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "serviceName") in
      let resourceRole =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resourceRole") in
      let eventLastSeen =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "eventLastSeen") in
      let eventFirstSeen =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "eventFirstSeen") in
      let detectorId =
        (Option.map ~f:DetectorId.of_xml) (Xml.child xml_arg0 "detectorId") in
      let count = (Option.map ~f:Integer.of_xml) (Xml.child xml_arg0 "count") in
      let archived =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "archived") in
      let evidence =
        (Option.map ~f:Evidence.of_xml) (Xml.child xml_arg0 "evidence") in
      let action =
        (Option.map ~f:Action.of_xml) (Xml.child xml_arg0 "action") in
      make ?malwareScanDetails ?detection ?runtimeDetails
        ?ebsVolumeScanDetails ?featureName ?additionalInfo ?userFeedback
        ?serviceName ?resourceRole ?eventLastSeen ?eventFirstSeen ?detectorId
        ?count ?archived ?evidence ?action ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareScanDetails =
        field_map json__ "MalwareScanDetails" MalwareScanDetails.of_json in
      let detection = field_map json__ "Detection" Detection.of_json in
      let runtimeDetails =
        field_map json__ "RuntimeDetails" RuntimeDetails.of_json in
      let ebsVolumeScanDetails =
        field_map json__ "EbsVolumeScanDetails" EbsVolumeScanDetails.of_json in
      let featureName = field_map json__ "FeatureName" String_.of_json in
      let additionalInfo =
        field_map json__ "AdditionalInfo" ServiceAdditionalInfo.of_json in
      let userFeedback = field_map json__ "UserFeedback" String_.of_json in
      let serviceName = field_map json__ "ServiceName" String_.of_json in
      let resourceRole = field_map json__ "ResourceRole" String_.of_json in
      let eventLastSeen = field_map json__ "EventLastSeen" String_.of_json in
      let eventFirstSeen = field_map json__ "EventFirstSeen" String_.of_json in
      let detectorId = field_map json__ "DetectorId" DetectorId.of_json in
      let count = field_map json__ "Count" Integer.of_json in
      let archived = field_map json__ "Archived" Boolean.of_json in
      let evidence = field_map json__ "Evidence" Evidence.of_json in
      let action = field_map json__ "Action" Action.of_json in
      make ?malwareScanDetails ?detection ?runtimeDetails
        ?ebsVolumeScanDetails ?featureName ?additionalInfo ?userFeedback
        ?serviceName ?resourceRole ?eventLastSeen ?eventFirstSeen ?detectorId
        ?count ?archived ?evidence ?action ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains additional information about the generated finding."]
module DetectorAdditionalConfigurationResults =
  struct
    type nonrec t = DetectorAdditionalConfigurationResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:DetectorAdditionalConfigurationResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:DetectorAdditionalConfigurationResult.of_xml)
    let of_json j =
      list_of_json ~kind:"DetectorAdditionalConfigurationResults"
        ~of_json:DetectorAdditionalConfigurationResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module DetectorFeatureResult =
  struct
    type nonrec t =
      | FLOW_LOGS 
      | CLOUD_TRAIL 
      | DNS_LOGS 
      | S3_DATA_EVENTS 
      | EKS_AUDIT_LOGS 
      | EBS_MALWARE_PROTECTION 
      | RDS_LOGIN_EVENTS 
      | LAMBDA_NETWORK_LOGS 
      | EKS_RUNTIME_MONITORING 
      | RUNTIME_MONITORING 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | FLOW_LOGS -> "FLOW_LOGS"
      | CLOUD_TRAIL -> "CLOUD_TRAIL"
      | DNS_LOGS -> "DNS_LOGS"
      | S3_DATA_EVENTS -> "S3_DATA_EVENTS"
      | EKS_AUDIT_LOGS -> "EKS_AUDIT_LOGS"
      | EBS_MALWARE_PROTECTION -> "EBS_MALWARE_PROTECTION"
      | RDS_LOGIN_EVENTS -> "RDS_LOGIN_EVENTS"
      | LAMBDA_NETWORK_LOGS -> "LAMBDA_NETWORK_LOGS"
      | EKS_RUNTIME_MONITORING -> "EKS_RUNTIME_MONITORING"
      | RUNTIME_MONITORING -> "RUNTIME_MONITORING"
      | Non_static_id s -> s
    let of_string =
      function
      | "FLOW_LOGS" -> FLOW_LOGS
      | "CLOUD_TRAIL" -> CLOUD_TRAIL
      | "DNS_LOGS" -> DNS_LOGS
      | "S3_DATA_EVENTS" -> S3_DATA_EVENTS
      | "EKS_AUDIT_LOGS" -> EKS_AUDIT_LOGS
      | "EBS_MALWARE_PROTECTION" -> EBS_MALWARE_PROTECTION
      | "RDS_LOGIN_EVENTS" -> RDS_LOGIN_EVENTS
      | "LAMBDA_NETWORK_LOGS" -> LAMBDA_NETWORK_LOGS
      | "EKS_RUNTIME_MONITORING" -> EKS_RUNTIME_MONITORING
      | "RUNTIME_MONITORING" -> RUNTIME_MONITORING
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration DetectorFeatureResult" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"DetectorFeatureResult" j)
    let to_json = simple_to_json to_value
  end
module OrganizationKubernetesAuditLogsConfigurationResult =
  struct
    type nonrec t =
      {
      autoEnable: Boolean.t option
        [@ocaml.doc
          "Whether Kubernetes audit logs data source should be auto-enabled for new members joining the organization."]}
    let make ?autoEnable = fun () -> { autoEnable }
    let to_value x =
      structure_to_value
        [("autoEnable", (Option.map x.autoEnable ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnable =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "autoEnable") in
      make ?autoEnable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnable = field_map json__ "AutoEnable" Boolean.of_json in
      make ?autoEnable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "The current configuration of Kubernetes audit logs as a data source for the organization."]
module OrganizationScanEc2InstanceWithFindingsResult =
  struct
    type nonrec t =
      {
      ebsVolumes: OrganizationEbsVolumesResult.t option
        [@ocaml.doc
          "Describes the configuration for scanning EBS volumes for an organization."]}
    let make ?ebsVolumes = fun () -> { ebsVolumes }
    let to_value x =
      structure_to_value
        [("ebsVolumes",
           (Option.map x.ebsVolumes ~f:OrganizationEbsVolumesResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ebsVolumes =
        (Option.map ~f:OrganizationEbsVolumesResult.of_xml)
          (Xml.child xml_arg0 "ebsVolumes") in
      make ?ebsVolumes ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ebsVolumes =
        field_map json__ "EbsVolumes" OrganizationEbsVolumesResult.of_json in
      make ?ebsVolumes ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "An object that contains information on the status of scanning EC2 instances with findings for an organization."]
module OrganizationAdditionalConfigurationResults =
  struct
    type nonrec t = OrganizationAdditionalConfigurationResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:OrganizationAdditionalConfigurationResult.to_value))
        |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:OrganizationAdditionalConfigurationResult.of_xml)
    let of_json j =
      list_of_json ~kind:"OrganizationAdditionalConfigurationResults"
        ~of_json:OrganizationAdditionalConfigurationResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module ResourceDetails =
  struct
    type nonrec t =
      {
      instanceArn: InstanceArn.t option
        [@ocaml.doc "Instance ARN that was scanned in the scan entry."]}
    let make ?instanceArn = fun () -> { instanceArn }
    let to_value x =
      structure_to_value
        [("instanceArn", (Option.map x.instanceArn ~f:InstanceArn.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let instanceArn =
        (Option.map ~f:InstanceArn.of_xml) (Xml.child xml_arg0 "instanceArn") in
      make ?instanceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let instanceArn = field_map json__ "InstanceArn" InstanceArn.of_json in
      make ?instanceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents the resources that were scanned in the scan entry."]
module ScanResultDetails =
  struct
    type nonrec t =
      {
      scanResult: ScanResult.t option
        [@ocaml.doc "An enum value representing possible scan results."]}
    let make ?scanResult = fun () -> { scanResult }
    let to_value x =
      structure_to_value
        [("scanResult", (Option.map x.scanResult ~f:ScanResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanResult =
        (Option.map ~f:ScanResult.of_xml) (Xml.child xml_arg0 "scanResult") in
      make ?scanResult ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanResult = field_map json__ "ScanResult" ScanResult.of_json in
      make ?scanResult ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Represents the result of the scan."]
module ScanStatus =
  struct
    type nonrec t =
      | RUNNING 
      | COMPLETED 
      | FAILED 
      | SKIPPED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | RUNNING -> "RUNNING"
      | COMPLETED -> "COMPLETED"
      | FAILED -> "FAILED"
      | SKIPPED -> "SKIPPED"
      | Non_static_id s -> s
    let of_string =
      function
      | "RUNNING" -> RUNNING
      | "COMPLETED" -> COMPLETED
      | "FAILED" -> FAILED
      | "SKIPPED" -> SKIPPED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration ScanStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ScanStatus" j)
    let to_json = simple_to_json to_value
  end
module TriggerDetails =
  struct
    type nonrec t =
      {
      guardDutyFindingId: NonEmptyString.t option
        [@ocaml.doc
          "The ID of the GuardDuty finding that triggered the malware scan."];
      description: NonEmptyString.t option
        [@ocaml.doc "The description of the scan trigger."];
      triggerType: TriggerType.t option
        [@ocaml.doc
          "Specifies the trigger type that started the malware scan."]}
    let make ?guardDutyFindingId =
      fun ?description ->
        fun ?triggerType ->
          fun () -> { guardDutyFindingId; description; triggerType }
    let to_value x =
      structure_to_value
        [("guardDutyFindingId",
           (Option.map x.guardDutyFindingId ~f:NonEmptyString.to_value));
        ("description",
          (Option.map x.description ~f:NonEmptyString.to_value));
        ("triggerType", (Option.map x.triggerType ~f:TriggerType.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let triggerType =
        (Option.map ~f:TriggerType.of_xml) (Xml.child xml_arg0 "triggerType") in
      let description =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "description") in
      let guardDutyFindingId =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "guardDutyFindingId") in
      make ?triggerType ?description ?guardDutyFindingId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let triggerType = field_map json__ "TriggerType" TriggerType.of_json in
      let description = field_map json__ "Description" NonEmptyString.of_json in
      let guardDutyFindingId =
        field_map json__ "GuardDutyFindingId" NonEmptyString.of_json in
      make ?triggerType ?description ?guardDutyFindingId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Represents the reason the scan was triggered."]
module FilterCriterion =
  struct
    type nonrec t =
      {
      criterionKey: CriterionKey.t option
        [@ocaml.doc
          "An enum value representing possible scan properties to match with given scan entries."];
      filterCondition: FilterCondition.t option
        [@ocaml.doc "Contains information about the condition."]}
    let make ?criterionKey =
      fun ?filterCondition -> fun () -> { criterionKey; filterCondition }
    let to_value x =
      structure_to_value
        [("criterionKey",
           (Option.map x.criterionKey ~f:CriterionKey.to_value));
        ("filterCondition",
          (Option.map x.filterCondition ~f:FilterCondition.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let filterCondition =
        (Option.map ~f:FilterCondition.of_xml)
          (Xml.child xml_arg0 "filterCondition") in
      let criterionKey =
        (Option.map ~f:CriterionKey.of_xml)
          (Xml.child xml_arg0 "criterionKey") in
      make ?filterCondition ?criterionKey ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let filterCondition =
        field_map json__ "FilterCondition" FilterCondition.of_json in
      let criterionKey = field_map json__ "CriterionKey" CriterionKey.of_json in
      make ?filterCondition ?criterionKey ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents a condition that when matched will be added to the response of the operation. Irrespective of using any filter criteria, an administrator account can view the scan entries for all of its member accounts. However, each member account can view the scan entries only for their own account."]
module OrganizationKubernetesConfiguration =
  struct
    type nonrec t =
      {
      auditLogs: OrganizationKubernetesAuditLogsConfiguration.t
        [@ocaml.doc
          "Whether Kubernetes audit logs data source should be auto-enabled for new members joining the organization."]}
    let context_ = "OrganizationKubernetesConfiguration"
    let make ~auditLogs = fun () -> { auditLogs }
    let to_value x =
      structure_to_value
        [("auditLogs",
           (Some
              (OrganizationKubernetesAuditLogsConfiguration.to_value
                 x.auditLogs)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let auditLogs =
        OrganizationKubernetesAuditLogsConfiguration.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "auditLogs") in
      make ~auditLogs ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let auditLogs =
        field_map_exn json__ "AuditLogs"
          OrganizationKubernetesAuditLogsConfiguration.of_json in
      make ~auditLogs ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Organization-wide Kubernetes data sources configurations."]
module OrganizationMalwareProtectionConfiguration =
  struct
    type nonrec t =
      {
      scanEc2InstanceWithFindings:
        OrganizationScanEc2InstanceWithFindings.t option
        [@ocaml.doc
          "Whether Malware Protection for EC2 instances with findings should be auto-enabled for new members joining the organization."]}
    let make ?scanEc2InstanceWithFindings =
      fun () -> { scanEc2InstanceWithFindings }
    let to_value x =
      structure_to_value
        [("scanEc2InstanceWithFindings",
           (Option.map x.scanEc2InstanceWithFindings
              ~f:OrganizationScanEc2InstanceWithFindings.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanEc2InstanceWithFindings =
        (Option.map ~f:OrganizationScanEc2InstanceWithFindings.of_xml)
          (Xml.child xml_arg0 "scanEc2InstanceWithFindings") in
      make ?scanEc2InstanceWithFindings ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanEc2InstanceWithFindings =
        field_map json__ "ScanEc2InstanceWithFindings"
          OrganizationScanEc2InstanceWithFindings.of_json in
      make ?scanEc2InstanceWithFindings ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Organization-wide Malware Protection configurations."]
module OrganizationS3LogsConfiguration =
  struct
    type nonrec t =
      {
      autoEnable: Boolean.t
        [@ocaml.doc
          "A value that contains information on whether S3 data event logs will be enabled automatically as a data source for the organization."]}
    let context_ = "OrganizationS3LogsConfiguration"
    let make ~autoEnable = fun () -> { autoEnable }
    let to_value x =
      structure_to_value
        [("autoEnable", (Some (Boolean.to_value x.autoEnable)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnable =
        Boolean.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "autoEnable") in
      make ~autoEnable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnable = field_map_exn json__ "AutoEnable" Boolean.of_json in
      make ~autoEnable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether S3 data event logs will be automatically enabled for new members of the organization."]
module OrganizationFeatureConfiguration =
  struct
    type nonrec t =
      {
      name: OrgFeature.t option
        [@ocaml.doc
          "The name of the feature that will be configured for the organization."];
      autoEnable: OrgFeatureStatus.t option
        [@ocaml.doc
          "Describes the status of the feature that is configured for the member accounts within the organization. One of the following values is the status for the entire organization: NEW: Indicates that when a new account joins the organization, they will have the feature enabled automatically. ALL: Indicates that all accounts in the organization have the feature enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. It may take up to 24 hours to update the configuration for all the member accounts. NONE: Indicates that the feature will not be automatically enabled for any account in the organization. The administrator must manage the feature for each account individually."];
      additionalConfiguration: OrganizationAdditionalConfigurations.t option
        [@ocaml.doc
          "The additional information that will be configured for the organization."]}
    let make ?name =
      fun ?autoEnable ->
        fun ?additionalConfiguration ->
          fun () -> { name; autoEnable; additionalConfiguration }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:OrgFeature.to_value));
        ("autoEnable",
          (Option.map x.autoEnable ~f:OrgFeatureStatus.to_value));
        ("additionalConfiguration",
          (Option.map x.additionalConfiguration
             ~f:OrganizationAdditionalConfigurations.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalConfiguration =
        (Option.map ~f:OrganizationAdditionalConfigurations.of_xml)
          (Xml.child xml_arg0 "additionalConfiguration") in
      let autoEnable =
        (Option.map ~f:OrgFeatureStatus.of_xml)
          (Xml.child xml_arg0 "autoEnable") in
      let name =
        (Option.map ~f:OrgFeature.of_xml) (Xml.child xml_arg0 "name") in
      make ?additionalConfiguration ?autoEnable ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalConfiguration =
        field_map json__ "AdditionalConfiguration"
          OrganizationAdditionalConfigurations.of_json in
      let autoEnable = field_map json__ "AutoEnable" OrgFeatureStatus.of_json in
      let name = field_map json__ "Name" OrgFeature.of_json in
      make ?additionalConfiguration ?autoEnable ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "A list of features which will be configured for the organization."]
module UnprocessedAccount =
  struct
    type nonrec t =
      {
      accountId: AccountId.t option
        [@ocaml.doc "The Amazon Web Services account ID."];
      result: String_.t option
        [@ocaml.doc "A reason why the account hasn't been processed."]}
    let make ?accountId = fun ?result -> fun () -> { accountId; result }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("result", (Option.map x.result ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let result =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "result") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?result ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let result = field_map json__ "Result" String_.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      make ?result ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the accounts that weren't processed."]
module KubernetesConfiguration =
  struct
    type nonrec t =
      {
      auditLogs: KubernetesAuditLogsConfiguration.t
        [@ocaml.doc "The status of Kubernetes audit logs as a data source."]}
    let context_ = "KubernetesConfiguration"
    let make ~auditLogs = fun () -> { auditLogs }
    let to_value x =
      structure_to_value
        [("auditLogs",
           (Some (KubernetesAuditLogsConfiguration.to_value x.auditLogs)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let auditLogs =
        KubernetesAuditLogsConfiguration.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "auditLogs") in
      make ~auditLogs ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let auditLogs =
        field_map_exn json__ "AuditLogs"
          KubernetesAuditLogsConfiguration.of_json in
      make ~auditLogs ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether any Kubernetes data sources are enabled."]
module MalwareProtectionConfiguration =
  struct
    type nonrec t =
      {
      scanEc2InstanceWithFindings: ScanEc2InstanceWithFindings.t option
        [@ocaml.doc
          "Describes the configuration of Malware Protection for EC2 instances with findings."]}
    let make ?scanEc2InstanceWithFindings =
      fun () -> { scanEc2InstanceWithFindings }
    let to_value x =
      structure_to_value
        [("scanEc2InstanceWithFindings",
           (Option.map x.scanEc2InstanceWithFindings
              ~f:ScanEc2InstanceWithFindings.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanEc2InstanceWithFindings =
        (Option.map ~f:ScanEc2InstanceWithFindings.of_xml)
          (Xml.child xml_arg0 "scanEc2InstanceWithFindings") in
      make ?scanEc2InstanceWithFindings ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanEc2InstanceWithFindings =
        field_map json__ "ScanEc2InstanceWithFindings"
          ScanEc2InstanceWithFindings.of_json in
      make ?scanEc2InstanceWithFindings ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether Malware Protection will be enabled as a data source."]
module S3LogsConfiguration =
  struct
    type nonrec t =
      {
      enable: Boolean.t
        [@ocaml.doc "The status of S3 data event logs as a data source."]}
    let context_ = "S3LogsConfiguration"
    let make ~enable = fun () -> { enable }
    let to_value x =
      structure_to_value [("enable", (Some (Boolean.to_value x.enable)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let enable =
        Boolean.of_xml (Xml.child_exn ~context:context_ xml_arg0 "enable") in
      make ~enable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let enable = field_map_exn json__ "Enable" Boolean.of_json in
      make ~enable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes whether S3 data event logs will be enabled as a data source."]
module MemberFeaturesConfiguration =
  struct
    type nonrec t =
      {
      name: OrgFeature.t option [@ocaml.doc "The name of the feature."];
      status: FeatureStatus.t option
        [@ocaml.doc "The status of the feature."];
      additionalConfiguration: MemberAdditionalConfigurations.t option
        [@ocaml.doc
          "Additional configuration of the feature for the member account."]}
    let make ?name =
      fun ?status ->
        fun ?additionalConfiguration ->
          fun () -> { name; status; additionalConfiguration }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:OrgFeature.to_value));
        ("status", (Option.map x.status ~f:FeatureStatus.to_value));
        ("additionalConfiguration",
          (Option.map x.additionalConfiguration
             ~f:MemberAdditionalConfigurations.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalConfiguration =
        (Option.map ~f:MemberAdditionalConfigurations.of_xml)
          (Xml.child xml_arg0 "additionalConfiguration") in
      let status =
        (Option.map ~f:FeatureStatus.of_xml) (Xml.child xml_arg0 "status") in
      let name =
        (Option.map ~f:OrgFeature.of_xml) (Xml.child xml_arg0 "name") in
      make ?additionalConfiguration ?status ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalConfiguration =
        field_map json__ "AdditionalConfiguration"
          MemberAdditionalConfigurations.of_json in
      let status = field_map json__ "Status" FeatureStatus.of_json in
      let name = field_map json__ "Name" OrgFeature.of_json in
      make ?additionalConfiguration ?status ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the features for the member account."]
module ScanCriterion =
  struct
    type nonrec t = (ScanCriterionKey.t * ScanCondition.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            let (_ : string) = v in
                            let (_ : string) = chopped in
                            failwith
                              "no of_header for complex types ScanCriterionKey ScanCondition"))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (ScanCriterionKey.to_value x) |>
                    (fun x -> (ScanCondition.to_value y) |> (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:ScanCriterionKey.of_string
        ~of_json:ScanCondition.of_json j
    let to_json v = composed_to_json to_value v
  end
module MalwareProtectionPlanTaggingAction =
  struct
    type nonrec t =
      {
      status: MalwareProtectionPlanTaggingActionStatus.t option
        [@ocaml.doc "Indicates whether or not the tags will added."]}
    let make ?status = fun () -> { status }
    let to_value x =
      structure_to_value
        [("status",
           (Option.map x.status
              ~f:MalwareProtectionPlanTaggingActionStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:MalwareProtectionPlanTaggingActionStatus.of_xml)
          (Xml.child xml_arg0 "status") in
      make ?status ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status =
        field_map json__ "Status"
          MalwareProtectionPlanTaggingActionStatus.of_json in
      make ?status ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about adding tags to the scanned S3 object after the scan result."]
module UpdateS3BucketResource =
  struct
    type nonrec t =
      {
      objectPrefixes: MalwareProtectionPlanObjectPrefixesList.t option
        [@ocaml.doc
          "Information about the specified object prefixes. The S3 object will be scanned only if it belongs to any of the specified object prefixes."]}
    let make ?objectPrefixes = fun () -> { objectPrefixes }
    let to_value x =
      structure_to_value
        [("objectPrefixes",
           (Option.map x.objectPrefixes
              ~f:MalwareProtectionPlanObjectPrefixesList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let objectPrefixes =
        (Option.map ~f:MalwareProtectionPlanObjectPrefixesList.of_xml)
          (Xml.child xml_arg0 "objectPrefixes") in
      make ?objectPrefixes ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let objectPrefixes =
        field_map json__ "ObjectPrefixes"
          MalwareProtectionPlanObjectPrefixesList.of_json in
      make ?objectPrefixes ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the protected S3 bucket resource."]
module FindingId =
  struct
    type nonrec t = string
    let context_ = "FindingId"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:300) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"FindingId" j
    let to_json = simple_to_json to_value
  end
module Criterion =
  struct
    type nonrec t = (String_.t * Condition.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            let (_ : string) = v in
                            let (_ : string) = chopped in
                            failwith
                              "no of_header for complex types String Condition"))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (String_.to_value x) |>
                    (fun x -> (Condition.to_value y) |> (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:String_.of_string
        ~of_json:Condition.of_json j
    let to_json v = composed_to_json to_value v
  end
module DetectorFeatureConfiguration =
  struct
    type nonrec t =
      {
      name: DetectorFeature.t option [@ocaml.doc "The name of the feature."];
      status: FeatureStatus.t option
        [@ocaml.doc "The status of the feature."];
      additionalConfiguration: DetectorAdditionalConfigurations.t option
        [@ocaml.doc "Additional configuration for a resource."]}
    let make ?name =
      fun ?status ->
        fun ?additionalConfiguration ->
          fun () -> { name; status; additionalConfiguration }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:DetectorFeature.to_value));
        ("status", (Option.map x.status ~f:FeatureStatus.to_value));
        ("additionalConfiguration",
          (Option.map x.additionalConfiguration
             ~f:DetectorAdditionalConfigurations.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalConfiguration =
        (Option.map ~f:DetectorAdditionalConfigurations.of_xml)
          (Xml.child xml_arg0 "additionalConfiguration") in
      let status =
        (Option.map ~f:FeatureStatus.of_xml) (Xml.child xml_arg0 "status") in
      let name =
        (Option.map ~f:DetectorFeature.of_xml) (Xml.child xml_arg0 "name") in
      make ?additionalConfiguration ?status ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalConfiguration =
        field_map json__ "AdditionalConfiguration"
          DetectorAdditionalConfigurations.of_json in
      let status = field_map json__ "Status" FeatureStatus.of_json in
      let name = field_map json__ "Name" DetectorFeature.of_json in
      make ?additionalConfiguration ?status ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about a GuardDuty feature. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring."]
module RecoveryPoint =
  struct
    type nonrec t =
      {
      backupVaultName: String_.t
        [@ocaml.doc
          "The name of the Amazon Web Services Backup vault that contains the name of the recovery point to be scanned."]}
    let context_ = "RecoveryPoint"
    let make ~backupVaultName = fun () -> { backupVaultName }
    let to_value x =
      structure_to_value
        [("backupVaultName", (Some (String_.to_value x.backupVaultName)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let backupVaultName =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "backupVaultName") in
      make ~backupVaultName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let backupVaultName =
        field_map_exn json__ "BackupVaultName" String_.of_json in
      make ~backupVaultName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the recovery point configuration for scanning backup data from Amazon Web Services Backup."]
module Destination =
  struct
    type nonrec t =
      {
      destinationId: String_.t option
        [@ocaml.doc "The unique ID of the publishing destination."];
      destinationType: DestinationType.t option
        [@ocaml.doc
          "The type of resource used for the publishing destination. Currently, only Amazon S3 buckets are supported."];
      status: PublishingStatus.t option
        [@ocaml.doc "The status of the publishing destination."]}
    let make ?destinationId =
      fun ?destinationType ->
        fun ?status -> fun () -> { destinationId; destinationType; status }
    let to_value x =
      structure_to_value
        [("destinationId", (Option.map x.destinationId ~f:String_.to_value));
        ("destinationType",
          (Option.map x.destinationType ~f:DestinationType.to_value));
        ("status", (Option.map x.status ~f:PublishingStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let status =
        (Option.map ~f:PublishingStatus.of_xml) (Xml.child xml_arg0 "status") in
      let destinationType =
        (Option.map ~f:DestinationType.of_xml)
          (Xml.child xml_arg0 "destinationType") in
      let destinationId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "destinationId") in
      make ?status ?destinationType ?destinationId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let status = field_map json__ "Status" PublishingStatus.of_json in
      let destinationType =
        field_map json__ "DestinationType" DestinationType.of_json in
      let destinationId = field_map json__ "DestinationId" String_.of_json in
      make ?status ?destinationType ?destinationId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the publishing destination, including the ID, type, and status."]
module AdminAccount =
  struct
    type nonrec t =
      {
      adminAccountId: String_.t option
        [@ocaml.doc "The Amazon Web Services account ID for the account."];
      adminStatus: AdminStatus.t option
        [@ocaml.doc
          "Indicates whether the account is enabled as the delegated administrator."]}
    let make ?adminAccountId =
      fun ?adminStatus -> fun () -> { adminAccountId; adminStatus }
    let to_value x =
      structure_to_value
        [("adminAccountId",
           (Option.map x.adminAccountId ~f:String_.to_value));
        ("adminStatus", (Option.map x.adminStatus ~f:AdminStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let adminStatus =
        (Option.map ~f:AdminStatus.of_xml) (Xml.child xml_arg0 "adminStatus") in
      let adminAccountId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "adminAccountId") in
      make ?adminStatus ?adminAccountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let adminStatus = field_map json__ "AdminStatus" AdminStatus.of_json in
      let adminAccountId = field_map json__ "AdminAccountId" String_.of_json in
      make ?adminStatus ?adminAccountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "The account within the organization specified as the GuardDuty delegated administrator."]
module Member =
  struct
    type nonrec t =
      {
      accountId: AccountId.t option
        [@ocaml.doc "The ID of the member account."];
      detectorId: DetectorId.t option
        [@ocaml.doc "The detector ID of the member account."];
      masterId: String_.t option [@ocaml.doc "The administrator account ID."];
      email: Email.t option
        [@ocaml.doc "The email address of the member account."];
      relationshipStatus: String_.t option
        [@ocaml.doc
          "The status of the relationship between the member and the administrator."];
      invitedAt: String_.t option
        [@ocaml.doc "The timestamp when the invitation was sent."];
      updatedAt: String_.t option
        [@ocaml.doc "The last-updated timestamp of the member."];
      administratorId: String_.t option
        [@ocaml.doc "The administrator account ID."]}
    let make ?accountId =
      fun ?detectorId ->
        fun ?masterId ->
          fun ?email ->
            fun ?relationshipStatus ->
              fun ?invitedAt ->
                fun ?updatedAt ->
                  fun ?administratorId ->
                    fun () ->
                      {
                        accountId;
                        detectorId;
                        masterId;
                        email;
                        relationshipStatus;
                        invitedAt;
                        updatedAt;
                        administratorId
                      }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("detectorId", (Option.map x.detectorId ~f:DetectorId.to_value));
        ("masterId", (Option.map x.masterId ~f:String_.to_value));
        ("email", (Option.map x.email ~f:Email.to_value));
        ("relationshipStatus",
          (Option.map x.relationshipStatus ~f:String_.to_value));
        ("invitedAt", (Option.map x.invitedAt ~f:String_.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:String_.to_value));
        ("administratorId",
          (Option.map x.administratorId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let administratorId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "administratorId") in
      let updatedAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let invitedAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "invitedAt") in
      let relationshipStatus =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "relationshipStatus") in
      let email = (Option.map ~f:Email.of_xml) (Xml.child xml_arg0 "email") in
      let masterId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "masterId") in
      let detectorId =
        (Option.map ~f:DetectorId.of_xml) (Xml.child xml_arg0 "detectorId") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?administratorId ?updatedAt ?invitedAt ?relationshipStatus ?email
        ?masterId ?detectorId ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let administratorId =
        field_map json__ "AdministratorId" String_.of_json in
      let updatedAt = field_map json__ "UpdatedAt" String_.of_json in
      let invitedAt = field_map json__ "InvitedAt" String_.of_json in
      let relationshipStatus =
        field_map json__ "RelationshipStatus" String_.of_json in
      let email = field_map json__ "Email" Email.of_json in
      let masterId = field_map json__ "MasterId" String_.of_json in
      let detectorId = field_map json__ "DetectorId" DetectorId.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      make ?administratorId ?updatedAt ?invitedAt ?relationshipStatus ?email
        ?masterId ?detectorId ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the member account."]
module MalwareScan =
  struct
    type nonrec t =
      {
      resourceArn: NonEmptyString.t option
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the resource for the given malware scan."];
      resourceType: MalwareProtectionResourceType.t option
        [@ocaml.doc "The type of resource that was scanned for malware."];
      scanId: NonEmptyString.t option
        [@ocaml.doc
          "A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan."];
      scanStatus: MalwareProtectionScanStatus.t option
        [@ocaml.doc
          "An enum value representing the current status of the malware scan."];
      scanResultStatus: ScanResultStatus.t option
        [@ocaml.doc
          "An enum value representing the result of the malware scan."];
      scanType: MalwareProtectionScanType.t option
        [@ocaml.doc
          "An enum value representing the type of scan that was initiated."];
      scanStartedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp representing when the malware scan was started."];
      scanCompletedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp representing when the malware scan was completed."]}
    let make ?resourceArn =
      fun ?resourceType ->
        fun ?scanId ->
          fun ?scanStatus ->
            fun ?scanResultStatus ->
              fun ?scanType ->
                fun ?scanStartedAt ->
                  fun ?scanCompletedAt ->
                    fun () ->
                      {
                        resourceArn;
                        resourceType;
                        scanId;
                        scanStatus;
                        scanResultStatus;
                        scanType;
                        scanStartedAt;
                        scanCompletedAt
                      }
    let to_value x =
      structure_to_value
        [("resourceArn",
           (Option.map x.resourceArn ~f:NonEmptyString.to_value));
        ("resourceType",
          (Option.map x.resourceType
             ~f:MalwareProtectionResourceType.to_value));
        ("scanId", (Option.map x.scanId ~f:NonEmptyString.to_value));
        ("scanStatus",
          (Option.map x.scanStatus ~f:MalwareProtectionScanStatus.to_value));
        ("scanResultStatus",
          (Option.map x.scanResultStatus ~f:ScanResultStatus.to_value));
        ("scanType",
          (Option.map x.scanType ~f:MalwareProtectionScanType.to_value));
        ("scanStartedAt", (Option.map x.scanStartedAt ~f:Timestamp.to_value));
        ("scanCompletedAt",
          (Option.map x.scanCompletedAt ~f:Timestamp.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanCompletedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "scanCompletedAt") in
      let scanStartedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "scanStartedAt") in
      let scanType =
        (Option.map ~f:MalwareProtectionScanType.of_xml)
          (Xml.child xml_arg0 "scanType") in
      let scanResultStatus =
        (Option.map ~f:ScanResultStatus.of_xml)
          (Xml.child xml_arg0 "scanResultStatus") in
      let scanStatus =
        (Option.map ~f:MalwareProtectionScanStatus.of_xml)
          (Xml.child xml_arg0 "scanStatus") in
      let scanId =
        (Option.map ~f:NonEmptyString.of_xml) (Xml.child xml_arg0 "scanId") in
      let resourceType =
        (Option.map ~f:MalwareProtectionResourceType.of_xml)
          (Xml.child xml_arg0 "resourceType") in
      let resourceArn =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "resourceArn") in
      make ?scanCompletedAt ?scanStartedAt ?scanType ?scanResultStatus
        ?scanStatus ?scanId ?resourceType ?resourceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanCompletedAt =
        field_map json__ "ScanCompletedAt" Timestamp.of_json in
      let scanStartedAt = field_map json__ "ScanStartedAt" Timestamp.of_json in
      let scanType =
        field_map json__ "ScanType" MalwareProtectionScanType.of_json in
      let scanResultStatus =
        field_map json__ "ScanResultStatus" ScanResultStatus.of_json in
      let scanStatus =
        field_map json__ "ScanStatus" MalwareProtectionScanStatus.of_json in
      let scanId = field_map json__ "ScanId" NonEmptyString.of_json in
      let resourceType =
        field_map json__ "ResourceType" MalwareProtectionResourceType.of_json in
      let resourceArn = field_map json__ "ResourceArn" NonEmptyString.of_json in
      make ?scanCompletedAt ?scanStartedAt ?scanType ?scanResultStatus
        ?scanStatus ?scanId ?resourceType ?resourceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about a particular malware scan."]
module ListMalwareScansFilterCriterionList =
  struct
    type nonrec t = ListMalwareScansFilterCriterion.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:1) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ListMalwareScansFilterCriterion.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ListMalwareScansFilterCriterion.of_xml)
    let of_json j =
      list_of_json ~kind:"ListMalwareScansFilterCriterionList"
        ~of_json:ListMalwareScansFilterCriterion.of_json j
    let to_json v = composed_to_json to_value v
  end
module OrderBy =
  struct
    type nonrec t =
      | ASC 
      | DESC 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function | ASC -> "ASC" | DESC -> "DESC" | Non_static_id s -> s
    let of_string =
      function | "ASC" -> ASC | "DESC" -> DESC | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration OrderBy" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"OrderBy" j)
    let to_json = simple_to_json to_value
  end
module MalwareProtectionPlanSummary =
  struct
    type nonrec t =
      {
      malwareProtectionPlanId: String_.t option
        [@ocaml.doc
          "A unique identifier associated with Malware Protection plan."]}
    let make ?malwareProtectionPlanId = fun () -> { malwareProtectionPlanId }
    let to_value x =
      structure_to_value
        [("malwareProtectionPlanId",
           (Option.map x.malwareProtectionPlanId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtectionPlanId =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "malwareProtectionPlanId") in
      make ?malwareProtectionPlanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtectionPlanId =
        field_map json__ "MalwareProtectionPlanId" String_.of_json in
      make ?malwareProtectionPlanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the Malware Protection plan resource."]
module Invitation =
  struct
    type nonrec t =
      {
      accountId: AccountId.t option
        [@ocaml.doc
          "The ID of the account that the invitation was sent from."];
      invitationId: String_.t option
        [@ocaml.doc
          "The ID of the invitation. This value is used to validate the inviter account to the member account."];
      relationshipStatus: String_.t option
        [@ocaml.doc
          "The status of the relationship between the inviter and invitee accounts."];
      invitedAt: String_.t option
        [@ocaml.doc "The timestamp when the invitation was sent."]}
    let make ?accountId =
      fun ?invitationId ->
        fun ?relationshipStatus ->
          fun ?invitedAt ->
            fun () ->
              { accountId; invitationId; relationshipStatus; invitedAt }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("invitationId", (Option.map x.invitationId ~f:String_.to_value));
        ("relationshipStatus",
          (Option.map x.relationshipStatus ~f:String_.to_value));
        ("invitedAt", (Option.map x.invitedAt ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let invitedAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "invitedAt") in
      let relationshipStatus =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "relationshipStatus") in
      let invitationId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "invitationId") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?invitedAt ?relationshipStatus ?invitationId ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let invitedAt = field_map json__ "InvitedAt" String_.of_json in
      let relationshipStatus =
        field_map json__ "RelationshipStatus" String_.of_json in
      let invitationId = field_map json__ "InvitationId" String_.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      make ?invitedAt ?relationshipStatus ?invitationId ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the invitation to become a member account."]
module FilterName =
  struct
    type nonrec t = string
    let context_ = "FilterName"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:64) >>=
             (fun () -> check_string_min i ~min:3));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"FilterName" j
    let to_json = simple_to_json to_value
  end
module CoverageResource =
  struct
    type nonrec t =
      {
      resourceId: String_.t option
        [@ocaml.doc "The unique ID of the resource."];
      detectorId: DetectorId.t option
        [@ocaml.doc
          "The unique ID of the GuardDuty detector associated with the resource."];
      accountId: AccountId.t option
        [@ocaml.doc "The unique ID of the Amazon Web Services account."];
      resourceDetails: CoverageResourceDetails.t option
        [@ocaml.doc
          "Information about the resource for which the coverage statistics are retrieved."];
      coverageStatus: CoverageStatus.t option
        [@ocaml.doc "Represents the status of the EKS cluster coverage."];
      issue: String_.t option
        [@ocaml.doc
          "Represents the reason why a coverage status was UNHEALTHY for the EKS cluster."];
      updatedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the coverage details for the resource were last updated. This is in UTC format."]}
    let make ?resourceId =
      fun ?detectorId ->
        fun ?accountId ->
          fun ?resourceDetails ->
            fun ?coverageStatus ->
              fun ?issue ->
                fun ?updatedAt ->
                  fun () ->
                    {
                      resourceId;
                      detectorId;
                      accountId;
                      resourceDetails;
                      coverageStatus;
                      issue;
                      updatedAt
                    }
    let to_value x =
      structure_to_value
        [("resourceId", (Option.map x.resourceId ~f:String_.to_value));
        ("detectorId", (Option.map x.detectorId ~f:DetectorId.to_value));
        ("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("resourceDetails",
          (Option.map x.resourceDetails ~f:CoverageResourceDetails.to_value));
        ("coverageStatus",
          (Option.map x.coverageStatus ~f:CoverageStatus.to_value));
        ("issue", (Option.map x.issue ~f:String_.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let issue = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "issue") in
      let coverageStatus =
        (Option.map ~f:CoverageStatus.of_xml)
          (Xml.child xml_arg0 "coverageStatus") in
      let resourceDetails =
        (Option.map ~f:CoverageResourceDetails.of_xml)
          (Xml.child xml_arg0 "resourceDetails") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      let detectorId =
        (Option.map ~f:DetectorId.of_xml) (Xml.child xml_arg0 "detectorId") in
      let resourceId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "resourceId") in
      make ?updatedAt ?issue ?coverageStatus ?resourceDetails ?accountId
        ?detectorId ?resourceId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      let issue = field_map json__ "Issue" String_.of_json in
      let coverageStatus =
        field_map json__ "CoverageStatus" CoverageStatus.of_json in
      let resourceDetails =
        field_map json__ "ResourceDetails" CoverageResourceDetails.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      let detectorId = field_map json__ "DetectorId" DetectorId.of_json in
      let resourceId = field_map json__ "ResourceId" String_.of_json in
      make ?updatedAt ?issue ?coverageStatus ?resourceDetails ?accountId
        ?detectorId ?resourceId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the resource of the GuardDuty account."]
module CoverageFilterCriterionList =
  struct
    type nonrec t = CoverageFilterCriterion.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:CoverageFilterCriterion.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:CoverageFilterCriterion.of_xml)
    let of_json j =
      list_of_json ~kind:"CoverageFilterCriterionList"
        ~of_json:CoverageFilterCriterion.of_json j
    let to_json v = composed_to_json to_value v
  end
module CoverageSortKey =
  struct
    type nonrec t =
      | ACCOUNT_ID 
      | COVERAGE_STATUS 
      | ISSUE 
      | ADDON_VERSION 
      | UPDATED_AT 
      | CLUSTER_NAME 
      | EKS_CLUSTER_NAME 
      | ECS_CLUSTER_NAME 
      | INSTANCE_ID 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ACCOUNT_ID -> "ACCOUNT_ID"
      | COVERAGE_STATUS -> "COVERAGE_STATUS"
      | ISSUE -> "ISSUE"
      | ADDON_VERSION -> "ADDON_VERSION"
      | UPDATED_AT -> "UPDATED_AT"
      | CLUSTER_NAME -> "CLUSTER_NAME"
      | EKS_CLUSTER_NAME -> "EKS_CLUSTER_NAME"
      | ECS_CLUSTER_NAME -> "ECS_CLUSTER_NAME"
      | INSTANCE_ID -> "INSTANCE_ID"
      | Non_static_id s -> s
    let of_string =
      function
      | "ACCOUNT_ID" -> ACCOUNT_ID
      | "COVERAGE_STATUS" -> COVERAGE_STATUS
      | "ISSUE" -> ISSUE
      | "ADDON_VERSION" -> ADDON_VERSION
      | "UPDATED_AT" -> UPDATED_AT
      | "CLUSTER_NAME" -> CLUSTER_NAME
      | "EKS_CLUSTER_NAME" -> EKS_CLUSTER_NAME
      | "ECS_CLUSTER_NAME" -> ECS_CLUSTER_NAME
      | "INSTANCE_ID" -> INSTANCE_ID
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration CoverageSortKey" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"CoverageSortKey" j)
    let to_json = simple_to_json to_value
  end
module UsageAccountResultList =
  struct
    type nonrec t = UsageAccountResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:UsageAccountResult.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:UsageAccountResult.of_xml)
    let of_json j =
      list_of_json ~kind:"UsageAccountResultList"
        ~of_json:UsageAccountResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module UsageDataSourceResultList =
  struct
    type nonrec t = UsageDataSourceResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:UsageDataSourceResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:UsageDataSourceResult.of_xml)
    let of_json j =
      list_of_json ~kind:"UsageDataSourceResultList"
        ~of_json:UsageDataSourceResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module UsageFeatureResultList =
  struct
    type nonrec t = UsageFeatureResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:UsageFeatureResult.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:UsageFeatureResult.of_xml)
    let of_json j =
      list_of_json ~kind:"UsageFeatureResultList"
        ~of_json:UsageFeatureResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module UsageResourceResultList =
  struct
    type nonrec t = UsageResourceResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:UsageResourceResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:UsageResourceResult.of_xml)
    let of_json j =
      list_of_json ~kind:"UsageResourceResultList"
        ~of_json:UsageResourceResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module UsageTopAccountsResultList =
  struct
    type nonrec t = UsageTopAccountsResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:UsageTopAccountsResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:UsageTopAccountsResult.of_xml)
    let of_json j =
      list_of_json ~kind:"UsageTopAccountsResultList"
        ~of_json:UsageTopAccountsResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module AccountIds =
  struct
    type nonrec t = AccountId.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:1));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:AccountId.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:AccountId.of_xml)
    let of_json j =
      list_of_json ~kind:"AccountIds" ~of_json:AccountId.of_json j
    let to_json v = composed_to_json to_value v
  end
module DataSourceList =
  struct
    type nonrec t = DataSource.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:DataSource.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:DataSource.of_xml)
    let of_json j =
      list_of_json ~kind:"DataSourceList" ~of_json:DataSource.of_json j
    let to_json v = composed_to_json to_value v
  end
module ResourceList =
  struct
    type nonrec t = String_.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"ResourceList" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module UsageFeatureList =
  struct
    type nonrec t = UsageFeature.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:UsageFeature.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:UsageFeature.of_xml)
    let of_json j =
      list_of_json ~kind:"UsageFeatureList" ~of_json:UsageFeature.of_json j
    let to_json v = composed_to_json to_value v
  end
module AccountFreeTrialInfo =
  struct
    type nonrec t =
      {
      accountId: String_.t option
        [@ocaml.doc
          "The account identifier of the GuardDuty member account."];
      dataSources: DataSourcesFreeTrial.t option
        [@ocaml.doc
          "Describes the data source enabled for the GuardDuty member account."];
      features: FreeTrialFeatureConfigurationsResults.t option
        [@ocaml.doc "A list of features enabled for the GuardDuty account."]}
    let make ?accountId =
      fun ?dataSources ->
        fun ?features -> fun () -> { accountId; dataSources; features }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:String_.to_value));
        ("dataSources",
          (Option.map x.dataSources ~f:DataSourcesFreeTrial.to_value));
        ("features",
          (Option.map x.features
             ~f:FreeTrialFeatureConfigurationsResults.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let features =
        (Option.map ~f:FreeTrialFeatureConfigurationsResults.of_xml)
          (Xml.child xml_arg0 "features") in
      let dataSources =
        (Option.map ~f:DataSourcesFreeTrial.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let accountId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?features ?dataSources ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let features =
        field_map json__ "Features"
          FreeTrialFeatureConfigurationsResults.of_json in
      let dataSources =
        field_map json__ "DataSources" DataSourcesFreeTrial.of_json in
      let accountId = field_map json__ "AccountId" String_.of_json in
      make ?features ?dataSources ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides details of the GuardDuty member account that uses a free trial service."]
module OrganizationStatistics =
  struct
    type nonrec t =
      {
      totalAccountsCount: Integer.t option
        [@ocaml.doc
          "Total number of accounts in your Amazon Web Services organization."];
      memberAccountsCount: Integer.t option
        [@ocaml.doc
          "Total number of accounts in your Amazon Web Services organization that are associated with GuardDuty."];
      activeAccountsCount: Integer.t option
        [@ocaml.doc
          "Total number of active accounts in your Amazon Web Services organization that are associated with GuardDuty."];
      enabledAccountsCount: Integer.t option
        [@ocaml.doc "Total number of accounts that have enabled GuardDuty."];
      countByFeature: OrganizationFeatureStatisticsResults.t option
        [@ocaml.doc "Retrieves the coverage statistics for each feature."]}
    let make ?totalAccountsCount =
      fun ?memberAccountsCount ->
        fun ?activeAccountsCount ->
          fun ?enabledAccountsCount ->
            fun ?countByFeature ->
              fun () ->
                {
                  totalAccountsCount;
                  memberAccountsCount;
                  activeAccountsCount;
                  enabledAccountsCount;
                  countByFeature
                }
    let to_value x =
      structure_to_value
        [("totalAccountsCount",
           (Option.map x.totalAccountsCount ~f:Integer.to_value));
        ("memberAccountsCount",
          (Option.map x.memberAccountsCount ~f:Integer.to_value));
        ("activeAccountsCount",
          (Option.map x.activeAccountsCount ~f:Integer.to_value));
        ("enabledAccountsCount",
          (Option.map x.enabledAccountsCount ~f:Integer.to_value));
        ("countByFeature",
          (Option.map x.countByFeature
             ~f:OrganizationFeatureStatisticsResults.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let countByFeature =
        (Option.map ~f:OrganizationFeatureStatisticsResults.of_xml)
          (Xml.child xml_arg0 "countByFeature") in
      let enabledAccountsCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "enabledAccountsCount") in
      let activeAccountsCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "activeAccountsCount") in
      let memberAccountsCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "memberAccountsCount") in
      let totalAccountsCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "totalAccountsCount") in
      make ?countByFeature ?enabledAccountsCount ?activeAccountsCount
        ?memberAccountsCount ?totalAccountsCount ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let countByFeature =
        field_map json__ "CountByFeature"
          OrganizationFeatureStatisticsResults.of_json in
      let enabledAccountsCount =
        field_map json__ "EnabledAccountsCount" Integer.of_json in
      let activeAccountsCount =
        field_map json__ "ActiveAccountsCount" Integer.of_json in
      let memberAccountsCount =
        field_map json__ "MemberAccountsCount" Integer.of_json in
      let totalAccountsCount =
        field_map json__ "TotalAccountsCount" Integer.of_json in
      make ?countByFeature ?enabledAccountsCount ?activeAccountsCount
        ?memberAccountsCount ?totalAccountsCount ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the coverage statistics of the features for the entire Amazon Web Services organization. When you create a new Amazon Web Services organization, it might take up to 24 hours to generate the statistics summary for this organization."]
module MemberDataSourceConfiguration =
  struct
    type nonrec t =
      {
      accountId: AccountId.t option
        [@ocaml.doc "The account ID for the member account."];
      dataSources: DataSourceConfigurationsResult.t option
        [@ocaml.doc
          "Contains information on the status of data sources for the account."];
      features: MemberFeaturesConfigurationsResults.t option
        [@ocaml.doc
          "Contains information about the status of the features for the member account."]}
    let make ?accountId =
      fun ?dataSources ->
        fun ?features -> fun () -> { accountId; dataSources; features }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("dataSources",
          (Option.map x.dataSources
             ~f:DataSourceConfigurationsResult.to_value));
        ("features",
          (Option.map x.features
             ~f:MemberFeaturesConfigurationsResults.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let features =
        (Option.map ~f:MemberFeaturesConfigurationsResults.of_xml)
          (Xml.child xml_arg0 "features") in
      let dataSources =
        (Option.map ~f:DataSourceConfigurationsResult.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?features ?dataSources ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let features =
        field_map json__ "Features"
          MemberFeaturesConfigurationsResults.of_json in
      let dataSources =
        field_map json__ "DataSources" DataSourceConfigurationsResult.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      make ?features ?dataSources ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on which data sources are enabled for a member account."]
module ScanResultThreats =
  struct
    type nonrec t = ScanResultThreat.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ScanResultThreat.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ScanResultThreat.of_xml)
    let of_json j =
      list_of_json ~kind:"ScanResultThreats"
        ~of_json:ScanResultThreat.of_json j
    let to_json v = composed_to_json to_value v
  end
module ScanConfigurationRecoveryPoint =
  struct
    type nonrec t =
      {
      backupVaultName: NonEmptyString.t option
        [@ocaml.doc
          "The name of the Amazon Web Services Backup vault that contains the recovery point for the scanned."]}
    let make ?backupVaultName = fun () -> { backupVaultName }
    let to_value x =
      structure_to_value
        [("backupVaultName",
           (Option.map x.backupVaultName ~f:NonEmptyString.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let backupVaultName =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "backupVaultName") in
      make ?backupVaultName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let backupVaultName =
        field_map json__ "BackupVaultName" NonEmptyString.of_json in
      make ?backupVaultName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the recovery point configuration used in the scan."]
module ScannedResource =
  struct
    type nonrec t =
      {
      scannedResourceArn: NonEmptyString.t option
        [@ocaml.doc "Amazon Resource Name (ARN) of the scanned resource."];
      scannedResourceType: MalwareProtectionResourceType.t option
        [@ocaml.doc "The resource type of the scanned resource."];
      scannedResourceStatus: MalwareProtectionScanStatus.t option
        [@ocaml.doc "The status of the scanned resource."];
      scanStatusReason: ScanStatusReason.t option
        [@ocaml.doc
          "The reason for the scan status of this particular resource, if applicable."];
      resourceDetails: ScannedResourceDetails.t option
        [@ocaml.doc "Information about the scanned resource."]}
    let make ?scannedResourceArn =
      fun ?scannedResourceType ->
        fun ?scannedResourceStatus ->
          fun ?scanStatusReason ->
            fun ?resourceDetails ->
              fun () ->
                {
                  scannedResourceArn;
                  scannedResourceType;
                  scannedResourceStatus;
                  scanStatusReason;
                  resourceDetails
                }
    let to_value x =
      structure_to_value
        [("scannedResourceArn",
           (Option.map x.scannedResourceArn ~f:NonEmptyString.to_value));
        ("scannedResourceType",
          (Option.map x.scannedResourceType
             ~f:MalwareProtectionResourceType.to_value));
        ("scannedResourceStatus",
          (Option.map x.scannedResourceStatus
             ~f:MalwareProtectionScanStatus.to_value));
        ("scanStatusReason",
          (Option.map x.scanStatusReason ~f:ScanStatusReason.to_value));
        ("resourceDetails",
          (Option.map x.resourceDetails ~f:ScannedResourceDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let resourceDetails =
        (Option.map ~f:ScannedResourceDetails.of_xml)
          (Xml.child xml_arg0 "resourceDetails") in
      let scanStatusReason =
        (Option.map ~f:ScanStatusReason.of_xml)
          (Xml.child xml_arg0 "scanStatusReason") in
      let scannedResourceStatus =
        (Option.map ~f:MalwareProtectionScanStatus.of_xml)
          (Xml.child xml_arg0 "scannedResourceStatus") in
      let scannedResourceType =
        (Option.map ~f:MalwareProtectionResourceType.of_xml)
          (Xml.child xml_arg0 "scannedResourceType") in
      let scannedResourceArn =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "scannedResourceArn") in
      make ?resourceDetails ?scanStatusReason ?scannedResourceStatus
        ?scannedResourceType ?scannedResourceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let resourceDetails =
        field_map json__ "ResourceDetails" ScannedResourceDetails.of_json in
      let scanStatusReason =
        field_map json__ "ScanStatusReason" ScanStatusReason.of_json in
      let scannedResourceStatus =
        field_map json__ "ScannedResourceStatus"
          MalwareProtectionScanStatus.of_json in
      let scannedResourceType =
        field_map json__ "ScannedResourceType"
          MalwareProtectionResourceType.of_json in
      let scannedResourceArn =
        field_map json__ "ScannedResourceArn" NonEmptyString.of_json in
      make ?resourceDetails ?scanStatusReason ?scannedResourceStatus
        ?scannedResourceType ?scannedResourceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about a resource that was scanned as part of the malware scan operation."]
module CreateS3BucketResource =
  struct
    type nonrec t =
      {
      bucketName: String_.t option [@ocaml.doc "Name of the S3 bucket."];
      objectPrefixes: MalwareProtectionPlanObjectPrefixesList.t option
        [@ocaml.doc
          "Information about the specified object prefixes. The S3 object will be scanned only if it belongs to any of the specified object prefixes."]}
    let make ?bucketName =
      fun ?objectPrefixes -> fun () -> { bucketName; objectPrefixes }
    let to_value x =
      structure_to_value
        [("bucketName", (Option.map x.bucketName ~f:String_.to_value));
        ("objectPrefixes",
          (Option.map x.objectPrefixes
             ~f:MalwareProtectionPlanObjectPrefixesList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let objectPrefixes =
        (Option.map ~f:MalwareProtectionPlanObjectPrefixesList.of_xml)
          (Xml.child xml_arg0 "objectPrefixes") in
      let bucketName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "bucketName") in
      make ?objectPrefixes ?bucketName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let objectPrefixes =
        field_map json__ "ObjectPrefixes"
          MalwareProtectionPlanObjectPrefixesList.of_json in
      let bucketName = field_map json__ "BucketName" String_.of_json in
      make ?objectPrefixes ?bucketName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Information about the protected S3 bucket resource."]
module MalwareProtectionPlanStatusReason =
  struct
    type nonrec t =
      {
      code: String_.t option [@ocaml.doc "Issue code."];
      message: String_.t option
        [@ocaml.doc
          "Issue message that specifies the reason. For information about potential troubleshooting steps, see Troubleshooting Malware Protection for S3 status issues in the Amazon GuardDuty User Guide."]}
    let make ?code = fun ?message -> fun () -> { code; message }
    let to_value x =
      structure_to_value
        [("code", (Option.map x.code ~f:String_.to_value));
        ("message", (Option.map x.message ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let message =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "message") in
      let code = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "code") in
      make ?message ?code ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let message = field_map json__ "Message" String_.of_json in
      let code = field_map json__ "Code" String_.of_json in
      make ?message ?code ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the issue code and message associated to the status of your Malware Protection plan."]
module CountBySeverity =
  struct
    type nonrec t = (String_.t * Integer.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            ((String_.of_string chopped),
                              (Integer.of_string v))))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (String_.to_value x) |>
                    (fun x -> (Integer.to_value y) |> (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:String_.of_string
        ~of_json:Integer.of_json j
    let to_json v = composed_to_json to_value v
  end
module GroupedByAccount =
  struct
    type nonrec t = AccountStatistics.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:AccountStatistics.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:AccountStatistics.of_xml)
    let of_json j =
      list_of_json ~kind:"GroupedByAccount"
        ~of_json:AccountStatistics.of_json j
    let to_json v = composed_to_json to_value v
  end
module GroupedByDate =
  struct
    type nonrec t = DateStatistics.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:DateStatistics.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:DateStatistics.of_xml)
    let of_json j =
      list_of_json ~kind:"GroupedByDate" ~of_json:DateStatistics.of_json j
    let to_json v = composed_to_json to_value v
  end
module GroupedByFindingType =
  struct
    type nonrec t = FindingTypeStatistics.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:FindingTypeStatistics.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:FindingTypeStatistics.of_xml)
    let of_json j =
      list_of_json ~kind:"GroupedByFindingType"
        ~of_json:FindingTypeStatistics.of_json j
    let to_json v = composed_to_json to_value v
  end
module GroupedByResource =
  struct
    type nonrec t = ResourceStatistics.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ResourceStatistics.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ResourceStatistics.of_xml)
    let of_json j =
      list_of_json ~kind:"GroupedByResource"
        ~of_json:ResourceStatistics.of_json j
    let to_json v = composed_to_json to_value v
  end
module GroupedBySeverity =
  struct
    type nonrec t = SeverityStatistics.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:SeverityStatistics.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:SeverityStatistics.of_xml)
    let of_json j =
      list_of_json ~kind:"GroupedBySeverity"
        ~of_json:SeverityStatistics.of_json j
    let to_json v = composed_to_json to_value v
  end
module FindingStatisticType =
  struct
    type nonrec t =
      | COUNT_BY_SEVERITY 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | COUNT_BY_SEVERITY -> "COUNT_BY_SEVERITY"
      | Non_static_id s -> s
    let of_string =
      function
      | "COUNT_BY_SEVERITY" -> COUNT_BY_SEVERITY
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration FindingStatisticType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"FindingStatisticType" j)
    let to_json = simple_to_json to_value
  end
module Finding =
  struct
    type nonrec t =
      {
      accountId: String_.t option
        [@ocaml.doc
          "The ID of the account in which the finding was generated."];
      arn: String_.t option [@ocaml.doc "The ARN of the finding."];
      confidence: Double.t option
        [@ocaml.doc "The confidence score for the finding."];
      createdAt: String_.t option
        [@ocaml.doc "The time and date when the finding was created."];
      description: String_.t option
        [@ocaml.doc "The description of the finding."];
      id: String_.t option [@ocaml.doc "The ID of the finding."];
      partition: String_.t option
        [@ocaml.doc "The partition associated with the finding."];
      region: String_.t option
        [@ocaml.doc
          "The Region where the finding was generated. For findings generated from Global Service Events, the Region value in the finding might differ from the Region where GuardDuty identifies the potential threat. For more information, see How GuardDuty handles Amazon Web Services CloudTrail global events in the Amazon GuardDuty User Guide."];
      resource: Resource.t option ;
      schemaVersion: String_.t option
        [@ocaml.doc "The version of the schema used for the finding."];
      service: Service.t option ;
      severity: Double.t option [@ocaml.doc "The severity of the finding."];
      title: String_.t option [@ocaml.doc "The title of the finding."];
      type_: FindingType.t option [@ocaml.doc "The type of finding."];
      updatedAt: String_.t option
        [@ocaml.doc "The time and date when the finding was last updated."];
      associatedAttackSequenceArn: String_.t option
        [@ocaml.doc
          "Amazon Resource Name (ARN) associated with the attack sequence finding."]}
    let make ?accountId =
      fun ?arn ->
        fun ?confidence ->
          fun ?createdAt ->
            fun ?description ->
              fun ?id ->
                fun ?partition ->
                  fun ?region ->
                    fun ?resource ->
                      fun ?schemaVersion ->
                        fun ?service ->
                          fun ?severity ->
                            fun ?title ->
                              fun ?type_ ->
                                fun ?updatedAt ->
                                  fun ?associatedAttackSequenceArn ->
                                    fun () ->
                                      {
                                        accountId;
                                        arn;
                                        confidence;
                                        createdAt;
                                        description;
                                        id;
                                        partition;
                                        region;
                                        resource;
                                        schemaVersion;
                                        service;
                                        severity;
                                        title;
                                        type_;
                                        updatedAt;
                                        associatedAttackSequenceArn
                                      }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:String_.to_value));
        ("arn", (Option.map x.arn ~f:String_.to_value));
        ("confidence", (Option.map x.confidence ~f:Double.to_value));
        ("createdAt", (Option.map x.createdAt ~f:String_.to_value));
        ("description", (Option.map x.description ~f:String_.to_value));
        ("id", (Option.map x.id ~f:String_.to_value));
        ("partition", (Option.map x.partition ~f:String_.to_value));
        ("region", (Option.map x.region ~f:String_.to_value));
        ("resource", (Option.map x.resource ~f:Resource.to_value));
        ("schemaVersion", (Option.map x.schemaVersion ~f:String_.to_value));
        ("service", (Option.map x.service ~f:Service.to_value));
        ("severity", (Option.map x.severity ~f:Double.to_value));
        ("title", (Option.map x.title ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:FindingType.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:String_.to_value));
        ("associatedAttackSequenceArn",
          (Option.map x.associatedAttackSequenceArn ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let associatedAttackSequenceArn =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "associatedAttackSequenceArn") in
      let updatedAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let type_ =
        (Option.map ~f:FindingType.of_xml) (Xml.child xml_arg0 "type") in
      let title = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "title") in
      let severity =
        (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "severity") in
      let service =
        (Option.map ~f:Service.of_xml) (Xml.child xml_arg0 "service") in
      let schemaVersion =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "schemaVersion") in
      let resource =
        (Option.map ~f:Resource.of_xml) (Xml.child xml_arg0 "resource") in
      let region =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "region") in
      let partition =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "partition") in
      let id = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "id") in
      let description =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "description") in
      let createdAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "createdAt") in
      let confidence =
        (Option.map ~f:Double.of_xml) (Xml.child xml_arg0 "confidence") in
      let arn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "arn") in
      let accountId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?associatedAttackSequenceArn ?updatedAt ?type_ ?title ?severity
        ?service ?schemaVersion ?resource ?region ?partition ?id ?description
        ?createdAt ?confidence ?arn ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let associatedAttackSequenceArn =
        field_map json__ "AssociatedAttackSequenceArn" String_.of_json in
      let updatedAt = field_map json__ "UpdatedAt" String_.of_json in
      let type_ = field_map json__ "Type" FindingType.of_json in
      let title = field_map json__ "Title" String_.of_json in
      let severity = field_map json__ "Severity" Double.of_json in
      let service = field_map json__ "Service" Service.of_json in
      let schemaVersion = field_map json__ "SchemaVersion" String_.of_json in
      let resource = field_map json__ "Resource" Resource.of_json in
      let region = field_map json__ "Region" String_.of_json in
      let partition = field_map json__ "Partition" String_.of_json in
      let id = field_map json__ "Id" String_.of_json in
      let description = field_map json__ "Description" String_.of_json in
      let createdAt = field_map json__ "CreatedAt" String_.of_json in
      let confidence = field_map json__ "Confidence" Double.of_json in
      let arn = field_map json__ "Arn" String_.of_json in
      let accountId = field_map json__ "AccountId" String_.of_json in
      make ?associatedAttackSequenceArn ?updatedAt ?type_ ?title ?severity
        ?service ?schemaVersion ?resource ?region ?partition ?id ?description
        ?createdAt ?confidence ?arn ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the finding that is generated when abnormal or suspicious activity is detected."]
module DetectorFeatureConfigurationResult =
  struct
    type nonrec t =
      {
      name: DetectorFeatureResult.t option
        [@ocaml.doc
          "Indicates the name of the feature that can be enabled for the detector."];
      status: FeatureStatus.t option
        [@ocaml.doc
          "Indicates the status of the feature that is enabled for the detector."];
      updatedAt: Timestamp.t option
        [@ocaml.doc "The timestamp at which the feature object was updated."];
      additionalConfiguration:
        DetectorAdditionalConfigurationResults.t option
        [@ocaml.doc "Additional configuration for a resource."]}
    let make ?name =
      fun ?status ->
        fun ?updatedAt ->
          fun ?additionalConfiguration ->
            fun () -> { name; status; updatedAt; additionalConfiguration }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:DetectorFeatureResult.to_value));
        ("status", (Option.map x.status ~f:FeatureStatus.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value));
        ("additionalConfiguration",
          (Option.map x.additionalConfiguration
             ~f:DetectorAdditionalConfigurationResults.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalConfiguration =
        (Option.map ~f:DetectorAdditionalConfigurationResults.of_xml)
          (Xml.child xml_arg0 "additionalConfiguration") in
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let status =
        (Option.map ~f:FeatureStatus.of_xml) (Xml.child xml_arg0 "status") in
      let name =
        (Option.map ~f:DetectorFeatureResult.of_xml)
          (Xml.child xml_arg0 "name") in
      make ?additionalConfiguration ?updatedAt ?status ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalConfiguration =
        field_map json__ "AdditionalConfiguration"
          DetectorAdditionalConfigurationResults.of_json in
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      let status = field_map json__ "Status" FeatureStatus.of_json in
      let name = field_map json__ "Name" DetectorFeatureResult.of_json in
      make ?additionalConfiguration ?updatedAt ?status ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about a GuardDuty feature. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring."]
module CountByCoverageStatus =
  struct
    type nonrec t = (CoverageStatus.t * Long.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            ((CoverageStatus.of_string chopped),
                              (Long.of_string v))))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (CoverageStatus.to_value x) |>
                    (fun x -> (Long.to_value y) |> (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:CoverageStatus.of_string
        ~of_json:Long.of_json j
    let to_json v = composed_to_json to_value v
  end
module CountByResourceType =
  struct
    type nonrec t = (ResourceType.t * Long.t) list
    let make i = i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            ((ResourceType.of_string chopped),
                              (Long.of_string v))))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (ResourceType.to_value x) |>
                    (fun x -> (Long.to_value y) |> (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:ResourceType.of_string
        ~of_json:Long.of_json j
    let to_json v = composed_to_json to_value v
  end
module CoverageStatisticsType =
  struct
    type nonrec t =
      | COUNT_BY_RESOURCE_TYPE 
      | COUNT_BY_COVERAGE_STATUS 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | COUNT_BY_RESOURCE_TYPE -> "COUNT_BY_RESOURCE_TYPE"
      | COUNT_BY_COVERAGE_STATUS -> "COUNT_BY_COVERAGE_STATUS"
      | Non_static_id s -> s
    let of_string =
      function
      | "COUNT_BY_RESOURCE_TYPE" -> COUNT_BY_RESOURCE_TYPE
      | "COUNT_BY_COVERAGE_STATUS" -> COUNT_BY_COVERAGE_STATUS
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration CoverageStatisticsType" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"CoverageStatisticsType" j)
    let to_json = simple_to_json to_value
  end
module OrganizationKubernetesConfigurationResult =
  struct
    type nonrec t =
      {
      auditLogs: OrganizationKubernetesAuditLogsConfigurationResult.t option
        [@ocaml.doc
          "The current configuration of Kubernetes audit logs as a data source for the organization."]}
    let make ?auditLogs = fun () -> { auditLogs }
    let to_value x =
      structure_to_value
        [("auditLogs",
           (Option.map x.auditLogs
              ~f:OrganizationKubernetesAuditLogsConfigurationResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let auditLogs =
        (Option.map
           ~f:OrganizationKubernetesAuditLogsConfigurationResult.of_xml)
          (Xml.child xml_arg0 "auditLogs") in
      make ?auditLogs ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let auditLogs =
        field_map json__ "AuditLogs"
          OrganizationKubernetesAuditLogsConfigurationResult.of_json in
      make ?auditLogs ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "The current configuration of all Kubernetes data sources for the organization."]
module OrganizationMalwareProtectionConfigurationResult =
  struct
    type nonrec t =
      {
      scanEc2InstanceWithFindings:
        OrganizationScanEc2InstanceWithFindingsResult.t option
        [@ocaml.doc
          "Describes the configuration for scanning EC2 instances with findings for an organization."]}
    let make ?scanEc2InstanceWithFindings =
      fun () -> { scanEc2InstanceWithFindings }
    let to_value x =
      structure_to_value
        [("scanEc2InstanceWithFindings",
           (Option.map x.scanEc2InstanceWithFindings
              ~f:OrganizationScanEc2InstanceWithFindingsResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanEc2InstanceWithFindings =
        (Option.map ~f:OrganizationScanEc2InstanceWithFindingsResult.of_xml)
          (Xml.child xml_arg0 "scanEc2InstanceWithFindings") in
      make ?scanEc2InstanceWithFindings ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanEc2InstanceWithFindings =
        field_map json__ "ScanEc2InstanceWithFindings"
          OrganizationScanEc2InstanceWithFindingsResult.of_json in
      make ?scanEc2InstanceWithFindings ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "An object that contains information on the status of all Malware Protection data source for an organization."]
module OrganizationS3LogsConfigurationResult =
  struct
    type nonrec t =
      {
      autoEnable: Boolean.t option
        [@ocaml.doc
          "A value that describes whether S3 data event logs are automatically enabled for new members of the organization."]}
    let make ?autoEnable = fun () -> { autoEnable }
    let to_value x =
      structure_to_value
        [("autoEnable", (Option.map x.autoEnable ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnable =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "autoEnable") in
      make ?autoEnable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnable = field_map json__ "AutoEnable" Boolean.of_json in
      make ?autoEnable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "The current configuration of S3 data event logs as a data source for the organization."]
module OrganizationFeatureConfigurationResult =
  struct
    type nonrec t =
      {
      name: OrgFeature.t option
        [@ocaml.doc
          "The name of the feature that is configured for the member accounts within the organization."];
      autoEnable: OrgFeatureStatus.t option
        [@ocaml.doc
          "Describes the status of the feature that is configured for the member accounts within the organization. NEW: Indicates that when a new account joins the organization, they will have the feature enabled automatically. ALL: Indicates that all accounts in the organization have the feature enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. NONE: Indicates that the feature will not be automatically enabled for any account in the organization. In this case, each account will be managed individually by the administrator."];
      additionalConfiguration:
        OrganizationAdditionalConfigurationResults.t option
        [@ocaml.doc
          "The additional configuration that is configured for the member accounts within the organization."]}
    let make ?name =
      fun ?autoEnable ->
        fun ?additionalConfiguration ->
          fun () -> { name; autoEnable; additionalConfiguration }
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:OrgFeature.to_value));
        ("autoEnable",
          (Option.map x.autoEnable ~f:OrgFeatureStatus.to_value));
        ("additionalConfiguration",
          (Option.map x.additionalConfiguration
             ~f:OrganizationAdditionalConfigurationResults.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let additionalConfiguration =
        (Option.map ~f:OrganizationAdditionalConfigurationResults.of_xml)
          (Xml.child xml_arg0 "additionalConfiguration") in
      let autoEnable =
        (Option.map ~f:OrgFeatureStatus.of_xml)
          (Xml.child xml_arg0 "autoEnable") in
      let name =
        (Option.map ~f:OrgFeature.of_xml) (Xml.child xml_arg0 "name") in
      make ?additionalConfiguration ?autoEnable ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let additionalConfiguration =
        field_map json__ "AdditionalConfiguration"
          OrganizationAdditionalConfigurationResults.of_json in
      let autoEnable = field_map json__ "AutoEnable" OrgFeatureStatus.of_json in
      let name = field_map json__ "Name" OrgFeature.of_json in
      make ?additionalConfiguration ?autoEnable ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "A list of features which will be configured for the organization."]
module Scan =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t option
        [@ocaml.doc
          "The unique ID of the detector that is associated with the request. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      adminDetectorId: DetectorId.t option
        [@ocaml.doc
          "The unique detector ID of the administrator account that the request is associated with. If the account is an administrator, the AdminDetectorId will be the same as the one used for DetectorId. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      scanId: NonEmptyString.t option
        [@ocaml.doc "The unique scan ID associated with a scan entry."];
      scanStatus: ScanStatus.t option
        [@ocaml.doc "An enum value representing possible scan statuses."];
      failureReason: NonEmptyString.t option
        [@ocaml.doc "Represents the reason for FAILED scan status."];
      scanStartTime: Timestamp.t option
        [@ocaml.doc "The timestamp of when the scan was triggered."];
      scanEndTime: Timestamp.t option
        [@ocaml.doc "The timestamp of when the scan was finished."];
      triggerDetails: TriggerDetails.t option
        [@ocaml.doc "Specifies the reason why the scan was initiated."];
      resourceDetails: ResourceDetails.t option
        [@ocaml.doc
          "Represents the resources that were scanned in the scan entry."];
      scanResultDetails: ScanResultDetails.t option
        [@ocaml.doc "Represents the result of the scan."];
      accountId: AccountId.t option
        [@ocaml.doc "The ID for the account that belongs to the scan."];
      totalBytes: PositiveLong.t option
        [@ocaml.doc "Represents total bytes that were scanned."];
      fileCount: PositiveLong.t option
        [@ocaml.doc "Represents the number of files that were scanned."];
      attachedVolumes: VolumeDetails.t option
        [@ocaml.doc
          "List of volumes that were attached to the original instance to be scanned."];
      scanType: ScanType.t option
        [@ocaml.doc "Specifies the scan type that invoked the malware scan."]}
    let make ?detectorId =
      fun ?adminDetectorId ->
        fun ?scanId ->
          fun ?scanStatus ->
            fun ?failureReason ->
              fun ?scanStartTime ->
                fun ?scanEndTime ->
                  fun ?triggerDetails ->
                    fun ?resourceDetails ->
                      fun ?scanResultDetails ->
                        fun ?accountId ->
                          fun ?totalBytes ->
                            fun ?fileCount ->
                              fun ?attachedVolumes ->
                                fun ?scanType ->
                                  fun () ->
                                    {
                                      detectorId;
                                      adminDetectorId;
                                      scanId;
                                      scanStatus;
                                      failureReason;
                                      scanStartTime;
                                      scanEndTime;
                                      triggerDetails;
                                      resourceDetails;
                                      scanResultDetails;
                                      accountId;
                                      totalBytes;
                                      fileCount;
                                      attachedVolumes;
                                      scanType
                                    }
    let to_value x =
      structure_to_value
        [("detectorId", (Option.map x.detectorId ~f:DetectorId.to_value));
        ("adminDetectorId",
          (Option.map x.adminDetectorId ~f:DetectorId.to_value));
        ("scanId", (Option.map x.scanId ~f:NonEmptyString.to_value));
        ("scanStatus", (Option.map x.scanStatus ~f:ScanStatus.to_value));
        ("failureReason",
          (Option.map x.failureReason ~f:NonEmptyString.to_value));
        ("scanStartTime", (Option.map x.scanStartTime ~f:Timestamp.to_value));
        ("scanEndTime", (Option.map x.scanEndTime ~f:Timestamp.to_value));
        ("triggerDetails",
          (Option.map x.triggerDetails ~f:TriggerDetails.to_value));
        ("resourceDetails",
          (Option.map x.resourceDetails ~f:ResourceDetails.to_value));
        ("scanResultDetails",
          (Option.map x.scanResultDetails ~f:ScanResultDetails.to_value));
        ("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("totalBytes", (Option.map x.totalBytes ~f:PositiveLong.to_value));
        ("fileCount", (Option.map x.fileCount ~f:PositiveLong.to_value));
        ("attachedVolumes",
          (Option.map x.attachedVolumes ~f:VolumeDetails.to_value));
        ("scanType", (Option.map x.scanType ~f:ScanType.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanType =
        (Option.map ~f:ScanType.of_xml) (Xml.child xml_arg0 "scanType") in
      let attachedVolumes =
        (Option.map ~f:VolumeDetails.of_xml)
          (Xml.child xml_arg0 "attachedVolumes") in
      let fileCount =
        (Option.map ~f:PositiveLong.of_xml) (Xml.child xml_arg0 "fileCount") in
      let totalBytes =
        (Option.map ~f:PositiveLong.of_xml) (Xml.child xml_arg0 "totalBytes") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      let scanResultDetails =
        (Option.map ~f:ScanResultDetails.of_xml)
          (Xml.child xml_arg0 "scanResultDetails") in
      let resourceDetails =
        (Option.map ~f:ResourceDetails.of_xml)
          (Xml.child xml_arg0 "resourceDetails") in
      let triggerDetails =
        (Option.map ~f:TriggerDetails.of_xml)
          (Xml.child xml_arg0 "triggerDetails") in
      let scanEndTime =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "scanEndTime") in
      let scanStartTime =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "scanStartTime") in
      let failureReason =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "failureReason") in
      let scanStatus =
        (Option.map ~f:ScanStatus.of_xml) (Xml.child xml_arg0 "scanStatus") in
      let scanId =
        (Option.map ~f:NonEmptyString.of_xml) (Xml.child xml_arg0 "scanId") in
      let adminDetectorId =
        (Option.map ~f:DetectorId.of_xml)
          (Xml.child xml_arg0 "adminDetectorId") in
      let detectorId =
        (Option.map ~f:DetectorId.of_xml) (Xml.child xml_arg0 "detectorId") in
      make ?scanType ?attachedVolumes ?fileCount ?totalBytes ?accountId
        ?scanResultDetails ?resourceDetails ?triggerDetails ?scanEndTime
        ?scanStartTime ?failureReason ?scanStatus ?scanId ?adminDetectorId
        ?detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanType = field_map json__ "ScanType" ScanType.of_json in
      let attachedVolumes =
        field_map json__ "AttachedVolumes" VolumeDetails.of_json in
      let fileCount = field_map json__ "FileCount" PositiveLong.of_json in
      let totalBytes = field_map json__ "TotalBytes" PositiveLong.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      let scanResultDetails =
        field_map json__ "ScanResultDetails" ScanResultDetails.of_json in
      let resourceDetails =
        field_map json__ "ResourceDetails" ResourceDetails.of_json in
      let triggerDetails =
        field_map json__ "TriggerDetails" TriggerDetails.of_json in
      let scanEndTime = field_map json__ "ScanEndTime" Timestamp.of_json in
      let scanStartTime = field_map json__ "ScanStartTime" Timestamp.of_json in
      let failureReason =
        field_map json__ "FailureReason" NonEmptyString.of_json in
      let scanStatus = field_map json__ "ScanStatus" ScanStatus.of_json in
      let scanId = field_map json__ "ScanId" NonEmptyString.of_json in
      let adminDetectorId =
        field_map json__ "AdminDetectorId" DetectorId.of_json in
      let detectorId = field_map json__ "DetectorId" DetectorId.of_json in
      make ?scanType ?attachedVolumes ?fileCount ?totalBytes ?accountId
        ?scanResultDetails ?resourceDetails ?triggerDetails ?scanEndTime
        ?scanStartTime ?failureReason ?scanStatus ?scanId ?adminDetectorId
        ?detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about malware scans associated with GuardDuty Malware Protection for EC2."]
module FilterCriterionList =
  struct
    type nonrec t = FilterCriterion.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:1) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:FilterCriterion.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:FilterCriterion.of_xml)
    let of_json j =
      list_of_json ~kind:"FilterCriterionList"
        ~of_json:FilterCriterion.of_json j
    let to_json v = composed_to_json to_value v
  end
module AccountDetail =
  struct
    type nonrec t =
      {
      accountId: AccountId.t [@ocaml.doc "The member account ID."];
      email: Email.t
        [@ocaml.doc
          "The email address of the member account. The following list includes the rules for a valid email address: The email address must be a minimum of 6 and a maximum of 64 characters long. All characters must be 7-bit ASCII characters. There must be one and only one \\@ symbol, which separates the local name from the domain name. The local name can't contain any of the following characters: whitespace, \" ' ( ) < > \\[ \\] : ' , \\ | % & The local name can't begin with a dot (.). The domain name can consist of only the characters \\[a-z\\], \\[A-Z\\], \\[0-9\\], hyphen (-), or dot (.). The domain name can't begin or end with a dot (.) or hyphen (-). The domain name must contain at least one dot."]}
    let context_ = "AccountDetail"
    let make ~accountId = fun ~email -> fun () -> { accountId; email }
    let to_value x =
      structure_to_value
        [("accountId", (Some (AccountId.to_value x.accountId)));
        ("email", (Some (Email.to_value x.email)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let email =
        Email.of_xml (Xml.child_exn ~context:context_ xml_arg0 "email") in
      let accountId =
        AccountId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountId") in
      make ~email ~accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let email = field_map_exn json__ "Email" Email.of_json in
      let accountId = field_map_exn json__ "AccountId" AccountId.of_json in
      make ~email ~accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about the account."]
module BadRequestException =
  struct
    type nonrec t =
      {
      message: String_.t option [@ocaml.doc "The error message."];
      type_: String_.t option [@ocaml.doc "The error type."]}
    let make ?message = fun ?type_ -> fun () -> { message; type_ }
    let to_value x =
      structure_to_value
        [("message", (Option.map x.message ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let message =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "message") in
      make ?type_ ?message ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let type_ = field_map json__ "Type" String_.of_json in
      let message = field_map json__ "Message" String_.of_json in
      make ?type_ ?message ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "A bad request exception object."]
module InternalServerErrorException =
  struct
    type nonrec t =
      {
      message: String_.t option [@ocaml.doc "The error message."];
      type_: String_.t option [@ocaml.doc "The error type."]}
    let make ?message = fun ?type_ -> fun () -> { message; type_ }
    let to_value x =
      structure_to_value
        [("message", (Option.map x.message ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let message =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "message") in
      make ?type_ ?message ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let type_ = field_map json__ "Type" String_.of_json in
      let message = field_map json__ "Message" String_.of_json in
      make ?type_ ?message ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "An internal server error exception object."]
module ExpectedBucketOwner =
  struct
    type nonrec t = string
    let context_ = "ExpectedBucketOwner"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_min i ~min:12) >>=
             (fun () ->
                (check_string_max i ~max:12) >>=
                  (fun () -> check_pattern i ~pattern:"[0-9]+")));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"ExpectedBucketOwner" j
    let to_json = simple_to_json to_value
  end
module Location =
  struct
    type nonrec t = string
    let context_ = "Location"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:300) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"Location" j
    let to_json = simple_to_json to_value
  end
module Name =
  struct
    type nonrec t = string
    let context_ = "Name"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:300) >>=
             (fun () -> check_string_min i ~min:1));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"Name" j
    let to_json = simple_to_json to_value
  end
module AccessDeniedException =
  struct
    type nonrec t =
      {
      message: String_.t option [@ocaml.doc "The error message."];
      type_: String_.t option [@ocaml.doc "The error type."]}
    let make ?message = fun ?type_ -> fun () -> { message; type_ }
    let to_value x =
      structure_to_value
        [("message", (Option.map x.message ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let message =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "message") in
      make ?type_ ?message ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let type_ = field_map json__ "Type" String_.of_json in
      let message = field_map json__ "Message" String_.of_json in
      make ?type_ ?message ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "An access denied exception object."]
module DestinationProperties =
  struct
    type nonrec t =
      {
      destinationArn: String_.t option
        [@ocaml.doc
          "The ARN of the resource to publish to. To specify an S3 bucket folder use the following format: arn:aws:s3:::DOC-EXAMPLE-BUCKET/myFolder/"];
      kmsKeyArn: String_.t option
        [@ocaml.doc "The ARN of the KMS key to use for encryption."]}
    let make ?destinationArn =
      fun ?kmsKeyArn -> fun () -> { destinationArn; kmsKeyArn }
    let to_value x =
      structure_to_value
        [("destinationArn",
           (Option.map x.destinationArn ~f:String_.to_value));
        ("kmsKeyArn", (Option.map x.kmsKeyArn ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let kmsKeyArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "kmsKeyArn") in
      let destinationArn =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "destinationArn") in
      make ?kmsKeyArn ?destinationArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let kmsKeyArn = field_map json__ "KmsKeyArn" String_.of_json in
      let destinationArn = field_map json__ "DestinationArn" String_.of_json in
      make ?kmsKeyArn ?destinationArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings."]
module AutoEnableMembers =
  struct
    type nonrec t =
      | NEW 
      | ALL 
      | NONE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | NEW -> "NEW"
      | ALL -> "ALL"
      | NONE -> "NONE"
      | Non_static_id s -> s
    let of_string =
      function
      | "NEW" -> NEW
      | "ALL" -> ALL
      | "NONE" -> NONE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration AutoEnableMembers" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"AutoEnableMembers" j)
    let to_json = simple_to_json to_value
  end
module OrganizationDataSourceConfigurations =
  struct
    type nonrec t =
      {
      s3Logs: OrganizationS3LogsConfiguration.t option
        [@ocaml.doc
          "Describes whether S3 data event logs are enabled for new members of the organization."];
      kubernetes: OrganizationKubernetesConfiguration.t option
        [@ocaml.doc
          "Describes the configuration of Kubernetes data sources for new members of the organization."];
      malwareProtection: OrganizationMalwareProtectionConfiguration.t option
        [@ocaml.doc
          "Describes the configuration of Malware Protection for new members of the organization."]}
    let make ?s3Logs =
      fun ?kubernetes ->
        fun ?malwareProtection ->
          fun () -> { s3Logs; kubernetes; malwareProtection }
    let to_value x =
      structure_to_value
        [("s3Logs",
           (Option.map x.s3Logs ~f:OrganizationS3LogsConfiguration.to_value));
        ("kubernetes",
          (Option.map x.kubernetes
             ~f:OrganizationKubernetesConfiguration.to_value));
        ("malwareProtection",
          (Option.map x.malwareProtection
             ~f:OrganizationMalwareProtectionConfiguration.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtection =
        (Option.map ~f:OrganizationMalwareProtectionConfiguration.of_xml)
          (Xml.child xml_arg0 "malwareProtection") in
      let kubernetes =
        (Option.map ~f:OrganizationKubernetesConfiguration.of_xml)
          (Xml.child xml_arg0 "kubernetes") in
      let s3Logs =
        (Option.map ~f:OrganizationS3LogsConfiguration.of_xml)
          (Xml.child xml_arg0 "s3Logs") in
      make ?malwareProtection ?kubernetes ?s3Logs ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtection =
        field_map json__ "MalwareProtection"
          OrganizationMalwareProtectionConfiguration.of_json in
      let kubernetes =
        field_map json__ "Kubernetes"
          OrganizationKubernetesConfiguration.of_json in
      let s3Logs =
        field_map json__ "S3Logs" OrganizationS3LogsConfiguration.of_json in
      make ?malwareProtection ?kubernetes ?s3Logs ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "An object that contains information on which data sources will be configured to be automatically enabled for new members within the organization."]
module OrganizationFeaturesConfigurations =
  struct
    type nonrec t = OrganizationFeatureConfiguration.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:OrganizationFeatureConfiguration.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:OrganizationFeatureConfiguration.of_xml)
    let of_json j =
      list_of_json ~kind:"OrganizationFeaturesConfigurations"
        ~of_json:OrganizationFeatureConfiguration.of_json j
    let to_json v = composed_to_json to_value v
  end
module UnprocessedAccounts =
  struct
    type nonrec t = UnprocessedAccount.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:UnprocessedAccount.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:UnprocessedAccount.of_xml)
    let of_json j =
      list_of_json ~kind:"UnprocessedAccounts"
        ~of_json:UnprocessedAccount.of_json j
    let to_json v = composed_to_json to_value v
  end
module DataSourceConfigurations =
  struct
    type nonrec t =
      {
      s3Logs: S3LogsConfiguration.t option
        [@ocaml.doc
          "Describes whether S3 data event logs are enabled as a data source."];
      kubernetes: KubernetesConfiguration.t option
        [@ocaml.doc
          "Describes whether any Kubernetes logs are enabled as data sources."];
      malwareProtection: MalwareProtectionConfiguration.t option
        [@ocaml.doc
          "Describes whether Malware Protection is enabled as a data source."]}
    let make ?s3Logs =
      fun ?kubernetes ->
        fun ?malwareProtection ->
          fun () -> { s3Logs; kubernetes; malwareProtection }
    let to_value x =
      structure_to_value
        [("s3Logs", (Option.map x.s3Logs ~f:S3LogsConfiguration.to_value));
        ("kubernetes",
          (Option.map x.kubernetes ~f:KubernetesConfiguration.to_value));
        ("malwareProtection",
          (Option.map x.malwareProtection
             ~f:MalwareProtectionConfiguration.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtection =
        (Option.map ~f:MalwareProtectionConfiguration.of_xml)
          (Xml.child xml_arg0 "malwareProtection") in
      let kubernetes =
        (Option.map ~f:KubernetesConfiguration.of_xml)
          (Xml.child xml_arg0 "kubernetes") in
      let s3Logs =
        (Option.map ~f:S3LogsConfiguration.of_xml)
          (Xml.child xml_arg0 "s3Logs") in
      make ?malwareProtection ?kubernetes ?s3Logs ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtection =
        field_map json__ "MalwareProtection"
          MalwareProtectionConfiguration.of_json in
      let kubernetes =
        field_map json__ "Kubernetes" KubernetesConfiguration.of_json in
      let s3Logs = field_map json__ "S3Logs" S3LogsConfiguration.of_json in
      make ?malwareProtection ?kubernetes ?s3Logs ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about which data sources are enabled."]
module MemberFeaturesConfigurations =
  struct
    type nonrec t = MemberFeaturesConfiguration.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:MemberFeaturesConfiguration.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:MemberFeaturesConfiguration.of_xml)
    let of_json j =
      list_of_json ~kind:"MemberFeaturesConfigurations"
        ~of_json:MemberFeaturesConfiguration.of_json j
    let to_json v = composed_to_json to_value v
  end
module EbsSnapshotPreservation =
  struct
    type nonrec t =
      | NO_RETENTION 
      | RETENTION_WITH_FINDING 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | NO_RETENTION -> "NO_RETENTION"
      | RETENTION_WITH_FINDING -> "RETENTION_WITH_FINDING"
      | Non_static_id s -> s
    let of_string =
      function
      | "NO_RETENTION" -> NO_RETENTION
      | "RETENTION_WITH_FINDING" -> RETENTION_WITH_FINDING
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration EbsSnapshotPreservation" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"EbsSnapshotPreservation" j)
    let to_json = simple_to_json to_value
  end
module ScanResourceCriteria =
  struct
    type nonrec t =
      {
      include_: ScanCriterion.t option
        [@ocaml.doc
          "Represents condition that when matched will allow a malware scan for a certain resource."];
      exclude: ScanCriterion.t option
        [@ocaml.doc
          "Represents condition that when matched will prevent a malware scan for a certain resource."]}
    let make ?include_ = fun ?exclude -> fun () -> { include_; exclude }
    let to_value x =
      structure_to_value
        [("include", (Option.map x.include_ ~f:ScanCriterion.to_value));
        ("exclude", (Option.map x.exclude ~f:ScanCriterion.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let exclude =
        (Option.map ~f:ScanCriterion.of_xml) (Xml.child xml_arg0 "exclude") in
      let include_ =
        (Option.map ~f:ScanCriterion.of_xml) (Xml.child xml_arg0 "include") in
      make ?exclude ?include_ ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let exclude = field_map json__ "Exclude" ScanCriterion.of_json in
      let include_ = field_map json__ "Include" ScanCriterion.of_json in
      make ?exclude ?include_ ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about criteria used to filter resources before triggering malware scan."]
module MalwareProtectionPlanActions =
  struct
    type nonrec t =
      {
      tagging: MalwareProtectionPlanTaggingAction.t option
        [@ocaml.doc
          "Indicates whether the scanned S3 object will have tags about the scan result."]}
    let make ?tagging = fun () -> { tagging }
    let to_value x =
      structure_to_value
        [("tagging",
           (Option.map x.tagging
              ~f:MalwareProtectionPlanTaggingAction.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tagging =
        (Option.map ~f:MalwareProtectionPlanTaggingAction.of_xml)
          (Xml.child xml_arg0 "tagging") in
      make ?tagging ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tagging =
        field_map json__ "Tagging" MalwareProtectionPlanTaggingAction.of_json in
      make ?tagging ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about whether the tags will be added to the S3 object after scanning."]
module UpdateProtectedResource =
  struct
    type nonrec t =
      {
      s3Bucket: UpdateS3BucketResource.t option
        [@ocaml.doc "Information about the protected S3 bucket resource."]}
    let make ?s3Bucket = fun () -> { s3Bucket }
    let to_value x =
      structure_to_value
        [("s3Bucket",
           (Option.map x.s3Bucket ~f:UpdateS3BucketResource.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let s3Bucket =
        (Option.map ~f:UpdateS3BucketResource.of_xml)
          (Xml.child xml_arg0 "s3Bucket") in
      make ?s3Bucket ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let s3Bucket =
        field_map json__ "S3Bucket" UpdateS3BucketResource.of_json in
      make ?s3Bucket ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource."]
module Feedback =
  struct
    type nonrec t =
      | USEFUL 
      | NOT_USEFUL 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | USEFUL -> "USEFUL"
      | NOT_USEFUL -> "NOT_USEFUL"
      | Non_static_id s -> s
    let of_string =
      function
      | "USEFUL" -> USEFUL
      | "NOT_USEFUL" -> NOT_USEFUL
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration Feedback" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"Feedback" j)
    let to_json = simple_to_json to_value
  end
module FindingIds =
  struct
    type nonrec t = FindingId.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:FindingId.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:FindingId.of_xml)
    let of_json j =
      list_of_json ~kind:"FindingIds" ~of_json:FindingId.of_json j
    let to_json v = composed_to_json to_value v
  end
module FilterAction =
  struct
    type nonrec t =
      | NOOP 
      | ARCHIVE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function | NOOP -> "NOOP" | ARCHIVE -> "ARCHIVE" | Non_static_id s -> s
    let of_string =
      function | "NOOP" -> NOOP | "ARCHIVE" -> ARCHIVE | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration FilterAction" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"FilterAction" j)
    let to_json = simple_to_json to_value
  end
module FilterDescription =
  struct
    type nonrec t = string
    let context_ = "FilterDescription"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:512) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"FilterDescription" j
    let to_json = simple_to_json to_value
  end
module FilterRank =
  struct
    type nonrec t = int
    let make i =
      let open Result in
        ok_or_failwith
          ((check_int_max i ~max:100) >>= (fun () -> check_int_min i ~min:1));
        i
    let of_string = Int.of_string
    let to_value x = `Integer x
    let to_query v = to_query to_value v
    let to_header x = Int.to_string x
    let of_xml xml_arg0 =
      Int.of_string
        (string_of_xml ~kind:"an integer for FilterRank" xml_arg0)
    let of_json j = Int.of_float (float_of_json ~kind:"an integer" j)
    let to_json = simple_to_json to_value
  end
module FindingCriteria =
  struct
    type nonrec t =
      {
      criterion: Criterion.t option
        [@ocaml.doc
          "Represents a map of finding properties that match specified conditions and values when querying findings."]}
    let make ?criterion = fun () -> { criterion }
    let to_value x =
      structure_to_value
        [("criterion", (Option.map x.criterion ~f:Criterion.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let criterion =
        (Option.map ~f:Criterion.of_xml) (Xml.child xml_arg0 "criterion") in
      make ?criterion ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let criterion = field_map json__ "Criterion" Criterion.of_json in
      make ?criterion ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the criteria used for querying findings."]
module DetectorFeatureConfigurations =
  struct
    type nonrec t = DetectorFeatureConfiguration.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:DetectorFeatureConfiguration.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:DetectorFeatureConfiguration.of_xml)
    let of_json j =
      list_of_json ~kind:"DetectorFeatureConfigurations"
        ~of_json:DetectorFeatureConfiguration.of_json j
    let to_json v = composed_to_json to_value v
  end
module FindingPublishingFrequency =
  struct
    type nonrec t =
      | FIFTEEN_MINUTES 
      | ONE_HOUR 
      | SIX_HOURS 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | FIFTEEN_MINUTES -> "FIFTEEN_MINUTES"
      | ONE_HOUR -> "ONE_HOUR"
      | SIX_HOURS -> "SIX_HOURS"
      | Non_static_id s -> s
    let of_string =
      function
      | "FIFTEEN_MINUTES" -> FIFTEEN_MINUTES
      | "ONE_HOUR" -> ONE_HOUR
      | "SIX_HOURS" -> SIX_HOURS
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration FindingPublishingFrequency"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"FindingPublishingFrequency" j)
    let to_json = simple_to_json to_value
  end
module GuardDutyArn =
  struct
    type nonrec t = string
    let context_ = "GuardDutyArn"
    let make i =
      let open Result in
        ok_or_failwith
          (check_pattern i
             ~pattern:"arn:[A-Za-z_.-]{1,20}:guardduty:[A-Za-z0-9_/.-]{0,63}:\\d+:detector/[A-Za-z0-9_/.-]{32,264}");
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"GuardDutyArn" j
    let to_json = simple_to_json to_value
  end
module TagKeyList =
  struct
    type nonrec t = TagKey.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:200) >>=
             (fun () -> check_list_min i ~min:1));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:TagKey.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:TagKey.of_xml)
    let of_json j = list_of_json ~kind:"TagKeyList" ~of_json:TagKey.of_json j
    let to_json v = composed_to_json to_value v
  end
module TagMap =
  struct
    type nonrec t = (TagKey.t * TagValue.t) list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:200) >>=
             (fun () -> check_list_min i ~min:1));
        i
    let of_header xs =
      make
        (List.filter_map xs
           ~f:(fun (k, v) ->
                 (Base.String.chop_prefix k ~prefix:"x-amz-meta-") |>
                   (Option.map
                      ~f:(fun chopped ->
                            ((TagKey.of_string chopped),
                              (TagValue.of_string v))))))
    let to_value xs =
      (xs |>
         (List.map
            ~f:(fun (x, y) ->
                  (TagKey.to_value x) |>
                    (fun x -> (TagValue.to_value y) |> (fun y -> (x, y))))))
        |> (fun x -> `Map x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for Map_shape objects" ()
    let of_xml _ =
      failwith "of_xml_converter_of_shape: Map_shape case not implemented"
    let of_json j =
      object_of_json ~key_of_string:TagKey.of_string
        ~of_json:TagValue.of_json j
    let to_json v = composed_to_json to_value v
  end
module ConflictException =
  struct
    type nonrec t =
      {
      message: String_.t option [@ocaml.doc "The error message."];
      type_: String_.t option [@ocaml.doc "The error type."]}
    let make ?message = fun ?type_ -> fun () -> { message; type_ }
    let to_value x =
      structure_to_value
        [("message", (Option.map x.message ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let message =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "message") in
      make ?type_ ?message ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let type_ = field_map json__ "Type" String_.of_json in
      let message = field_map json__ "Message" String_.of_json in
      make ?type_ ?message ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "A request conflict exception object."]
module ClientToken =
  struct
    type nonrec t = string
    let context_ = "ClientToken"
    let make i =
      let open Result in
        ok_or_failwith
          ((check_string_max i ~max:64) >>=
             (fun () -> check_string_min i ~min:0));
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"ClientToken" j
    let to_json = simple_to_json to_value
  end
module ResourceArn =
  struct
    type nonrec t = string
    let context_ = "ResourceArn"
    let make i =
      let open Result in
        ok_or_failwith
          (check_pattern i
             ~pattern:"arn:[A-Za-z-]+:[A-Za-z0-9]+:[A-Za-z0-9-]+:\\d+:(([A-Za-z0-9-]+)[:\\/])?[A-Za-z0-9:-]*");
        i
    let of_string x = x
    let to_value x = `String x
    let to_query v = to_query to_value v
    let to_header x = x
    let of_xml = Xml.string_data_exn ~context:context_
    let of_json j = string_of_json ~kind:"ResourceArn" j
    let to_json = simple_to_json to_value
  end
module StartMalwareScanConfiguration =
  struct
    type nonrec t =
      {
      role: NonEmptyString.t
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the IAM role that is used for scanning the resource."];
      incrementalScanDetails: IncrementalScanDetails.t option
        [@ocaml.doc
          "Contains information about the incremental scan configuration. When specified, the scan will only process changes since the baseline resource."];
      recoveryPoint: RecoveryPoint.t option
        [@ocaml.doc
          "Contains information about the recovery point configuration for the requested scan."]}
    let context_ = "StartMalwareScanConfiguration"
    let make ?incrementalScanDetails =
      fun ?recoveryPoint ->
        fun ~role ->
          fun () -> { incrementalScanDetails; recoveryPoint; role }
    let to_value x =
      structure_to_value
        [("role", (Some (NonEmptyString.to_value x.role)));
        ("incrementalScanDetails",
          (Option.map x.incrementalScanDetails
             ~f:IncrementalScanDetails.to_value));
        ("recoveryPoint",
          (Option.map x.recoveryPoint ~f:RecoveryPoint.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let recoveryPoint =
        (Option.map ~f:RecoveryPoint.of_xml)
          (Xml.child xml_arg0 "recoveryPoint") in
      let incrementalScanDetails =
        (Option.map ~f:IncrementalScanDetails.of_xml)
          (Xml.child xml_arg0 "incrementalScanDetails") in
      let role =
        NonEmptyString.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "role") in
      make ?recoveryPoint ?incrementalScanDetails ~role ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let recoveryPoint =
        field_map json__ "RecoveryPoint" RecoveryPoint.of_json in
      let incrementalScanDetails =
        field_map json__ "IncrementalScanDetails"
          IncrementalScanDetails.of_json in
      let role = field_map_exn json__ "Role" NonEmptyString.of_json in
      make ?recoveryPoint ?incrementalScanDetails ~role ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the configuration to be used for the malware scan."]
module S3ObjectForSendObjectMalwareScan =
  struct
    type nonrec t =
      {
      bucket: String_.t option
        [@ocaml.doc
          "The name of the S3 bucket containing the object to scan. The bucket must have GuardDuty Malware Protection enabled."];
      key: String_.t option
        [@ocaml.doc
          "The key (name) of the S3 object to scan for malware. This must be the full key path of the object within the bucket."];
      versionId: String_.t option
        [@ocaml.doc
          "The version ID of the S3 object to scan. If not specified, the latest version of the object is scanned."]}
    let make ?bucket =
      fun ?key -> fun ?versionId -> fun () -> { bucket; key; versionId }
    let to_value x =
      structure_to_value
        [("bucket", (Option.map x.bucket ~f:String_.to_value));
        ("key", (Option.map x.key ~f:String_.to_value));
        ("versionId", (Option.map x.versionId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let versionId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "versionId") in
      let key = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "key") in
      let bucket =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "bucket") in
      make ?versionId ?key ?bucket ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let versionId = field_map json__ "VersionId" String_.of_json in
      let key = field_map json__ "Key" String_.of_json in
      let bucket = field_map json__ "Bucket" String_.of_json in
      make ?versionId ?key ?bucket ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "The S3 object path to initiate a scan, including bucket name, object key, and optional version ID."]
module TrustedEntitySetIds =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"TrustedEntitySetIds" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module MaxResults =
  struct
    type nonrec t = int
    let make i =
      let open Result in
        ok_or_failwith
          ((check_int_max i ~max:50) >>= (fun () -> check_int_min i ~min:1));
        i
    let of_string = Int.of_string
    let to_value x = `Integer x
    let to_query v = to_query to_value v
    let to_header x = Int.to_string x
    let of_xml xml_arg0 =
      Int.of_string
        (string_of_xml ~kind:"an integer for MaxResults" xml_arg0)
    let of_json j = Int.of_float (float_of_json ~kind:"an integer" j)
    let to_json = simple_to_json to_value
  end
module ThreatIntelSetIds =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"ThreatIntelSetIds" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module ThreatEntitySetIds =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j =
      list_of_json ~kind:"ThreatEntitySetIds" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module Destinations =
  struct
    type nonrec t = Destination.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Destination.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Destination.of_xml)
    let of_json j =
      list_of_json ~kind:"Destinations" ~of_json:Destination.of_json j
    let to_json v = composed_to_json to_value v
  end
module AdminAccounts =
  struct
    type nonrec t = AdminAccount.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:1) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:AdminAccount.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:AdminAccount.of_xml)
    let of_json j =
      list_of_json ~kind:"AdminAccounts" ~of_json:AdminAccount.of_json j
    let to_json v = composed_to_json to_value v
  end
module Members =
  struct
    type nonrec t = Member.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Member.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Member.of_xml)
    let of_json j = list_of_json ~kind:"Members" ~of_json:Member.of_json j
    let to_json v = composed_to_json to_value v
  end
module MalwareScans =
  struct
    type nonrec t = MalwareScan.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:MalwareScan.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:MalwareScan.of_xml)
    let of_json j =
      list_of_json ~kind:"MalwareScans" ~of_json:MalwareScan.of_json j
    let to_json v = composed_to_json to_value v
  end
module ListMalwareScansFilterCriteria =
  struct
    type nonrec t =
      {
      listMalwareScansFilterCriterion:
        ListMalwareScansFilterCriterionList.t option
        [@ocaml.doc
          "Represents a condition that when matched will be added to the response of the operation."]}
    let make ?listMalwareScansFilterCriterion =
      fun () -> { listMalwareScansFilterCriterion }
    let to_value x =
      structure_to_value
        [("filterCriterion",
           (Option.map x.listMalwareScansFilterCriterion
              ~f:ListMalwareScansFilterCriterionList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let listMalwareScansFilterCriterion =
        (Option.map ~f:ListMalwareScansFilterCriterionList.of_xml)
          (Xml.child xml_arg0 "filterCriterion") in
      make ?listMalwareScansFilterCriterion ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let listMalwareScansFilterCriterion =
        field_map json__ "ListMalwareScansFilterCriterion"
          ListMalwareScansFilterCriterionList.of_json in
      make ?listMalwareScansFilterCriterion ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents the criteria used to filter the malware scan entries."]
module SortCriteria =
  struct
    type nonrec t =
      {
      attributeName: String_.t option
        [@ocaml.doc
          "Represents the finding attribute, such as accountId, that sorts the findings."];
      orderBy: OrderBy.t option
        [@ocaml.doc
          "The order by which the sorted findings are to be displayed."]}
    let make ?attributeName =
      fun ?orderBy -> fun () -> { attributeName; orderBy }
    let to_value x =
      structure_to_value
        [("attributeName", (Option.map x.attributeName ~f:String_.to_value));
        ("orderBy", (Option.map x.orderBy ~f:OrderBy.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let orderBy =
        (Option.map ~f:OrderBy.of_xml) (Xml.child xml_arg0 "orderBy") in
      let attributeName =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "attributeName") in
      make ?orderBy ?attributeName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let orderBy = field_map json__ "OrderBy" OrderBy.of_json in
      let attributeName = field_map json__ "AttributeName" String_.of_json in
      make ?orderBy ?attributeName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the criteria used for sorting findings."]
module MalwareProtectionPlansSummary =
  struct
    type nonrec t = MalwareProtectionPlanSummary.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:MalwareProtectionPlanSummary.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:MalwareProtectionPlanSummary.of_xml)
    let of_json j =
      list_of_json ~kind:"MalwareProtectionPlansSummary"
        ~of_json:MalwareProtectionPlanSummary.of_json j
    let to_json v = composed_to_json to_value v
  end
module Invitations =
  struct
    type nonrec t = Invitation.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Invitation.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Invitation.of_xml)
    let of_json j =
      list_of_json ~kind:"Invitations" ~of_json:Invitation.of_json j
    let to_json v = composed_to_json to_value v
  end
module IpSetIds =
  struct
    type nonrec t = String_.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:String_.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:String_.of_xml)
    let of_json j = list_of_json ~kind:"IpSetIds" ~of_json:String_.of_json j
    let to_json v = composed_to_json to_value v
  end
module FilterNames =
  struct
    type nonrec t = FilterName.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:FilterName.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:FilterName.of_xml)
    let of_json j =
      list_of_json ~kind:"FilterNames" ~of_json:FilterName.of_json j
    let to_json v = composed_to_json to_value v
  end
module DetectorIds =
  struct
    type nonrec t = DetectorId.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:DetectorId.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:DetectorId.of_xml)
    let of_json j =
      list_of_json ~kind:"DetectorIds" ~of_json:DetectorId.of_json j
    let to_json v = composed_to_json to_value v
  end
module CoverageResources =
  struct
    type nonrec t = CoverageResource.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:CoverageResource.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:CoverageResource.of_xml)
    let of_json j =
      list_of_json ~kind:"CoverageResources"
        ~of_json:CoverageResource.of_json j
    let to_json v = composed_to_json to_value v
  end
module CoverageFilterCriteria =
  struct
    type nonrec t =
      {
      filterCriterion: CoverageFilterCriterionList.t option
        [@ocaml.doc
          "Represents a condition that when matched will be added to the response of the operation."]}
    let make ?filterCriterion = fun () -> { filterCriterion }
    let to_value x =
      structure_to_value
        [("filterCriterion",
           (Option.map x.filterCriterion
              ~f:CoverageFilterCriterionList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let filterCriterion =
        (Option.map ~f:CoverageFilterCriterionList.of_xml)
          (Xml.child xml_arg0 "filterCriterion") in
      make ?filterCriterion ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let filterCriterion =
        field_map json__ "FilterCriterion"
          CoverageFilterCriterionList.of_json in
      make ?filterCriterion ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Represents the criteria used in the filter."]
module CoverageSortCriteria =
  struct
    type nonrec t =
      {
      attributeName: CoverageSortKey.t option
        [@ocaml.doc
          "Represents the field name used to sort the coverage details. Replace the enum value CLUSTER_NAME with EKS_CLUSTER_NAME. CLUSTER_NAME has been deprecated."];
      orderBy: OrderBy.t option
        [@ocaml.doc
          "The order in which the sorted findings are to be displayed."]}
    let make ?attributeName =
      fun ?orderBy -> fun () -> { attributeName; orderBy }
    let to_value x =
      structure_to_value
        [("attributeName",
           (Option.map x.attributeName ~f:CoverageSortKey.to_value));
        ("orderBy", (Option.map x.orderBy ~f:OrderBy.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let orderBy =
        (Option.map ~f:OrderBy.of_xml) (Xml.child xml_arg0 "orderBy") in
      let attributeName =
        (Option.map ~f:CoverageSortKey.of_xml)
          (Xml.child xml_arg0 "attributeName") in
      make ?orderBy ?attributeName ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let orderBy = field_map json__ "OrderBy" OrderBy.of_json in
      let attributeName =
        field_map json__ "AttributeName" CoverageSortKey.of_json in
      make ?orderBy ?attributeName ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the sorting criteria used in the coverage statistics."]
module UsageStatistics =
  struct
    type nonrec t =
      {
      sumByAccount: UsageAccountResultList.t option
        [@ocaml.doc "The usage statistic sum organized by account ID."];
      topAccountsByFeature: UsageTopAccountsResultList.t option
        [@ocaml.doc
          "Lists the top 50 accounts by feature that have generated the most GuardDuty usage, in the order from most to least expensive. Currently, this doesn't support RDS_LOGIN_EVENTS."];
      sumByDataSource: UsageDataSourceResultList.t option
        [@ocaml.doc "The usage statistic sum organized by on data source."];
      sumByResource: UsageResourceResultList.t option
        [@ocaml.doc "The usage statistic sum organized by resource."];
      topResources: UsageResourceResultList.t option
        [@ocaml.doc
          "Lists the top 50 resources that have generated the most GuardDuty usage, in order from most to least expensive."];
      sumByFeature: UsageFeatureResultList.t option
        [@ocaml.doc "The usage statistic sum organized by feature."]}
    let make ?sumByAccount =
      fun ?topAccountsByFeature ->
        fun ?sumByDataSource ->
          fun ?sumByResource ->
            fun ?topResources ->
              fun ?sumByFeature ->
                fun () ->
                  {
                    sumByAccount;
                    topAccountsByFeature;
                    sumByDataSource;
                    sumByResource;
                    topResources;
                    sumByFeature
                  }
    let to_value x =
      structure_to_value
        [("sumByAccount",
           (Option.map x.sumByAccount ~f:UsageAccountResultList.to_value));
        ("topAccountsByFeature",
          (Option.map x.topAccountsByFeature
             ~f:UsageTopAccountsResultList.to_value));
        ("sumByDataSource",
          (Option.map x.sumByDataSource ~f:UsageDataSourceResultList.to_value));
        ("sumByResource",
          (Option.map x.sumByResource ~f:UsageResourceResultList.to_value));
        ("topResources",
          (Option.map x.topResources ~f:UsageResourceResultList.to_value));
        ("sumByFeature",
          (Option.map x.sumByFeature ~f:UsageFeatureResultList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let sumByFeature =
        (Option.map ~f:UsageFeatureResultList.of_xml)
          (Xml.child xml_arg0 "sumByFeature") in
      let topResources =
        (Option.map ~f:UsageResourceResultList.of_xml)
          (Xml.child xml_arg0 "topResources") in
      let sumByResource =
        (Option.map ~f:UsageResourceResultList.of_xml)
          (Xml.child xml_arg0 "sumByResource") in
      let sumByDataSource =
        (Option.map ~f:UsageDataSourceResultList.of_xml)
          (Xml.child xml_arg0 "sumByDataSource") in
      let topAccountsByFeature =
        (Option.map ~f:UsageTopAccountsResultList.of_xml)
          (Xml.child xml_arg0 "topAccountsByFeature") in
      let sumByAccount =
        (Option.map ~f:UsageAccountResultList.of_xml)
          (Xml.child xml_arg0 "sumByAccount") in
      make ?sumByFeature ?topResources ?sumByResource ?sumByDataSource
        ?topAccountsByFeature ?sumByAccount ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let sumByFeature =
        field_map json__ "SumByFeature" UsageFeatureResultList.of_json in
      let topResources =
        field_map json__ "TopResources" UsageResourceResultList.of_json in
      let sumByResource =
        field_map json__ "SumByResource" UsageResourceResultList.of_json in
      let sumByDataSource =
        field_map json__ "SumByDataSource" UsageDataSourceResultList.of_json in
      let topAccountsByFeature =
        field_map json__ "TopAccountsByFeature"
          UsageTopAccountsResultList.of_json in
      let sumByAccount =
        field_map json__ "SumByAccount" UsageAccountResultList.of_json in
      make ?sumByFeature ?topResources ?sumByResource ?sumByDataSource
        ?topAccountsByFeature ?sumByAccount ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains the result of GuardDuty usage. If a UsageStatisticType is provided the result for other types will be null."]
module UsageCriteria =
  struct
    type nonrec t =
      {
      accountIds: AccountIds.t option
        [@ocaml.doc "The account IDs to aggregate usage statistics from."];
      dataSources: DataSourceList.t option
        [@ocaml.doc "The data sources to aggregate usage statistics from."];
      resources: ResourceList.t option
        [@ocaml.doc
          "The resources to aggregate usage statistics from. Only accepts exact resource names."];
      features: UsageFeatureList.t option
        [@ocaml.doc "The features to aggregate usage statistics from."]}
    let make ?accountIds =
      fun ?dataSources ->
        fun ?resources ->
          fun ?features ->
            fun () -> { accountIds; dataSources; resources; features }
    let to_value x =
      structure_to_value
        [("accountIds", (Option.map x.accountIds ~f:AccountIds.to_value));
        ("dataSources",
          (Option.map x.dataSources ~f:DataSourceList.to_value));
        ("resources", (Option.map x.resources ~f:ResourceList.to_value));
        ("features", (Option.map x.features ~f:UsageFeatureList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let features =
        (Option.map ~f:UsageFeatureList.of_xml)
          (Xml.child xml_arg0 "features") in
      let resources =
        (Option.map ~f:ResourceList.of_xml) (Xml.child xml_arg0 "resources") in
      let dataSources =
        (Option.map ~f:DataSourceList.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let accountIds =
        (Option.map ~f:AccountIds.of_xml) (Xml.child xml_arg0 "accountIds") in
      make ?features ?resources ?dataSources ?accountIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let features = field_map json__ "Features" UsageFeatureList.of_json in
      let resources = field_map json__ "Resources" ResourceList.of_json in
      let dataSources = field_map json__ "DataSources" DataSourceList.of_json in
      let accountIds = field_map json__ "AccountIds" AccountIds.of_json in
      make ?features ?resources ?dataSources ?accountIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the criteria used to query usage statistics."]
module UsageStatisticType =
  struct
    type nonrec t =
      | SUM_BY_ACCOUNT 
      | SUM_BY_DATA_SOURCE 
      | SUM_BY_RESOURCE 
      | TOP_RESOURCES 
      | SUM_BY_FEATURES 
      | TOP_ACCOUNTS_BY_FEATURE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | SUM_BY_ACCOUNT -> "SUM_BY_ACCOUNT"
      | SUM_BY_DATA_SOURCE -> "SUM_BY_DATA_SOURCE"
      | SUM_BY_RESOURCE -> "SUM_BY_RESOURCE"
      | TOP_RESOURCES -> "TOP_RESOURCES"
      | SUM_BY_FEATURES -> "SUM_BY_FEATURES"
      | TOP_ACCOUNTS_BY_FEATURE -> "TOP_ACCOUNTS_BY_FEATURE"
      | Non_static_id s -> s
    let of_string =
      function
      | "SUM_BY_ACCOUNT" -> SUM_BY_ACCOUNT
      | "SUM_BY_DATA_SOURCE" -> SUM_BY_DATA_SOURCE
      | "SUM_BY_RESOURCE" -> SUM_BY_RESOURCE
      | "TOP_RESOURCES" -> TOP_RESOURCES
      | "SUM_BY_FEATURES" -> SUM_BY_FEATURES
      | "TOP_ACCOUNTS_BY_FEATURE" -> TOP_ACCOUNTS_BY_FEATURE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration UsageStatisticType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"UsageStatisticType" j)
    let to_json = simple_to_json to_value
  end
module TrustedEntitySetFormat =
  struct
    type nonrec t =
      | TXT 
      | STIX 
      | OTX_CSV 
      | ALIEN_VAULT 
      | PROOF_POINT 
      | FIRE_EYE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | TXT -> "TXT"
      | STIX -> "STIX"
      | OTX_CSV -> "OTX_CSV"
      | ALIEN_VAULT -> "ALIEN_VAULT"
      | PROOF_POINT -> "PROOF_POINT"
      | FIRE_EYE -> "FIRE_EYE"
      | Non_static_id s -> s
    let of_string =
      function
      | "TXT" -> TXT
      | "STIX" -> STIX
      | "OTX_CSV" -> OTX_CSV
      | "ALIEN_VAULT" -> ALIEN_VAULT
      | "PROOF_POINT" -> PROOF_POINT
      | "FIRE_EYE" -> FIRE_EYE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration TrustedEntitySetFormat" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"TrustedEntitySetFormat" j)
    let to_json = simple_to_json to_value
  end
module TrustedEntitySetStatus =
  struct
    type nonrec t =
      | INACTIVE 
      | ACTIVATING 
      | ACTIVE 
      | DEACTIVATING 
      | ERROR 
      | DELETE_PENDING 
      | DELETED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | INACTIVE -> "INACTIVE"
      | ACTIVATING -> "ACTIVATING"
      | ACTIVE -> "ACTIVE"
      | DEACTIVATING -> "DEACTIVATING"
      | ERROR -> "ERROR"
      | DELETE_PENDING -> "DELETE_PENDING"
      | DELETED -> "DELETED"
      | Non_static_id s -> s
    let of_string =
      function
      | "INACTIVE" -> INACTIVE
      | "ACTIVATING" -> ACTIVATING
      | "ACTIVE" -> ACTIVE
      | "DEACTIVATING" -> DEACTIVATING
      | "ERROR" -> ERROR
      | "DELETE_PENDING" -> DELETE_PENDING
      | "DELETED" -> DELETED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration TrustedEntitySetStatus" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"TrustedEntitySetStatus" j)
    let to_json = simple_to_json to_value
  end
module ThreatIntelSetFormat =
  struct
    type nonrec t =
      | TXT 
      | STIX 
      | OTX_CSV 
      | ALIEN_VAULT 
      | PROOF_POINT 
      | FIRE_EYE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | TXT -> "TXT"
      | STIX -> "STIX"
      | OTX_CSV -> "OTX_CSV"
      | ALIEN_VAULT -> "ALIEN_VAULT"
      | PROOF_POINT -> "PROOF_POINT"
      | FIRE_EYE -> "FIRE_EYE"
      | Non_static_id s -> s
    let of_string =
      function
      | "TXT" -> TXT
      | "STIX" -> STIX
      | "OTX_CSV" -> OTX_CSV
      | "ALIEN_VAULT" -> ALIEN_VAULT
      | "PROOF_POINT" -> PROOF_POINT
      | "FIRE_EYE" -> FIRE_EYE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration ThreatIntelSetFormat" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ThreatIntelSetFormat" j)
    let to_json = simple_to_json to_value
  end
module ThreatIntelSetStatus =
  struct
    type nonrec t =
      | INACTIVE 
      | ACTIVATING 
      | ACTIVE 
      | DEACTIVATING 
      | ERROR 
      | DELETE_PENDING 
      | DELETED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | INACTIVE -> "INACTIVE"
      | ACTIVATING -> "ACTIVATING"
      | ACTIVE -> "ACTIVE"
      | DEACTIVATING -> "DEACTIVATING"
      | ERROR -> "ERROR"
      | DELETE_PENDING -> "DELETE_PENDING"
      | DELETED -> "DELETED"
      | Non_static_id s -> s
    let of_string =
      function
      | "INACTIVE" -> INACTIVE
      | "ACTIVATING" -> ACTIVATING
      | "ACTIVE" -> ACTIVE
      | "DEACTIVATING" -> DEACTIVATING
      | "ERROR" -> ERROR
      | "DELETE_PENDING" -> DELETE_PENDING
      | "DELETED" -> DELETED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration ThreatIntelSetStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"ThreatIntelSetStatus" j)
    let to_json = simple_to_json to_value
  end
module ThreatEntitySetFormat =
  struct
    type nonrec t =
      | TXT 
      | STIX 
      | OTX_CSV 
      | ALIEN_VAULT 
      | PROOF_POINT 
      | FIRE_EYE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | TXT -> "TXT"
      | STIX -> "STIX"
      | OTX_CSV -> "OTX_CSV"
      | ALIEN_VAULT -> "ALIEN_VAULT"
      | PROOF_POINT -> "PROOF_POINT"
      | FIRE_EYE -> "FIRE_EYE"
      | Non_static_id s -> s
    let of_string =
      function
      | "TXT" -> TXT
      | "STIX" -> STIX
      | "OTX_CSV" -> OTX_CSV
      | "ALIEN_VAULT" -> ALIEN_VAULT
      | "PROOF_POINT" -> PROOF_POINT
      | "FIRE_EYE" -> FIRE_EYE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration ThreatEntitySetFormat" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"ThreatEntitySetFormat" j)
    let to_json = simple_to_json to_value
  end
module ThreatEntitySetStatus =
  struct
    type nonrec t =
      | INACTIVE 
      | ACTIVATING 
      | ACTIVE 
      | DEACTIVATING 
      | ERROR 
      | DELETE_PENDING 
      | DELETED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | INACTIVE -> "INACTIVE"
      | ACTIVATING -> "ACTIVATING"
      | ACTIVE -> "ACTIVE"
      | DEACTIVATING -> "DEACTIVATING"
      | ERROR -> "ERROR"
      | DELETE_PENDING -> "DELETE_PENDING"
      | DELETED -> "DELETED"
      | Non_static_id s -> s
    let of_string =
      function
      | "INACTIVE" -> INACTIVE
      | "ACTIVATING" -> ACTIVATING
      | "ACTIVE" -> ACTIVE
      | "DEACTIVATING" -> DEACTIVATING
      | "ERROR" -> ERROR
      | "DELETE_PENDING" -> DELETE_PENDING
      | "DELETED" -> DELETED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration ThreatEntitySetStatus" xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"ThreatEntitySetStatus" j)
    let to_json = simple_to_json to_value
  end
module AccountFreeTrialInfos =
  struct
    type nonrec t = AccountFreeTrialInfo.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:AccountFreeTrialInfo.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:AccountFreeTrialInfo.of_xml)
    let of_json j =
      list_of_json ~kind:"AccountFreeTrialInfos"
        ~of_json:AccountFreeTrialInfo.of_json j
    let to_json v = composed_to_json to_value v
  end
module OrganizationDetails =
  struct
    type nonrec t =
      {
      updatedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp at which the organization statistics was last updated. This is in UTC format."];
      organizationStatistics: OrganizationStatistics.t option
        [@ocaml.doc
          "Information about the GuardDuty coverage statistics for members in your Amazon Web Services organization."]}
    let make ?updatedAt =
      fun ?organizationStatistics ->
        fun () -> { updatedAt; organizationStatistics }
    let to_value x =
      structure_to_value
        [("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value));
        ("organizationStatistics",
          (Option.map x.organizationStatistics
             ~f:OrganizationStatistics.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let organizationStatistics =
        (Option.map ~f:OrganizationStatistics.of_xml)
          (Xml.child xml_arg0 "organizationStatistics") in
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      make ?organizationStatistics ?updatedAt ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let organizationStatistics =
        field_map json__ "OrganizationStatistics"
          OrganizationStatistics.of_json in
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      make ?organizationStatistics ?updatedAt ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about GuardDuty coverage statistics for members in your Amazon Web Services organization."]
module MemberDataSourceConfigurations =
  struct
    type nonrec t = MemberDataSourceConfiguration.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:1));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:MemberDataSourceConfiguration.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:MemberDataSourceConfiguration.of_xml)
    let of_json j =
      list_of_json ~kind:"MemberDataSourceConfigurations"
        ~of_json:MemberDataSourceConfiguration.of_json j
    let to_json v = composed_to_json to_value v
  end
module Master =
  struct
    type nonrec t =
      {
      accountId: AccountId.t option
        [@ocaml.doc
          "The ID of the account used as the administrator account."];
      invitationId: String_.t option
        [@ocaml.doc
          "The value used to validate the administrator account to the member account."];
      relationshipStatus: String_.t option
        [@ocaml.doc
          "The status of the relationship between the administrator and member accounts."];
      invitedAt: String_.t option
        [@ocaml.doc "The timestamp when the invitation was sent."]}
    let make ?accountId =
      fun ?invitationId ->
        fun ?relationshipStatus ->
          fun ?invitedAt ->
            fun () ->
              { accountId; invitationId; relationshipStatus; invitedAt }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("invitationId", (Option.map x.invitationId ~f:String_.to_value));
        ("relationshipStatus",
          (Option.map x.relationshipStatus ~f:String_.to_value));
        ("invitedAt", (Option.map x.invitedAt ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let invitedAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "invitedAt") in
      let relationshipStatus =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "relationshipStatus") in
      let invitationId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "invitationId") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?invitedAt ?relationshipStatus ?invitationId ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let invitedAt = field_map json__ "InvitedAt" String_.of_json in
      let relationshipStatus =
        field_map json__ "RelationshipStatus" String_.of_json in
      let invitationId = field_map json__ "InvitationId" String_.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      make ?invitedAt ?relationshipStatus ?invitationId ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the administrator account and invitation."]
module GetMalwareScanResultDetails =
  struct
    type nonrec t =
      {
      scanResultStatus: ScanResultStatus.t option
        [@ocaml.doc
          "Status indicating whether threats were found for a completed scan."];
      skippedFileCount: PositiveLong.t option
        [@ocaml.doc
          "The total number of files that were skipped during the scan."];
      failedFileCount: PositiveLong.t option
        [@ocaml.doc "The total number of files that failed to be scanned."];
      threatFoundFileCount: PositiveLong.t option
        [@ocaml.doc
          "The total number of files in which threats were detected."];
      totalFileCount: PositiveLong.t option
        [@ocaml.doc
          "The total number of files that were processed during the scan."];
      totalBytes: PositiveLong.t option
        [@ocaml.doc "The total number of bytes that were scanned."];
      uniqueThreatCount: PositiveLong.t option
        [@ocaml.doc
          "The total number of unique threats that were detected during the scan."];
      threats: ScanResultThreats.t option
        [@ocaml.doc
          "The threats that were detected during the malware scan."]}
    let make ?scanResultStatus =
      fun ?skippedFileCount ->
        fun ?failedFileCount ->
          fun ?threatFoundFileCount ->
            fun ?totalFileCount ->
              fun ?totalBytes ->
                fun ?uniqueThreatCount ->
                  fun ?threats ->
                    fun () ->
                      {
                        scanResultStatus;
                        skippedFileCount;
                        failedFileCount;
                        threatFoundFileCount;
                        totalFileCount;
                        totalBytes;
                        uniqueThreatCount;
                        threats
                      }
    let to_value x =
      structure_to_value
        [("scanResultStatus",
           (Option.map x.scanResultStatus ~f:ScanResultStatus.to_value));
        ("skippedFileCount",
          (Option.map x.skippedFileCount ~f:PositiveLong.to_value));
        ("failedFileCount",
          (Option.map x.failedFileCount ~f:PositiveLong.to_value));
        ("threatFoundFileCount",
          (Option.map x.threatFoundFileCount ~f:PositiveLong.to_value));
        ("totalFileCount",
          (Option.map x.totalFileCount ~f:PositiveLong.to_value));
        ("totalBytes", (Option.map x.totalBytes ~f:PositiveLong.to_value));
        ("uniqueThreatCount",
          (Option.map x.uniqueThreatCount ~f:PositiveLong.to_value));
        ("threats", (Option.map x.threats ~f:ScanResultThreats.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threats =
        (Option.map ~f:ScanResultThreats.of_xml)
          (Xml.child xml_arg0 "threats") in
      let uniqueThreatCount =
        (Option.map ~f:PositiveLong.of_xml)
          (Xml.child xml_arg0 "uniqueThreatCount") in
      let totalBytes =
        (Option.map ~f:PositiveLong.of_xml) (Xml.child xml_arg0 "totalBytes") in
      let totalFileCount =
        (Option.map ~f:PositiveLong.of_xml)
          (Xml.child xml_arg0 "totalFileCount") in
      let threatFoundFileCount =
        (Option.map ~f:PositiveLong.of_xml)
          (Xml.child xml_arg0 "threatFoundFileCount") in
      let failedFileCount =
        (Option.map ~f:PositiveLong.of_xml)
          (Xml.child xml_arg0 "failedFileCount") in
      let skippedFileCount =
        (Option.map ~f:PositiveLong.of_xml)
          (Xml.child xml_arg0 "skippedFileCount") in
      let scanResultStatus =
        (Option.map ~f:ScanResultStatus.of_xml)
          (Xml.child xml_arg0 "scanResultStatus") in
      make ?threats ?uniqueThreatCount ?totalBytes ?totalFileCount
        ?threatFoundFileCount ?failedFileCount ?skippedFileCount
        ?scanResultStatus ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threats = field_map json__ "Threats" ScanResultThreats.of_json in
      let uniqueThreatCount =
        field_map json__ "UniqueThreatCount" PositiveLong.of_json in
      let totalBytes = field_map json__ "TotalBytes" PositiveLong.of_json in
      let totalFileCount =
        field_map json__ "TotalFileCount" PositiveLong.of_json in
      let threatFoundFileCount =
        field_map json__ "ThreatFoundFileCount" PositiveLong.of_json in
      let failedFileCount =
        field_map json__ "FailedFileCount" PositiveLong.of_json in
      let skippedFileCount =
        field_map json__ "SkippedFileCount" PositiveLong.of_json in
      let scanResultStatus =
        field_map json__ "ScanResultStatus" ScanResultStatus.of_json in
      make ?threats ?uniqueThreatCount ?totalBytes ?totalFileCount
        ?threatFoundFileCount ?failedFileCount ?skippedFileCount
        ?scanResultStatus ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the results of the malware scan."]
module NonNegativeInteger =
  struct
    type nonrec t = int
    let make i =
      let open Result in ok_or_failwith (check_int_min i ~min:0); i
    let of_string = Int.of_string
    let to_value x = `Integer x
    let to_query v = to_query to_value v
    let to_header x = Int.to_string x
    let of_xml xml_arg0 =
      Int.of_string
        (string_of_xml ~kind:"an integer for NonNegativeInteger" xml_arg0)
    let of_json j = Int.of_float (float_of_json ~kind:"an integer" j)
    let to_json = simple_to_json to_value
  end
module ResourceNotFoundException =
  struct
    type nonrec t =
      {
      message: String_.t option [@ocaml.doc "The error message."];
      type_: String_.t option [@ocaml.doc "The error type."]}
    let make ?message = fun ?type_ -> fun () -> { message; type_ }
    let to_value x =
      structure_to_value
        [("message", (Option.map x.message ~f:String_.to_value));
        ("type", (Option.map x.type_ ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let type_ = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "type") in
      let message =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "message") in
      make ?type_ ?message ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let type_ = field_map json__ "Type" String_.of_json in
      let message = field_map json__ "Message" String_.of_json in
      make ?type_ ?message ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "The requested resource can't be found."]
module ScanConfiguration =
  struct
    type nonrec t =
      {
      role: NonEmptyString.t option
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the IAM role that should contain the required permissions for the scan."];
      triggerDetails: TriggerDetails.t option
        [@ocaml.doc
          "Information about the entity that triggered the malware scan."];
      incrementalScanDetails: IncrementalScanDetails.t option
        [@ocaml.doc
          "Information about the incremental scan configuration, if applicable."];
      recoveryPoint: ScanConfigurationRecoveryPoint.t option
        [@ocaml.doc
          "Information about the recovery point configuration used for the scan, if applicable."]}
    let make ?role =
      fun ?triggerDetails ->
        fun ?incrementalScanDetails ->
          fun ?recoveryPoint ->
            fun () ->
              { role; triggerDetails; incrementalScanDetails; recoveryPoint }
    let to_value x =
      structure_to_value
        [("role", (Option.map x.role ~f:NonEmptyString.to_value));
        ("triggerDetails",
          (Option.map x.triggerDetails ~f:TriggerDetails.to_value));
        ("incrementalScanDetails",
          (Option.map x.incrementalScanDetails
             ~f:IncrementalScanDetails.to_value));
        ("recoveryPoint",
          (Option.map x.recoveryPoint
             ~f:ScanConfigurationRecoveryPoint.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let recoveryPoint =
        (Option.map ~f:ScanConfigurationRecoveryPoint.of_xml)
          (Xml.child xml_arg0 "recoveryPoint") in
      let incrementalScanDetails =
        (Option.map ~f:IncrementalScanDetails.of_xml)
          (Xml.child xml_arg0 "incrementalScanDetails") in
      let triggerDetails =
        (Option.map ~f:TriggerDetails.of_xml)
          (Xml.child xml_arg0 "triggerDetails") in
      let role =
        (Option.map ~f:NonEmptyString.of_xml) (Xml.child xml_arg0 "role") in
      make ?recoveryPoint ?incrementalScanDetails ?triggerDetails ?role ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let recoveryPoint =
        field_map json__ "RecoveryPoint"
          ScanConfigurationRecoveryPoint.of_json in
      let incrementalScanDetails =
        field_map json__ "IncrementalScanDetails"
          IncrementalScanDetails.of_json in
      let triggerDetails =
        field_map json__ "TriggerDetails" TriggerDetails.of_json in
      let role = field_map json__ "Role" NonEmptyString.of_json in
      make ?recoveryPoint ?incrementalScanDetails ?triggerDetails ?role ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the configuration used for the malware scan."]
module ScannedResources =
  struct
    type nonrec t = ScannedResource.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:ScannedResource.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:ScannedResource.of_xml)
    let of_json j =
      list_of_json ~kind:"ScannedResources" ~of_json:ScannedResource.of_json
        j
    let to_json v = composed_to_json to_value v
  end
module CreateProtectedResource =
  struct
    type nonrec t =
      {
      s3Bucket: CreateS3BucketResource.t option
        [@ocaml.doc "Information about the protected S3 bucket resource."]}
    let make ?s3Bucket = fun () -> { s3Bucket }
    let to_value x =
      structure_to_value
        [("s3Bucket",
           (Option.map x.s3Bucket ~f:CreateS3BucketResource.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let s3Bucket =
        (Option.map ~f:CreateS3BucketResource.of_xml)
          (Xml.child xml_arg0 "s3Bucket") in
      make ?s3Bucket ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let s3Bucket =
        field_map json__ "S3Bucket" CreateS3BucketResource.of_json in
      make ?s3Bucket ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource."]
module MalwareProtectionPlanStatus =
  struct
    type nonrec t =
      | ACTIVE 
      | WARNING 
      | ERROR 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ACTIVE -> "ACTIVE"
      | WARNING -> "WARNING"
      | ERROR -> "ERROR"
      | Non_static_id s -> s
    let of_string =
      function
      | "ACTIVE" -> ACTIVE
      | "WARNING" -> WARNING
      | "ERROR" -> ERROR
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string
        (string_of_xml ~kind:"enumeration MalwareProtectionPlanStatus"
           xml_arg0)
    let of_json j =
      of_string (string_of_json ~kind:"MalwareProtectionPlanStatus" j)
    let to_json = simple_to_json to_value
  end
module MalwareProtectionPlanStatusReasonsList =
  struct
    type nonrec t = MalwareProtectionPlanStatusReason.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:MalwareProtectionPlanStatusReason.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:MalwareProtectionPlanStatusReason.of_xml)
    let of_json j =
      list_of_json ~kind:"MalwareProtectionPlanStatusReasonsList"
        ~of_json:MalwareProtectionPlanStatusReason.of_json j
    let to_json v = composed_to_json to_value v
  end
module IpSetFormat =
  struct
    type nonrec t =
      | TXT 
      | STIX 
      | OTX_CSV 
      | ALIEN_VAULT 
      | PROOF_POINT 
      | FIRE_EYE 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | TXT -> "TXT"
      | STIX -> "STIX"
      | OTX_CSV -> "OTX_CSV"
      | ALIEN_VAULT -> "ALIEN_VAULT"
      | PROOF_POINT -> "PROOF_POINT"
      | FIRE_EYE -> "FIRE_EYE"
      | Non_static_id s -> s
    let of_string =
      function
      | "TXT" -> TXT
      | "STIX" -> STIX
      | "OTX_CSV" -> OTX_CSV
      | "ALIEN_VAULT" -> ALIEN_VAULT
      | "PROOF_POINT" -> PROOF_POINT
      | "FIRE_EYE" -> FIRE_EYE
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration IpSetFormat" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"IpSetFormat" j)
    let to_json = simple_to_json to_value
  end
module IpSetStatus =
  struct
    type nonrec t =
      | INACTIVE 
      | ACTIVATING 
      | ACTIVE 
      | DEACTIVATING 
      | ERROR 
      | DELETE_PENDING 
      | DELETED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | INACTIVE -> "INACTIVE"
      | ACTIVATING -> "ACTIVATING"
      | ACTIVE -> "ACTIVE"
      | DEACTIVATING -> "DEACTIVATING"
      | ERROR -> "ERROR"
      | DELETE_PENDING -> "DELETE_PENDING"
      | DELETED -> "DELETED"
      | Non_static_id s -> s
    let of_string =
      function
      | "INACTIVE" -> INACTIVE
      | "ACTIVATING" -> ACTIVATING
      | "ACTIVE" -> ACTIVE
      | "DEACTIVATING" -> DEACTIVATING
      | "ERROR" -> ERROR
      | "DELETE_PENDING" -> DELETE_PENDING
      | "DELETED" -> DELETED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration IpSetStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"IpSetStatus" j)
    let to_json = simple_to_json to_value
  end
module FindingStatistics =
  struct
    type nonrec t =
      {
      countBySeverity: CountBySeverity.t option
        [@ocaml.doc
          "Represents a list of map of severity to count statistics for a set of findings."];
      groupedByAccount: GroupedByAccount.t option
        [@ocaml.doc
          "Represents a list of map of accounts with a findings count associated with each account."];
      groupedByDate: GroupedByDate.t option
        [@ocaml.doc
          "Represents a list of map of dates with a count of total findings generated on each date per severity level."];
      groupedByFindingType: GroupedByFindingType.t option
        [@ocaml.doc
          "Represents a list of map of finding types with a count of total findings generated for each type. Based on the orderBy parameter, this request returns either the most occurring finding types or the least occurring finding types. If the orderBy parameter is ASC, this will represent the least occurring finding types in your account; otherwise, this will represent the most occurring finding types. The default value of orderBy is DESC."];
      groupedByResource: GroupedByResource.t option
        [@ocaml.doc
          "Represents a list of map of top resources with a count of total findings."];
      groupedBySeverity: GroupedBySeverity.t option
        [@ocaml.doc
          "Represents a list of map of total findings for each severity level."]}
    let make ?countBySeverity =
      fun ?groupedByAccount ->
        fun ?groupedByDate ->
          fun ?groupedByFindingType ->
            fun ?groupedByResource ->
              fun ?groupedBySeverity ->
                fun () ->
                  {
                    countBySeverity;
                    groupedByAccount;
                    groupedByDate;
                    groupedByFindingType;
                    groupedByResource;
                    groupedBySeverity
                  }
    let to_value x =
      structure_to_value
        [("countBySeverity",
           (Option.map x.countBySeverity ~f:CountBySeverity.to_value));
        ("groupedByAccount",
          (Option.map x.groupedByAccount ~f:GroupedByAccount.to_value));
        ("groupedByDate",
          (Option.map x.groupedByDate ~f:GroupedByDate.to_value));
        ("groupedByFindingType",
          (Option.map x.groupedByFindingType ~f:GroupedByFindingType.to_value));
        ("groupedByResource",
          (Option.map x.groupedByResource ~f:GroupedByResource.to_value));
        ("groupedBySeverity",
          (Option.map x.groupedBySeverity ~f:GroupedBySeverity.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let groupedBySeverity =
        (Option.map ~f:GroupedBySeverity.of_xml)
          (Xml.child xml_arg0 "groupedBySeverity") in
      let groupedByResource =
        (Option.map ~f:GroupedByResource.of_xml)
          (Xml.child xml_arg0 "groupedByResource") in
      let groupedByFindingType =
        (Option.map ~f:GroupedByFindingType.of_xml)
          (Xml.child xml_arg0 "groupedByFindingType") in
      let groupedByDate =
        (Option.map ~f:GroupedByDate.of_xml)
          (Xml.child xml_arg0 "groupedByDate") in
      let groupedByAccount =
        (Option.map ~f:GroupedByAccount.of_xml)
          (Xml.child xml_arg0 "groupedByAccount") in
      let countBySeverity =
        (Option.map ~f:CountBySeverity.of_xml)
          (Xml.child xml_arg0 "countBySeverity") in
      make ?groupedBySeverity ?groupedByResource ?groupedByFindingType
        ?groupedByDate ?groupedByAccount ?countBySeverity ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let groupedBySeverity =
        field_map json__ "GroupedBySeverity" GroupedBySeverity.of_json in
      let groupedByResource =
        field_map json__ "GroupedByResource" GroupedByResource.of_json in
      let groupedByFindingType =
        field_map json__ "GroupedByFindingType" GroupedByFindingType.of_json in
      let groupedByDate =
        field_map json__ "GroupedByDate" GroupedByDate.of_json in
      let groupedByAccount =
        field_map json__ "GroupedByAccount" GroupedByAccount.of_json in
      let countBySeverity =
        field_map json__ "CountBySeverity" CountBySeverity.of_json in
      make ?groupedBySeverity ?groupedByResource ?groupedByFindingType
        ?groupedByDate ?groupedByAccount ?countBySeverity ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Contains information about finding statistics."]
module FindingStatisticTypes =
  struct
    type nonrec t = FindingStatisticType.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:10) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:FindingStatisticType.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:FindingStatisticType.of_xml)
    let of_json j =
      list_of_json ~kind:"FindingStatisticTypes"
        ~of_json:FindingStatisticType.of_json j
    let to_json v = composed_to_json to_value v
  end
module GroupByType =
  struct
    type nonrec t =
      | ACCOUNT 
      | DATE 
      | FINDING_TYPE 
      | RESOURCE 
      | SEVERITY 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ACCOUNT -> "ACCOUNT"
      | DATE -> "DATE"
      | FINDING_TYPE -> "FINDING_TYPE"
      | RESOURCE -> "RESOURCE"
      | SEVERITY -> "SEVERITY"
      | Non_static_id s -> s
    let of_string =
      function
      | "ACCOUNT" -> ACCOUNT
      | "DATE" -> DATE
      | "FINDING_TYPE" -> FINDING_TYPE
      | "RESOURCE" -> RESOURCE
      | "SEVERITY" -> SEVERITY
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration GroupByType" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"GroupByType" j)
    let to_json = simple_to_json to_value
  end
module MaxResults100 =
  struct
    type nonrec t = int
    let make i =
      let open Result in
        ok_or_failwith
          ((check_int_max i ~max:100) >>= (fun () -> check_int_min i ~min:1));
        i
    let of_string = Int.of_string
    let to_value x = `Integer x
    let to_query v = to_query to_value v
    let to_header x = Int.to_string x
    let of_xml xml_arg0 =
      Int.of_string
        (string_of_xml ~kind:"an integer for MaxResults100" xml_arg0)
    let of_json j = Int.of_float (float_of_json ~kind:"an integer" j)
    let to_json = simple_to_json to_value
  end
module Findings =
  struct
    type nonrec t = Finding.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Finding.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Finding.of_xml)
    let of_json j = list_of_json ~kind:"Findings" ~of_json:Finding.of_json j
    let to_json v = composed_to_json to_value v
  end
module DetectorFeatureConfigurationsResults =
  struct
    type nonrec t = DetectorFeatureConfigurationResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:DetectorFeatureConfigurationResult.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:DetectorFeatureConfigurationResult.of_xml)
    let of_json j =
      list_of_json ~kind:"DetectorFeatureConfigurationsResults"
        ~of_json:DetectorFeatureConfigurationResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module DetectorStatus =
  struct
    type nonrec t =
      | ENABLED 
      | DISABLED 
      | Non_static_id of string 
    let make i = i
    let to_string =
      function
      | ENABLED -> "ENABLED"
      | DISABLED -> "DISABLED"
      | Non_static_id s -> s
    let of_string =
      function
      | "ENABLED" -> ENABLED
      | "DISABLED" -> DISABLED
      | x -> Non_static_id x
    let to_value x = `Enum (to_string x)
    let to_query v = to_query to_value v
    let to_header x = to_string x
    let of_xml xml_arg0 =
      of_string (string_of_xml ~kind:"enumeration DetectorStatus" xml_arg0)
    let of_json j = of_string (string_of_json ~kind:"DetectorStatus" j)
    let to_json = simple_to_json to_value
  end
module CoverageStatistics =
  struct
    type nonrec t =
      {
      countByResourceType: CountByResourceType.t option
        [@ocaml.doc
          "Represents coverage statistics for EKS clusters aggregated by resource type."];
      countByCoverageStatus: CountByCoverageStatus.t option
        [@ocaml.doc
          "Represents coverage statistics for EKS clusters aggregated by coverage status."]}
    let make ?countByResourceType =
      fun ?countByCoverageStatus ->
        fun () -> { countByResourceType; countByCoverageStatus }
    let to_value x =
      structure_to_value
        [("countByResourceType",
           (Option.map x.countByResourceType ~f:CountByResourceType.to_value));
        ("countByCoverageStatus",
          (Option.map x.countByCoverageStatus
             ~f:CountByCoverageStatus.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let countByCoverageStatus =
        (Option.map ~f:CountByCoverageStatus.of_xml)
          (Xml.child xml_arg0 "countByCoverageStatus") in
      let countByResourceType =
        (Option.map ~f:CountByResourceType.of_xml)
          (Xml.child xml_arg0 "countByResourceType") in
      make ?countByCoverageStatus ?countByResourceType ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let countByCoverageStatus =
        field_map json__ "CountByCoverageStatus"
          CountByCoverageStatus.of_json in
      let countByResourceType =
        field_map json__ "CountByResourceType" CountByResourceType.of_json in
      make ?countByCoverageStatus ?countByResourceType ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Information about the coverage statistics for a resource."]
module CoverageStatisticsTypeList =
  struct
    type nonrec t = CoverageStatisticsType.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:CoverageStatisticsType.to_value)) |>
        (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:CoverageStatisticsType.of_xml)
    let of_json j =
      list_of_json ~kind:"CoverageStatisticsTypeList"
        ~of_json:CoverageStatisticsType.of_json j
    let to_json v = composed_to_json to_value v
  end
module Administrator =
  struct
    type nonrec t =
      {
      accountId: AccountId.t option
        [@ocaml.doc
          "The ID of the account used as the administrator account."];
      invitationId: String_.t option
        [@ocaml.doc
          "The value that is used to validate the administrator account to the member account."];
      relationshipStatus: String_.t option
        [@ocaml.doc
          "The status of the relationship between the administrator and member accounts."];
      invitedAt: String_.t option
        [@ocaml.doc "The timestamp when the invitation was sent."]}
    let make ?accountId =
      fun ?invitationId ->
        fun ?relationshipStatus ->
          fun ?invitedAt ->
            fun () ->
              { accountId; invitationId; relationshipStatus; invitedAt }
    let to_value x =
      structure_to_value
        [("accountId", (Option.map x.accountId ~f:AccountId.to_value));
        ("invitationId", (Option.map x.invitationId ~f:String_.to_value));
        ("relationshipStatus",
          (Option.map x.relationshipStatus ~f:String_.to_value));
        ("invitedAt", (Option.map x.invitedAt ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let invitedAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "invitedAt") in
      let relationshipStatus =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "relationshipStatus") in
      let invitationId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "invitationId") in
      let accountId =
        (Option.map ~f:AccountId.of_xml) (Xml.child xml_arg0 "accountId") in
      make ?invitedAt ?relationshipStatus ?invitationId ?accountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let invitedAt = field_map json__ "InvitedAt" String_.of_json in
      let relationshipStatus =
        field_map json__ "RelationshipStatus" String_.of_json in
      let invitationId = field_map json__ "InvitationId" String_.of_json in
      let accountId = field_map json__ "AccountId" AccountId.of_json in
      make ?invitedAt ?relationshipStatus ?invitationId ?accountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information about the administrator account and invitation."]
module OrganizationDataSourceConfigurationsResult =
  struct
    type nonrec t =
      {
      s3Logs: OrganizationS3LogsConfigurationResult.t option
        [@ocaml.doc
          "Describes whether S3 data event logs are enabled as a data source."];
      kubernetes: OrganizationKubernetesConfigurationResult.t option
        [@ocaml.doc
          "Describes the configuration of Kubernetes data sources."];
      malwareProtection:
        OrganizationMalwareProtectionConfigurationResult.t option
        [@ocaml.doc
          "Describes the configuration of Malware Protection data source for an organization."]}
    let make ?s3Logs =
      fun ?kubernetes ->
        fun ?malwareProtection ->
          fun () -> { s3Logs; kubernetes; malwareProtection }
    let to_value x =
      structure_to_value
        [("s3Logs",
           (Option.map x.s3Logs
              ~f:OrganizationS3LogsConfigurationResult.to_value));
        ("kubernetes",
          (Option.map x.kubernetes
             ~f:OrganizationKubernetesConfigurationResult.to_value));
        ("malwareProtection",
          (Option.map x.malwareProtection
             ~f:OrganizationMalwareProtectionConfigurationResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtection =
        (Option.map
           ~f:OrganizationMalwareProtectionConfigurationResult.of_xml)
          (Xml.child xml_arg0 "malwareProtection") in
      let kubernetes =
        (Option.map ~f:OrganizationKubernetesConfigurationResult.of_xml)
          (Xml.child xml_arg0 "kubernetes") in
      let s3Logs =
        (Option.map ~f:OrganizationS3LogsConfigurationResult.of_xml)
          (Xml.child xml_arg0 "s3Logs") in
      make ?malwareProtection ?kubernetes ?s3Logs ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtection =
        field_map json__ "MalwareProtection"
          OrganizationMalwareProtectionConfigurationResult.of_json in
      let kubernetes =
        field_map json__ "Kubernetes"
          OrganizationKubernetesConfigurationResult.of_json in
      let s3Logs =
        field_map json__ "S3Logs"
          OrganizationS3LogsConfigurationResult.of_json in
      make ?malwareProtection ?kubernetes ?s3Logs ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "An object that contains information on which data sources are automatically enabled for new members within the organization."]
module OrganizationFeaturesConfigurationsResults =
  struct
    type nonrec t = OrganizationFeatureConfigurationResult.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:OrganizationFeatureConfigurationResult.to_value))
        |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true)))
           ~f:OrganizationFeatureConfigurationResult.of_xml)
    let of_json j =
      list_of_json ~kind:"OrganizationFeaturesConfigurationsResults"
        ~of_json:OrganizationFeatureConfigurationResult.of_json j
    let to_json v = composed_to_json to_value v
  end
module Scans =
  struct
    type nonrec t = Scan.t list
    let make i = i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:Scan.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:Scan.of_xml)
    let of_json j = list_of_json ~kind:"Scans" ~of_json:Scan.of_json j
    let to_json v = composed_to_json to_value v
  end
module FilterCriteria =
  struct
    type nonrec t =
      {
      filterCriterion: FilterCriterionList.t option
        [@ocaml.doc
          "Represents a condition that when matched will be added to the response of the operation."]}
    let make ?filterCriterion = fun () -> { filterCriterion }
    let to_value x =
      structure_to_value
        [("filterCriterion",
           (Option.map x.filterCriterion ~f:FilterCriterionList.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let filterCriterion =
        (Option.map ~f:FilterCriterionList.of_xml)
          (Xml.child xml_arg0 "filterCriterion") in
      make ?filterCriterion ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let filterCriterion =
        field_map json__ "FilterCriterion" FilterCriterionList.of_json in
      make ?filterCriterion ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Represents the criteria to be used in the filter for describing scan entries."]
module IntegerValueWithMax =
  struct
    type nonrec t = int
    let make i =
      let open Result in
        ok_or_failwith
          ((check_int_max i ~max:50) >>= (fun () -> check_int_min i ~min:1));
        i
    let of_string = Int.of_string
    let to_value x = `Integer x
    let to_query v = to_query to_value v
    let to_header x = Int.to_string x
    let of_xml xml_arg0 =
      Int.of_string
        (string_of_xml ~kind:"an integer for IntegerValueWithMax" xml_arg0)
    let of_json j = Int.of_float (float_of_json ~kind:"an integer" j)
    let to_json = simple_to_json to_value
  end
module FindingTypes =
  struct
    type nonrec t = FindingType.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:0));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:FindingType.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:FindingType.of_xml)
    let of_json j =
      list_of_json ~kind:"FindingTypes" ~of_json:FindingType.of_json j
    let to_json v = composed_to_json to_value v
  end
module AccountDetails =
  struct
    type nonrec t = AccountDetail.t list
    let make i =
      let open Result in
        ok_or_failwith
          ((check_list_max i ~max:50) >>= (fun () -> check_list_min i ~min:1));
        i
    let of_string _ =
      failwithf "of_string is not implemented for List_shape objects" ()
      [@@warning "-32"]
    let to_value xs =
      (xs |> (List.map ~f:AccountDetail.to_value)) |> (fun x -> `List x)
    let to_query v = to_query to_value v
    let to_header _ =
      failwithf "to_header is not implemented for List_shape objects" ()
    let of_xml x =
      make
        (List.map
           ((Xml.all_children x) |>
              (List.filter
                 ~f:(function
                     | `Data s ->
                         (match Stdlib.String.trim s with
                          | "" -> false
                          | _ -> true)
                     | _ -> true))) ~f:AccountDetail.of_xml)
    let of_json j =
      list_of_json ~kind:"AccountDetails" ~of_json:AccountDetail.of_json j
    let to_json v = composed_to_json to_value v
  end
module UnprocessedDataSourcesResult =
  struct
    type nonrec t =
      {
      malwareProtection: MalwareProtectionConfigurationResult.t option }
    let make ?malwareProtection = fun () -> { malwareProtection }
    let to_value x =
      structure_to_value
        [("malwareProtection",
           (Option.map x.malwareProtection
              ~f:MalwareProtectionConfigurationResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtection =
        (Option.map ~f:MalwareProtectionConfigurationResult.of_xml)
          (Xml.child xml_arg0 "malwareProtection") in
      make ?malwareProtection ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtection =
        field_map json__ "MalwareProtection"
          MalwareProtectionConfigurationResult.of_json in
      make ?malwareProtection ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Specifies the names of the data sources that couldn't be enabled."]
module UpdateTrustedEntitySetResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the trusted entity set associated with the specified trustedEntitySetId."]
module UpdateTrustedEntitySetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the GuardDuty detector associated with the threat entity set that you want to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      trustedEntitySetId: String_.t
        [@ocaml.doc
          "The ID returned by GuardDuty after updating the trusted entity set resource."];
      name: Name.t option
        [@ocaml.doc
          "A user-friendly name to identify the trusted entity set. The name of your list can include lowercase letters, uppercase letters, numbers, dash (-), and underscore (_)."];
      location: Location.t option
        [@ocaml.doc
          "The URI of the file that contains the trusted entity set."];
      expectedBucketOwner: ExpectedBucketOwner.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."];
      activate: Boolean.t option
        [@ocaml.doc
          "A boolean value that indicates whether GuardDuty is to start using this updated trusted entity set. After you update an entity set, you will need to activate it again. It might take up to 15 minutes for the updated entity set to be effective."]}
    let context_ = "UpdateTrustedEntitySetRequest"
    let make ?name =
      fun ?location ->
        fun ?expectedBucketOwner ->
          fun ?activate ->
            fun ~detectorId ->
              fun ~trustedEntitySetId ->
                fun () ->
                  {
                    name;
                    location;
                    expectedBucketOwner;
                    activate;
                    detectorId;
                    trustedEntitySetId
                  }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("TrustedEntitySetId",
          (Some (String_.to_value x.trustedEntitySetId)));
        ("name", (Option.map x.name ~f:Name.to_value));
        ("location", (Option.map x.location ~f:Location.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:ExpectedBucketOwner.to_value));
        ("activate", (Option.map x.activate ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let activate =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "activate") in
      let expectedBucketOwner =
        (Option.map ~f:ExpectedBucketOwner.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let location =
        (Option.map ~f:Location.of_xml) (Xml.child xml_arg0 "location") in
      let name = (Option.map ~f:Name.of_xml) (Xml.child xml_arg0 "name") in
      let trustedEntitySetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "TrustedEntitySetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?activate ?expectedBucketOwner ?location ?name ~trustedEntitySetId
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let activate = field_map json__ "Activate" Boolean.of_json in
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" ExpectedBucketOwner.of_json in
      let location = field_map json__ "Location" Location.of_json in
      let name = field_map json__ "Name" Name.of_json in
      let trustedEntitySetId =
        field_map_exn json__ "TrustedEntitySetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?activate ?expectedBucketOwner ?location ?name ~trustedEntitySetId
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the trusted entity set associated with the specified trustedEntitySetId."]
module UpdateThreatIntelSetResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the ThreatIntelSet specified by the ThreatIntelSet ID."]
module UpdateThreatIntelSetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The detectorID that specifies the GuardDuty service whose ThreatIntelSet you want to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      threatIntelSetId: String_.t
        [@ocaml.doc
          "The unique ID that specifies the ThreatIntelSet that you want to update."];
      name: Name.t option
        [@ocaml.doc
          "The unique ID that specifies the ThreatIntelSet that you want to update."];
      location: Location.t option
        [@ocaml.doc
          "The updated URI of the file that contains the ThreateIntelSet."];
      activate: Boolean.t option
        [@ocaml.doc
          "The updated Boolean value that specifies whether the ThreateIntelSet is active or not."];
      expectedBucketOwner: AccountId.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."]}
    let context_ = "UpdateThreatIntelSetRequest"
    let make ?name =
      fun ?location ->
        fun ?activate ->
          fun ?expectedBucketOwner ->
            fun ~detectorId ->
              fun ~threatIntelSetId ->
                fun () ->
                  {
                    name;
                    location;
                    activate;
                    expectedBucketOwner;
                    detectorId;
                    threatIntelSetId
                  }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("ThreatIntelSetId", (Some (String_.to_value x.threatIntelSetId)));
        ("name", (Option.map x.name ~f:Name.to_value));
        ("location", (Option.map x.location ~f:Location.to_value));
        ("activate", (Option.map x.activate ~f:Boolean.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:AccountId.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let expectedBucketOwner =
        (Option.map ~f:AccountId.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let activate =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "activate") in
      let location =
        (Option.map ~f:Location.of_xml) (Xml.child xml_arg0 "location") in
      let name = (Option.map ~f:Name.of_xml) (Xml.child xml_arg0 "name") in
      let threatIntelSetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ThreatIntelSetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?expectedBucketOwner ?activate ?location ?name ~threatIntelSetId
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" AccountId.of_json in
      let activate = field_map json__ "Activate" Boolean.of_json in
      let location = field_map json__ "Location" Location.of_json in
      let name = field_map json__ "Name" Name.of_json in
      let threatIntelSetId =
        field_map_exn json__ "ThreatIntelSetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?expectedBucketOwner ?activate ?location ?name ~threatIntelSetId
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the ThreatIntelSet specified by the ThreatIntelSet ID."]
module UpdateThreatEntitySetResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the threat entity set associated with the specified threatEntitySetId."]
module UpdateThreatEntitySetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the GuardDuty detector associated with the threat entity set that you want to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      threatEntitySetId: String_.t
        [@ocaml.doc
          "The ID returned by GuardDuty after updating the threat entity set resource."];
      name: Name.t option
        [@ocaml.doc
          "A user-friendly name to identify the trusted entity set. The name of your list can include lowercase letters, uppercase letters, numbers, dash (-), and underscore (_)."];
      location: Location.t option
        [@ocaml.doc
          "The URI of the file that contains the trusted entity set."];
      expectedBucketOwner: ExpectedBucketOwner.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."];
      activate: Boolean.t option
        [@ocaml.doc
          "A boolean value that indicates whether GuardDuty is to start using this updated threat entity set. After you update an entity set, you will need to activate it again. It might take up to 15 minutes for the updated entity set to be effective."]}
    let context_ = "UpdateThreatEntitySetRequest"
    let make ?name =
      fun ?location ->
        fun ?expectedBucketOwner ->
          fun ?activate ->
            fun ~detectorId ->
              fun ~threatEntitySetId ->
                fun () ->
                  {
                    name;
                    location;
                    expectedBucketOwner;
                    activate;
                    detectorId;
                    threatEntitySetId
                  }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("ThreatEntitySetId", (Some (String_.to_value x.threatEntitySetId)));
        ("name", (Option.map x.name ~f:Name.to_value));
        ("location", (Option.map x.location ~f:Location.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:ExpectedBucketOwner.to_value));
        ("activate", (Option.map x.activate ~f:Boolean.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let activate =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "activate") in
      let expectedBucketOwner =
        (Option.map ~f:ExpectedBucketOwner.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let location =
        (Option.map ~f:Location.of_xml) (Xml.child xml_arg0 "location") in
      let name = (Option.map ~f:Name.of_xml) (Xml.child xml_arg0 "name") in
      let threatEntitySetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ThreatEntitySetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?activate ?expectedBucketOwner ?location ?name ~threatEntitySetId
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let activate = field_map json__ "Activate" Boolean.of_json in
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" ExpectedBucketOwner.of_json in
      let location = field_map json__ "Location" Location.of_json in
      let name = field_map json__ "Name" Name.of_json in
      let threatEntitySetId =
        field_map_exn json__ "ThreatEntitySetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?activate ?expectedBucketOwner ?location ?name ~threatEntitySetId
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the threat entity set associated with the specified threatEntitySetId."]
module UpdatePublishingDestinationResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates information about the publishing destination specified by the destinationId."]
module UpdatePublishingDestinationRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector associated with the publishing destinations to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      destinationId: String_.t
        [@ocaml.doc "The ID of the publishing destination to update."];
      destinationProperties: DestinationProperties.t option
        [@ocaml.doc
          "A DestinationProperties object that includes the DestinationArn and KmsKeyArn of the publishing destination."]}
    let context_ = "UpdatePublishingDestinationRequest"
    let make ?destinationProperties =
      fun ~detectorId ->
        fun ~destinationId ->
          fun () -> { destinationProperties; detectorId; destinationId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("DestinationId", (Some (String_.to_value x.destinationId)));
        ("destinationProperties",
          (Option.map x.destinationProperties
             ~f:DestinationProperties.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let destinationProperties =
        (Option.map ~f:DestinationProperties.of_xml)
          (Xml.child xml_arg0 "destinationProperties") in
      let destinationId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DestinationId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?destinationProperties ~destinationId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let destinationProperties =
        field_map json__ "DestinationProperties"
          DestinationProperties.of_json in
      let destinationId =
        field_map_exn json__ "DestinationId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?destinationProperties ~destinationId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates information about the publishing destination specified by the destinationId."]
module UpdateOrganizationConfigurationResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module UpdateOrganizationConfigurationRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector that configures the delegated administrator. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      autoEnable: Boolean.t option
        [@ocaml.doc
          "Represents whether to automatically enable member accounts in the organization. This applies to only new member accounts, not the existing member accounts. When a new account joins the organization, the chosen features will be enabled for them by default. Even though this is still supported, we recommend using AutoEnableOrganizationMembers to achieve the similar results. You must provide a value for either autoEnableOrganizationMembers or autoEnable."];
      dataSources: OrganizationDataSourceConfigurations.t option
        [@ocaml.doc "Describes which data sources will be updated."];
      features: OrganizationFeaturesConfigurations.t option
        [@ocaml.doc
          "A list of features that will be configured for the organization."];
      autoEnableOrganizationMembers: AutoEnableMembers.t option
        [@ocaml.doc
          "Indicates the auto-enablement configuration of GuardDuty for the member accounts in the organization. You must provide a value for either autoEnableOrganizationMembers or autoEnable. Use one of the following configuration values for autoEnableOrganizationMembers: NEW: Indicates that when a new account joins the organization, they will have GuardDuty enabled automatically. ALL: Indicates that all accounts in the organization have GuardDuty enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. It may take up to 24 hours to update the configuration for all the member accounts. NONE: Indicates that GuardDuty will not be automatically enabled for any account in the organization. The administrator must manage GuardDuty for each account in the organization individually. When you update the auto-enable setting from ALL or NEW to NONE, this action doesn't disable the corresponding option for your existing accounts. This configuration will apply to the new accounts that join the organization. After you update the auto-enable settings, no new account will have the corresponding option as enabled."]}
    let context_ = "UpdateOrganizationConfigurationRequest"
    let make ?autoEnable =
      fun ?dataSources ->
        fun ?features ->
          fun ?autoEnableOrganizationMembers ->
            fun ~detectorId ->
              fun () ->
                {
                  autoEnable;
                  dataSources;
                  features;
                  autoEnableOrganizationMembers;
                  detectorId
                }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("autoEnable", (Option.map x.autoEnable ~f:Boolean.to_value));
        ("dataSources",
          (Option.map x.dataSources
             ~f:OrganizationDataSourceConfigurations.to_value));
        ("features",
          (Option.map x.features
             ~f:OrganizationFeaturesConfigurations.to_value));
        ("autoEnableOrganizationMembers",
          (Option.map x.autoEnableOrganizationMembers
             ~f:AutoEnableMembers.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnableOrganizationMembers =
        (Option.map ~f:AutoEnableMembers.of_xml)
          (Xml.child xml_arg0 "autoEnableOrganizationMembers") in
      let features =
        (Option.map ~f:OrganizationFeaturesConfigurations.of_xml)
          (Xml.child xml_arg0 "features") in
      let dataSources =
        (Option.map ~f:OrganizationDataSourceConfigurations.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let autoEnable =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "autoEnable") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?autoEnableOrganizationMembers ?features ?dataSources ?autoEnable
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnableOrganizationMembers =
        field_map json__ "AutoEnableOrganizationMembers"
          AutoEnableMembers.of_json in
      let features =
        field_map json__ "Features"
          OrganizationFeaturesConfigurations.of_json in
      let dataSources =
        field_map json__ "DataSources"
          OrganizationDataSourceConfigurations.of_json in
      let autoEnable = field_map json__ "AutoEnable" Boolean.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?autoEnableOrganizationMembers ?features ?dataSources ?autoEnable
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module UpdateMemberDetectorsResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of member account IDs that were unable to be processed along with an explanation for why they were not processed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on member accounts to be updated. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module UpdateMemberDetectorsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The detector ID of the administrator account. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountIds: AccountIds.t
        [@ocaml.doc "A list of member account IDs to be updated."];
      dataSources: DataSourceConfigurations.t option
        [@ocaml.doc "Describes which data sources will be updated."];
      features: MemberFeaturesConfigurations.t option
        [@ocaml.doc
          "A list of features that will be updated for the specified member accounts."]}
    let context_ = "UpdateMemberDetectorsRequest"
    let make ?dataSources =
      fun ?features ->
        fun ~detectorId ->
          fun ~accountIds ->
            fun () -> { dataSources; features; detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)));
        ("dataSources",
          (Option.map x.dataSources ~f:DataSourceConfigurations.to_value));
        ("features",
          (Option.map x.features ~f:MemberFeaturesConfigurations.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let features =
        (Option.map ~f:MemberFeaturesConfigurations.of_xml)
          (Xml.child xml_arg0 "features") in
      let dataSources =
        (Option.map ~f:DataSourceConfigurations.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?features ?dataSources ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let features =
        field_map json__ "Features" MemberFeaturesConfigurations.of_json in
      let dataSources =
        field_map json__ "DataSources" DataSourceConfigurations.of_json in
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?features ?dataSources ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Contains information on member accounts to be updated. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module UpdateMalwareScanSettingsResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module UpdateMalwareScanSettingsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that specifies the GuardDuty service where you want to update scan settings. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      scanResourceCriteria: ScanResourceCriteria.t option
        [@ocaml.doc
          "Represents the criteria to be used in the filter for selecting resources to scan."];
      ebsSnapshotPreservation: EbsSnapshotPreservation.t option
        [@ocaml.doc
          "An enum value representing possible snapshot preservation settings."]}
    let context_ = "UpdateMalwareScanSettingsRequest"
    let make ?scanResourceCriteria =
      fun ?ebsSnapshotPreservation ->
        fun ~detectorId ->
          fun () ->
            { scanResourceCriteria; ebsSnapshotPreservation; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("scanResourceCriteria",
          (Option.map x.scanResourceCriteria ~f:ScanResourceCriteria.to_value));
        ("ebsSnapshotPreservation",
          (Option.map x.ebsSnapshotPreservation
             ~f:EbsSnapshotPreservation.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ebsSnapshotPreservation =
        (Option.map ~f:EbsSnapshotPreservation.of_xml)
          (Xml.child xml_arg0 "ebsSnapshotPreservation") in
      let scanResourceCriteria =
        (Option.map ~f:ScanResourceCriteria.of_xml)
          (Xml.child xml_arg0 "scanResourceCriteria") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?ebsSnapshotPreservation ?scanResourceCriteria ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ebsSnapshotPreservation =
        field_map json__ "EbsSnapshotPreservation"
          EbsSnapshotPreservation.of_json in
      let scanResourceCriteria =
        field_map json__ "ScanResourceCriteria" ScanResourceCriteria.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?ebsSnapshotPreservation ?scanResourceCriteria ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module UpdateMalwareProtectionPlanRequest =
  struct
    type nonrec t =
      {
      malwareProtectionPlanId: String_.t
        [@ocaml.doc
          "A unique identifier associated with the Malware Protection plan."];
      role: String_.t option
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the IAM role with permissions to scan and add tags to the associated protected resource."];
      actions: MalwareProtectionPlanActions.t option
        [@ocaml.doc
          "Information about whether the tags will be added to the S3 object after scanning."];
      protectedResource: UpdateProtectedResource.t option
        [@ocaml.doc
          "Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource."]}
    let context_ = "UpdateMalwareProtectionPlanRequest"
    let make ?role =
      fun ?actions ->
        fun ?protectedResource ->
          fun ~malwareProtectionPlanId ->
            fun () ->
              { role; actions; protectedResource; malwareProtectionPlanId }
    let to_value x =
      structure_to_value
        [("MalwareProtectionPlanId",
           (Some (String_.to_value x.malwareProtectionPlanId)));
        ("role", (Option.map x.role ~f:String_.to_value));
        ("actions",
          (Option.map x.actions ~f:MalwareProtectionPlanActions.to_value));
        ("protectedResource",
          (Option.map x.protectedResource ~f:UpdateProtectedResource.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let protectedResource =
        (Option.map ~f:UpdateProtectedResource.of_xml)
          (Xml.child xml_arg0 "protectedResource") in
      let actions =
        (Option.map ~f:MalwareProtectionPlanActions.of_xml)
          (Xml.child xml_arg0 "actions") in
      let role = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "role") in
      let malwareProtectionPlanId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "MalwareProtectionPlanId") in
      make ?protectedResource ?actions ?role ~malwareProtectionPlanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let protectedResource =
        field_map json__ "ProtectedResource" UpdateProtectedResource.of_json in
      let actions =
        field_map json__ "Actions" MalwareProtectionPlanActions.of_json in
      let role = field_map json__ "Role" String_.of_json in
      let malwareProtectionPlanId =
        field_map_exn json__ "MalwareProtectionPlanId" String_.of_json in
      make ?protectedResource ?actions ?role ~malwareProtectionPlanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Updates an existing Malware Protection plan resource."]
module UpdateIPSetResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Updates the IPSet specified by the IPSet ID."]
module UpdateIPSetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The detectorID that specifies the GuardDuty service whose IPSet you want to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      ipSetId: String_.t
        [@ocaml.doc
          "The unique ID that specifies the IPSet that you want to update."];
      name: Name.t option
        [@ocaml.doc
          "The unique ID that specifies the IPSet that you want to update."];
      location: Location.t option
        [@ocaml.doc "The updated URI of the file that contains the IPSet."];
      activate: Boolean.t option
        [@ocaml.doc
          "The updated Boolean value that specifies whether the IPSet is active or not."];
      expectedBucketOwner: AccountId.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."]}
    let context_ = "UpdateIPSetRequest"
    let make ?name =
      fun ?location ->
        fun ?activate ->
          fun ?expectedBucketOwner ->
            fun ~detectorId ->
              fun ~ipSetId ->
                fun () ->
                  {
                    name;
                    location;
                    activate;
                    expectedBucketOwner;
                    detectorId;
                    ipSetId
                  }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("IpSetId", (Some (String_.to_value x.ipSetId)));
        ("name", (Option.map x.name ~f:Name.to_value));
        ("location", (Option.map x.location ~f:Location.to_value));
        ("activate", (Option.map x.activate ~f:Boolean.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:AccountId.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let expectedBucketOwner =
        (Option.map ~f:AccountId.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let activate =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "activate") in
      let location =
        (Option.map ~f:Location.of_xml) (Xml.child xml_arg0 "location") in
      let name = (Option.map ~f:Name.of_xml) (Xml.child xml_arg0 "name") in
      let ipSetId =
        String_.of_xml (Xml.child_exn ~context:context_ xml_arg0 "IpSetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?expectedBucketOwner ?activate ?location ?name ~ipSetId
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" AccountId.of_json in
      let activate = field_map json__ "Activate" Boolean.of_json in
      let location = field_map json__ "Location" Location.of_json in
      let name = field_map json__ "Name" Name.of_json in
      let ipSetId = field_map_exn json__ "IpSetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?expectedBucketOwner ?activate ?location ?name ~ipSetId
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Updates the IPSet specified by the IPSet ID."]
module UpdateFindingsFeedbackResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Marks the specified GuardDuty findings as useful or not useful."]
module UpdateFindingsFeedbackRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector that is associated with the findings for which you want to update the feedback. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      findingIds: FindingIds.t
        [@ocaml.doc
          "The IDs of the findings that you want to mark as useful or not useful."];
      feedback: Feedback.t [@ocaml.doc "The feedback for the finding."];
      comments: SensitiveString.t option
        [@ocaml.doc "Additional feedback about the GuardDuty findings."]}
    let context_ = "UpdateFindingsFeedbackRequest"
    let make ?comments =
      fun ~detectorId ->
        fun ~findingIds ->
          fun ~feedback ->
            fun () -> { comments; detectorId; findingIds; feedback }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("findingIds", (Some (FindingIds.to_value x.findingIds)));
        ("feedback", (Some (Feedback.to_value x.feedback)));
        ("comments", (Option.map x.comments ~f:SensitiveString.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let comments =
        (Option.map ~f:SensitiveString.of_xml)
          (Xml.child xml_arg0 "comments") in
      let feedback =
        Feedback.of_xml (Xml.child_exn ~context:context_ xml_arg0 "feedback") in
      let findingIds =
        FindingIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "findingIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?comments ~feedback ~findingIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let comments = field_map json__ "Comments" SensitiveString.of_json in
      let feedback = field_map_exn json__ "Feedback" Feedback.of_json in
      let findingIds = field_map_exn json__ "FindingIds" FindingIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?comments ~feedback ~findingIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Marks the specified GuardDuty findings as useful or not useful."]
module UpdateFilterResponse =
  struct
    type nonrec t =
      {
      name: FilterName.t option [@ocaml.doc "The name of the filter."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?name = fun () -> { name }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:FilterName.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let name =
        (Option.map ~f:FilterName.of_xml) (Xml.child xml_arg0 "name") in
      make ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let name = field_map json__ "Name" FilterName.of_json in make ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Updates the filter specified by the filter name."]
module UpdateFilterRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that specifies the GuardDuty service where you want to update a filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      filterName: String_.t [@ocaml.doc "The name of the filter."];
      description: FilterDescription.t option
        [@ocaml.doc
          "The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses (\\{ \\}, \\[ \\], and ( )), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace."];
      action: FilterAction.t option
        [@ocaml.doc
          "Specifies the action that is to be applied to the findings that match the filter. Default: NOOP"];
      rank: FilterRank.t option
        [@ocaml.doc
          "Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings."];
      findingCriteria: FindingCriteria.t option
        [@ocaml.doc
          "Represents the criteria to be used in the filter for querying findings. The following fields are available for filtering: accountId arn associatedAttackSequenceArn confidence createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 description id partition region resource.accessKeyDetails.accessKeyId resource.accessKeyDetails.principalId resource.accessKeyDetails.userIdentity.accessKeyId resource.accessKeyDetails.userIdentity.accountId resource.accessKeyDetails.userIdentity.arn resource.accessKeyDetails.userIdentity.principalId resource.accessKeyDetails.userIdentity.sessionContext.attributes.mfaAuthenticated resource.accessKeyDetails.userIdentity.sessionContext.ec2RoleDelivery resource.accessKeyDetails.userIdentity.sessionContext.invokedBy resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.accountId resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.arn resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.principalId resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.type resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.userName resource.accessKeyDetails.userIdentity.sessionContext.sourceIdentity resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.attributes resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.federatedProvider resource.accessKeyDetails.userIdentity.type resource.accessKeyDetails.userIdentity.userName resource.accessKeyDetails.userName resource.accessKeyDetails.userType resource.bedrockGuardrailDetails.guardrailArn resource.bedrockGuardrailDetails.guardrailVersion resource.containerDetails.containerRuntime resource.containerDetails.id resource.containerDetails.image resource.containerDetails.imagePrefix resource.containerDetails.name resource.containerDetails.securityContext.allowPrivilegeEscalation resource.containerDetails.securityContext.privileged resource.containerDetails.volumeMounts.mountPath resource.containerDetails.volumeMounts.name resource.ebsSnapshotDetails.snapshotArn resource.ebsVolumeDetails.scannedVolumeDetails.deviceName resource.ebsVolumeDetails.scannedVolumeDetails.encryptionType resource.ebsVolumeDetails.scannedVolumeDetails.kmsKeyArn resource.ebsVolumeDetails.scannedVolumeDetails.snapshotArn resource.ebsVolumeDetails.scannedVolumeDetails.volumeArn resource.ebsVolumeDetails.scannedVolumeDetails.volumeSizeInGB resource.ebsVolumeDetails.scannedVolumeDetails.volumeType resource.ebsVolumeDetails.skippedVolumeDetails.deviceName resource.ebsVolumeDetails.skippedVolumeDetails.encryptionType resource.ebsVolumeDetails.skippedVolumeDetails.kmsKeyArn resource.ebsVolumeDetails.skippedVolumeDetails.snapshotArn resource.ebsVolumeDetails.skippedVolumeDetails.volumeArn resource.ebsVolumeDetails.skippedVolumeDetails.volumeSizeInGB resource.ebsVolumeDetails.skippedVolumeDetails.volumeType resource.ec2ImageDetails.imageArn resource.ecsClusterDetails.activeServicesCount resource.ecsClusterDetails.arn resource.ecsClusterDetails.name resource.ecsClusterDetails.registeredContainerInstancesCount resource.ecsClusterDetails.runningTasksCount resource.ecsClusterDetails.status resource.ecsClusterDetails.tags.key resource.ecsClusterDetails.tags.value resource.ecsClusterDetails.taskDetails.arn resource.ecsClusterDetails.taskDetails.containers.containerRuntime resource.ecsClusterDetails.taskDetails.containers.id resource.ecsClusterDetails.taskDetails.containers.image resource.ecsClusterDetails.taskDetails.containers.imagePrefix resource.ecsClusterDetails.taskDetails.containers.name resource.ecsClusterDetails.taskDetails.containers.securityContext.allowPrivilegeEscalation resource.ecsClusterDetails.taskDetails.containers.securityContext.privileged resource.ecsClusterDetails.taskDetails.containers.volumeMounts.mountPath resource.ecsClusterDetails.taskDetails.containers.volumeMounts.name resource.ecsClusterDetails.taskDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.ecsClusterDetails.taskDetails.definitionArn resource.ecsClusterDetails.taskDetails.group resource.ecsClusterDetails.taskDetails.launchType resource.ecsClusterDetails.taskDetails.startedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.ecsClusterDetails.taskDetails.startedBy resource.ecsClusterDetails.taskDetails.tags.key resource.ecsClusterDetails.taskDetails.tags.value resource.ecsClusterDetails.taskDetails.version resource.ecsClusterDetails.taskDetails.volumes.hostPath.path resource.ecsClusterDetails.taskDetails.volumes.name resource.eksClusterDetails.arn resource.eksClusterDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.eksClusterDetails.name resource.eksClusterDetails.status resource.eksClusterDetails.tags.key resource.eksClusterDetails.tags.value resource.eksClusterDetails.vpcId resource.instanceDetails.availabilityZone resource.instanceDetails.iamInstanceProfile.arn resource.instanceDetails.iamInstanceProfile.id resource.instanceDetails.imageDescription resource.instanceDetails.imageId resource.instanceDetails.instanceId resource.instanceDetails.instanceState resource.instanceDetails.instanceType resource.instanceDetails.launchTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.instanceDetails.networkInterfaces.ipv6Addresses resource.instanceDetails.networkInterfaces.networkInterfaceId resource.instanceDetails.networkInterfaces.privateDnsName resource.instanceDetails.networkInterfaces.privateIpAddress resource.instanceDetails.networkInterfaces.privateIpAddresses.privateDnsName resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress resource.instanceDetails.networkInterfaces.publicDnsName resource.instanceDetails.networkInterfaces.publicIp resource.instanceDetails.networkInterfaces.securityGroups.groupId resource.instanceDetails.networkInterfaces.securityGroups.groupName resource.instanceDetails.networkInterfaces.subnetId resource.instanceDetails.networkInterfaces.vpcId resource.instanceDetails.outpostArn resource.instanceDetails.platform resource.instanceDetails.productCodes.productCodeId resource.instanceDetails.productCodes.productCodeType resource.instanceDetails.tags.key resource.instanceDetails.tags.value resource.kubernetesDetails.kubernetesUserDetails.groups resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.groups resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.username resource.kubernetesDetails.kubernetesUserDetails.sessionName resource.kubernetesDetails.kubernetesUserDetails.uid resource.kubernetesDetails.kubernetesUserDetails.username resource.kubernetesDetails.kubernetesWorkloadDetails.containers.containerRuntime resource.kubernetesDetails.kubernetesWorkloadDetails.containers.id resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix resource.kubernetesDetails.kubernetesWorkloadDetails.containers.name resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.allowPrivilegeEscalation resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.privileged resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.mountPath resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.name resource.kubernetesDetails.kubernetesWorkloadDetails.hostIpc resource.kubernetesDetails.kubernetesWorkloadDetails.hostNetwork resource.kubernetesDetails.kubernetesWorkloadDetails.hostPid resource.kubernetesDetails.kubernetesWorkloadDetails.name resource.kubernetesDetails.kubernetesWorkloadDetails.namespace resource.kubernetesDetails.kubernetesWorkloadDetails.serviceAccountName resource.kubernetesDetails.kubernetesWorkloadDetails.type resource.kubernetesDetails.kubernetesWorkloadDetails.uid resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.hostPath.path resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.name resource.lambdaDetails.description resource.lambdaDetails.functionArn resource.lambdaDetails.functionName resource.lambdaDetails.functionVersion resource.lambdaDetails.lastModifiedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.lambdaDetails.revisionId resource.lambdaDetails.role resource.lambdaDetails.tags.key resource.lambdaDetails.tags.value resource.lambdaDetails.vpcConfig.securityGroups.groupId resource.lambdaDetails.vpcConfig.securityGroups.groupName resource.lambdaDetails.vpcConfig.subnetIds resource.lambdaDetails.vpcConfig.vpcId resource.rdsDbInstanceDetails.dbClusterIdentifier resource.rdsDbInstanceDetails.dbInstanceArn resource.rdsDbInstanceDetails.dbInstanceIdentifier resource.rdsDbInstanceDetails.dbSecurityGroups.name resource.rdsDbInstanceDetails.dbSecurityGroups.status resource.rdsDbInstanceDetails.dbiResourceId resource.rdsDbInstanceDetails.engine resource.rdsDbInstanceDetails.engineVersion resource.rdsDbInstanceDetails.iamDatabaseAuthenticationEnabled resource.rdsDbInstanceDetails.publiclyAccessible resource.rdsDbInstanceDetails.tags.key resource.rdsDbInstanceDetails.tags.value resource.rdsDbInstanceDetails.vpcId resource.rdsDbInstanceDetails.vpcSecurityGroups.status resource.rdsDbInstanceDetails.vpcSecurityGroups.vpcSecurityGroupId resource.rdsDbUserDetails.application resource.rdsDbUserDetails.authMethod resource.rdsDbUserDetails.database resource.rdsDbUserDetails.ssl resource.rdsDbUserDetails.user resource.rdsLimitlessDbDetails.dbClusterIdentifier resource.rdsLimitlessDbDetails.dbShardGroupArn resource.rdsLimitlessDbDetails.dbShardGroupIdentifier resource.rdsLimitlessDbDetails.dbShardGroupResourceId resource.rdsLimitlessDbDetails.engine resource.rdsLimitlessDbDetails.engineVersion resource.rdsLimitlessDbDetails.tags.key resource.rdsLimitlessDbDetails.tags.value resource.recoveryPointDetails.backupVaultName resource.recoveryPointDetails.recoveryPointArn resource.resourceType resource.s3BucketDetails.arn resource.s3BucketDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.s3BucketDetails.defaultServerSideEncryption.encryptionType resource.s3BucketDetails.defaultServerSideEncryption.kmsMasterKeyArn resource.s3BucketDetails.name resource.s3BucketDetails.owner.id resource.s3BucketDetails.publicAccess.effectivePermission resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.blockPublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.blockPublicPolicy resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.ignorePublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.restrictPublicBuckets resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.accessControlList.allowsPublicReadAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.accessControlList.allowsPublicWriteAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.blockPublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.blockPublicPolicy resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.ignorePublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.restrictPublicBuckets resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicReadAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicWriteAccess resource.s3BucketDetails.s3ObjectDetails.eTag resource.s3BucketDetails.s3ObjectDetails.hash resource.s3BucketDetails.s3ObjectDetails.key resource.s3BucketDetails.s3ObjectDetails.objectArn resource.s3BucketDetails.s3ObjectDetails.versionId resource.s3BucketDetails.tags.key resource.s3BucketDetails.tags.value resource.s3BucketDetails.type schemaVersion service.action.actionType service.action.awsApiCallAction.affectedResources service.action.awsApiCallAction.api service.action.awsApiCallAction.callerType service.action.awsApiCallAction.domainDetails.domain service.action.awsApiCallAction.errorCode service.action.awsApiCallAction.remoteAccountDetails.accountId service.action.awsApiCallAction.remoteAccountDetails.affiliated service.action.awsApiCallAction.remoteAccountDetails.awsServiceName service.action.awsApiCallAction.remoteIpDetails.city.cityName service.action.awsApiCallAction.remoteIpDetails.country.countryCode service.action.awsApiCallAction.remoteIpDetails.country.countryName service.action.awsApiCallAction.remoteIpDetails.geoLocation.lat service.action.awsApiCallAction.remoteIpDetails.geoLocation.lon service.action.awsApiCallAction.remoteIpDetails.ipAddressV4 service.action.awsApiCallAction.remoteIpDetails.ipAddressV6 service.action.awsApiCallAction.remoteIpDetails.organization.asn service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg service.action.awsApiCallAction.remoteIpDetails.organization.isp service.action.awsApiCallAction.remoteIpDetails.organization.org service.action.awsApiCallAction.serviceName service.action.awsApiCallAction.userAgent service.action.dnsRequestAction.blocked service.action.dnsRequestAction.domain service.action.dnsRequestAction.domainWithSuffix service.action.dnsRequestAction.protocol service.action.dnsRequestAction.vpcOwnerAccountId service.action.kubernetesApiCallAction.namespace service.action.kubernetesApiCallAction.parameters service.action.kubernetesApiCallAction.remoteIpDetails.city.cityName service.action.kubernetesApiCallAction.remoteIpDetails.country.countryCode service.action.kubernetesApiCallAction.remoteIpDetails.country.countryName service.action.kubernetesApiCallAction.remoteIpDetails.geoLocation.lat service.action.kubernetesApiCallAction.remoteIpDetails.geoLocation.lon service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4 service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6 service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn service.action.kubernetesApiCallAction.remoteIpDetails.organization.asnOrg service.action.kubernetesApiCallAction.remoteIpDetails.organization.isp service.action.kubernetesApiCallAction.remoteIpDetails.organization.org service.action.kubernetesApiCallAction.requestUri service.action.kubernetesApiCallAction.resource service.action.kubernetesApiCallAction.resourceName service.action.kubernetesApiCallAction.sourceIPs service.action.kubernetesApiCallAction.statusCode service.action.kubernetesApiCallAction.subresource service.action.kubernetesApiCallAction.userAgent service.action.kubernetesApiCallAction.verb service.action.kubernetesPermissionCheckedDetails.allowed service.action.kubernetesPermissionCheckedDetails.namespace service.action.kubernetesPermissionCheckedDetails.resource service.action.kubernetesPermissionCheckedDetails.verb service.action.kubernetesRoleBindingDetails.kind service.action.kubernetesRoleBindingDetails.name service.action.kubernetesRoleBindingDetails.roleRefKind service.action.kubernetesRoleBindingDetails.roleRefName service.action.kubernetesRoleBindingDetails.uid service.action.kubernetesRoleDetails.kind service.action.kubernetesRoleDetails.name service.action.kubernetesRoleDetails.uid service.action.networkConnectionAction.blocked service.action.networkConnectionAction.connectionDirection service.action.networkConnectionAction.localIpDetails.ipAddressV4 service.action.networkConnectionAction.localIpDetails.ipAddressV6 service.action.networkConnectionAction.localNetworkInterface service.action.networkConnectionAction.localPortDetails.port service.action.networkConnectionAction.localPortDetails.portName service.action.networkConnectionAction.protocol service.action.networkConnectionAction.remoteIpDetails.city.cityName service.action.networkConnectionAction.remoteIpDetails.country.countryCode service.action.networkConnectionAction.remoteIpDetails.country.countryName service.action.networkConnectionAction.remoteIpDetails.geoLocation.lat service.action.networkConnectionAction.remoteIpDetails.geoLocation.lon service.action.networkConnectionAction.remoteIpDetails.ipAddressV4 service.action.networkConnectionAction.remoteIpDetails.ipAddressV6 service.action.networkConnectionAction.remoteIpDetails.organization.asn service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg service.action.networkConnectionAction.remoteIpDetails.organization.isp service.action.networkConnectionAction.remoteIpDetails.organization.org service.action.networkConnectionAction.remotePortDetails.port service.action.networkConnectionAction.remotePortDetails.portName service.action.portProbeAction.blocked service.action.portProbeAction.portProbeDetails.localIpDetails.ipAddressV4 service.action.portProbeAction.portProbeDetails.localIpDetails.ipAddressV6 service.action.portProbeAction.portProbeDetails.localPortDetails.port service.action.portProbeAction.portProbeDetails.localPortDetails.portName service.action.portProbeAction.portProbeDetails.remoteIpDetails.city.cityName service.action.portProbeAction.portProbeDetails.remoteIpDetails.country.countryCode service.action.portProbeAction.portProbeDetails.remoteIpDetails.country.countryName service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lat service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lon service.action.portProbeAction.portProbeDetails.remoteIpDetails.ipAddressV4 service.action.portProbeAction.portProbeDetails.remoteIpDetails.ipAddressV6 service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.asn service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.asnOrg service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.isp service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.org service.action.rdsLoginAttemptAction.loginAttributes.application service.action.rdsLoginAttemptAction.loginAttributes.failedLoginAttempts service.action.rdsLoginAttemptAction.loginAttributes.successfulLoginAttempts service.action.rdsLoginAttemptAction.loginAttributes.user service.action.rdsLoginAttemptAction.remoteIpDetails.city.cityName service.action.rdsLoginAttemptAction.remoteIpDetails.country.countryCode service.action.rdsLoginAttemptAction.remoteIpDetails.country.countryName service.action.rdsLoginAttemptAction.remoteIpDetails.geoLocation.lat service.action.rdsLoginAttemptAction.remoteIpDetails.geoLocation.lon service.action.rdsLoginAttemptAction.remoteIpDetails.ipAddressV4 service.action.rdsLoginAttemptAction.remoteIpDetails.ipAddressV6 service.action.rdsLoginAttemptAction.remoteIpDetails.organization.asn service.action.rdsLoginAttemptAction.remoteIpDetails.organization.asnOrg service.action.rdsLoginAttemptAction.remoteIpDetails.organization.isp service.action.rdsLoginAttemptAction.remoteIpDetails.organization.org service.additionalInfo.agentDetails.agentId service.additionalInfo.agentDetails.agentVersion service.additionalInfo.anomalies.anomalousAPIs service.additionalInfo.authenticationMethod service.additionalInfo.averagePacketSizeIn service.additionalInfo.averagePacketSizeOut service.additionalInfo.context service.additionalInfo.domain service.additionalInfo.inBytes service.additionalInfo.localNetworkInterfaceOwner service.additionalInfo.localPort service.additionalInfo.outBytes service.additionalInfo.packetsIn service.additionalInfo.packetsOut service.additionalInfo.policyArn service.additionalInfo.policyName service.additionalInfo.remotePort service.additionalInfo.sample service.additionalInfo.scannedPort service.additionalInfo.threatFileSha256 service.additionalInfo.threatListName service.additionalInfo.threatName service.additionalInfo.totalBytesIn service.additionalInfo.totalBytesOut service.additionalInfo.type service.additionalInfo.unusual.asnOrg service.additionalInfo.unusual.port service.additionalInfo.unusualProtocol service.additionalInfo.userAgent.fullUserAgent service.additionalInfo.userAgent.userAgentCategory service.additionalInfo.value service.additionalInfo.vpcOwnerAccountId service.archived service.count service.detection.anomaly.profiles service.detection.anomaly.unusual.behavior service.detection.sequence.actors.id service.detection.sequence.actors.process.name service.detection.sequence.actors.process.path service.detection.sequence.actors.process.sha256 service.detection.sequence.actors.session.createdTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.actors.session.issuer service.detection.sequence.actors.session.mfaStatus service.detection.sequence.actors.session.uid service.detection.sequence.actors.user.account.account service.detection.sequence.actors.user.account.uid service.detection.sequence.actors.user.credentialUid service.detection.sequence.actors.user.name service.detection.sequence.actors.user.type service.detection.sequence.actors.user.uid service.detection.sequence.additionalSequenceTypes service.detection.sequence.description service.detection.sequence.endpoints.autonomousSystem.name service.detection.sequence.endpoints.autonomousSystem.number service.detection.sequence.endpoints.connection.direction service.detection.sequence.endpoints.domain service.detection.sequence.endpoints.id service.detection.sequence.endpoints.ip service.detection.sequence.endpoints.location.city service.detection.sequence.endpoints.location.country service.detection.sequence.endpoints.location.lat service.detection.sequence.endpoints.location.lon service.detection.sequence.endpoints.port service.detection.sequence.resources.accountId service.detection.sequence.resources.cloudPartition service.detection.sequence.resources.data.accessKey.principalId service.detection.sequence.resources.data.accessKey.userName service.detection.sequence.resources.data.accessKey.userType service.detection.sequence.resources.data.autoscalingAutoScalingGroup.ec2InstanceUids service.detection.sequence.resources.data.cloudformationStack.ec2InstanceUids service.detection.sequence.resources.data.container.image service.detection.sequence.resources.data.container.imageUid service.detection.sequence.resources.data.ec2Image.ec2InstanceUids service.detection.sequence.resources.data.ec2Instance.availabilityZone service.detection.sequence.resources.data.ec2Instance.ec2NetworkInterfaceUids service.detection.sequence.resources.data.ec2Instance.iamInstanceProfile.arn service.detection.sequence.resources.data.ec2Instance.iamInstanceProfile.id service.detection.sequence.resources.data.ec2Instance.imageDescription service.detection.sequence.resources.data.ec2Instance.instanceState service.detection.sequence.resources.data.ec2Instance.instanceType service.detection.sequence.resources.data.ec2Instance.outpostArn service.detection.sequence.resources.data.ec2Instance.platform service.detection.sequence.resources.data.ec2Instance.productCodes.productCodeId service.detection.sequence.resources.data.ec2Instance.productCodes.productCodeType service.detection.sequence.resources.data.ec2LaunchTemplate.ec2InstanceUids service.detection.sequence.resources.data.ec2LaunchTemplate.version service.detection.sequence.resources.data.ec2NetworkInterface.ipv6Addresses service.detection.sequence.resources.data.ec2NetworkInterface.privateIpAddresses.privateDnsName service.detection.sequence.resources.data.ec2NetworkInterface.privateIpAddresses.privateIpAddress service.detection.sequence.resources.data.ec2NetworkInterface.publicIp service.detection.sequence.resources.data.ec2NetworkInterface.securityGroups.groupId service.detection.sequence.resources.data.ec2NetworkInterface.securityGroups.groupName service.detection.sequence.resources.data.ec2NetworkInterface.subNetId service.detection.sequence.resources.data.ec2NetworkInterface.vpcId service.detection.sequence.resources.data.ec2Vpc.ec2InstanceUids service.detection.sequence.resources.data.ecsCluster.ec2InstanceUids service.detection.sequence.resources.data.ecsCluster.status service.detection.sequence.resources.data.ecsTask.containerUids service.detection.sequence.resources.data.ecsTask.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.ecsTask.launchType service.detection.sequence.resources.data.ecsTask.taskDefinitionArn service.detection.sequence.resources.data.eksCluster.arn service.detection.sequence.resources.data.eksCluster.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.eksCluster.ec2InstanceUids service.detection.sequence.resources.data.eksCluster.status service.detection.sequence.resources.data.eksCluster.vpcId service.detection.sequence.resources.data.iamInstanceProfile.ec2InstanceUids service.detection.sequence.resources.data.iamInstanceProfile.id service.detection.sequence.resources.data.kubernetesWorkload.containerUids service.detection.sequence.resources.data.kubernetesWorkload.namespace service.detection.sequence.resources.data.kubernetesWorkload.type service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicAclAccess service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicAclIgnoreBehavior service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicBucketRestrictBehavior service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicPolicyAccess service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicAclAccess service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicAclIgnoreBehavior service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicBucketRestrictBehavior service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicPolicyAccess service.detection.sequence.resources.data.s3Bucket.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.s3Bucket.effectivePermission service.detection.sequence.resources.data.s3Bucket.encryptionKeyArn service.detection.sequence.resources.data.s3Bucket.encryptionType service.detection.sequence.resources.data.s3Bucket.ownerId service.detection.sequence.resources.data.s3Bucket.publicReadAccess service.detection.sequence.resources.data.s3Bucket.publicWriteAccess service.detection.sequence.resources.data.s3Bucket.s3ObjectUids service.detection.sequence.resources.data.s3Object.eTag service.detection.sequence.resources.data.s3Object.key service.detection.sequence.resources.data.s3Object.versionId service.detection.sequence.resources.name service.detection.sequence.resources.region service.detection.sequence.resources.resourceType service.detection.sequence.resources.service service.detection.sequence.resources.tags.key service.detection.sequence.resources.tags.value service.detection.sequence.resources.uid service.detection.sequence.sequenceIndicators.key service.detection.sequence.sequenceIndicators.title service.detection.sequence.sequenceIndicators.values service.detection.sequence.signals.actorIds service.detection.sequence.signals.count service.detection.sequence.signals.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.description service.detection.sequence.signals.endpointIds service.detection.sequence.signals.firstSeenAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.lastSeenAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.name service.detection.sequence.signals.resourceUids service.detection.sequence.signals.severity service.detection.sequence.signals.signalIndicators.key service.detection.sequence.signals.signalIndicators.title service.detection.sequence.signals.signalIndicators.values service.detection.sequence.signals.type service.detection.sequence.signals.uid service.detection.sequence.signals.updatedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.uid service.detectorId service.ebsVolumeScanDetails.scanCompletedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.count service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.severity service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.threatName service.ebsVolumeScanDetails.scanDetections.scannedItemCount.files service.ebsVolumeScanDetails.scanDetections.scannedItemCount.totalGb service.ebsVolumeScanDetails.scanDetections.scannedItemCount.volumes service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.itemCount service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.shortened service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.fileName service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.filePath service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.volumeArn service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.itemCount service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.uniqueThreatNameCount service.ebsVolumeScanDetails.scanDetections.threatsDetectedItemCount.files service.ebsVolumeScanDetails.scanId service.ebsVolumeScanDetails.scanStartedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.ebsVolumeScanDetails.scanType service.ebsVolumeScanDetails.sources service.ebsVolumeScanDetails.triggerFindingId service.eventFirstSeen Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.eventLastSeen Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.evidence.threatIntelligenceDetails.threatFileSha256 service.evidence.threatIntelligenceDetails.threatListName service.evidence.threatIntelligenceDetails.threatNames service.featureName service.malwareScanDetails.scanCategory service.malwareScanDetails.scanConfiguration.incrementalScanDetails.baselineResourceArn service.malwareScanDetails.scanConfiguration.triggerType service.malwareScanDetails.scanId service.malwareScanDetails.scanType service.malwareScanDetails.threats.count service.malwareScanDetails.threats.hash service.malwareScanDetails.threats.itemDetails.additionalInfo.deviceName service.malwareScanDetails.threats.itemDetails.additionalInfo.versionId service.malwareScanDetails.threats.itemDetails.hash service.malwareScanDetails.threats.itemDetails.itemPath service.malwareScanDetails.threats.itemDetails.resourceArn service.malwareScanDetails.threats.itemPaths.hash service.malwareScanDetails.threats.itemPaths.nestedItemPath service.malwareScanDetails.threats.name service.malwareScanDetails.threats.source service.malwareScanDetails.uniqueThreatCount service.resourceRole service.runtimeDetails.context.addressFamily service.runtimeDetails.context.commandLineExample service.runtimeDetails.context.fileOperation service.runtimeDetails.context.filePath service.runtimeDetails.context.fileSystemType service.runtimeDetails.context.flags service.runtimeDetails.context.ianaProtocolNumber service.runtimeDetails.context.ldPreloadValue service.runtimeDetails.context.libraryPath service.runtimeDetails.context.memoryRegions service.runtimeDetails.context.modifiedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.euid service.runtimeDetails.context.modifyingProcess.executablePath service.runtimeDetails.context.modifyingProcess.executableSha256 service.runtimeDetails.context.modifyingProcess.lineage.euid service.runtimeDetails.context.modifyingProcess.lineage.executablePath service.runtimeDetails.context.modifyingProcess.lineage.name service.runtimeDetails.context.modifyingProcess.lineage.namespacePid service.runtimeDetails.context.modifyingProcess.lineage.parentUuid service.runtimeDetails.context.modifyingProcess.lineage.pid service.runtimeDetails.context.modifyingProcess.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.lineage.userId service.runtimeDetails.context.modifyingProcess.lineage.uuid service.runtimeDetails.context.modifyingProcess.name service.runtimeDetails.context.modifyingProcess.namespacePid service.runtimeDetails.context.modifyingProcess.parentUuid service.runtimeDetails.context.modifyingProcess.pid service.runtimeDetails.context.modifyingProcess.pwd service.runtimeDetails.context.modifyingProcess.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.user service.runtimeDetails.context.modifyingProcess.userId service.runtimeDetails.context.modifyingProcess.uuid service.runtimeDetails.context.moduleFilePath service.runtimeDetails.context.moduleName service.runtimeDetails.context.moduleSha256 service.runtimeDetails.context.mountSource service.runtimeDetails.context.mountTarget service.runtimeDetails.context.relatedFilePaths service.runtimeDetails.context.releaseAgentPath service.runtimeDetails.context.runcBinaryPath service.runtimeDetails.context.scriptPath service.runtimeDetails.context.serviceName service.runtimeDetails.context.shellHistoryFilePath service.runtimeDetails.context.socketPath service.runtimeDetails.context.targetProcess.euid service.runtimeDetails.context.targetProcess.executablePath service.runtimeDetails.context.targetProcess.executableSha256 service.runtimeDetails.context.targetProcess.lineage.euid service.runtimeDetails.context.targetProcess.lineage.executablePath service.runtimeDetails.context.targetProcess.lineage.name service.runtimeDetails.context.targetProcess.lineage.namespacePid service.runtimeDetails.context.targetProcess.lineage.parentUuid service.runtimeDetails.context.targetProcess.lineage.pid service.runtimeDetails.context.targetProcess.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.targetProcess.lineage.userId service.runtimeDetails.context.targetProcess.lineage.uuid service.runtimeDetails.context.targetProcess.name service.runtimeDetails.context.targetProcess.namespacePid service.runtimeDetails.context.targetProcess.parentUuid service.runtimeDetails.context.targetProcess.pid service.runtimeDetails.context.targetProcess.pwd service.runtimeDetails.context.targetProcess.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.targetProcess.user service.runtimeDetails.context.targetProcess.userId service.runtimeDetails.context.targetProcess.uuid service.runtimeDetails.context.threatFilePath service.runtimeDetails.context.toolCategory service.runtimeDetails.context.toolName service.runtimeDetails.process.euid service.runtimeDetails.process.executablePath service.runtimeDetails.process.executableSha256 service.runtimeDetails.process.lineage.euid service.runtimeDetails.process.lineage.executablePath service.runtimeDetails.process.lineage.name service.runtimeDetails.process.lineage.namespacePid service.runtimeDetails.process.lineage.parentUuid service.runtimeDetails.process.lineage.pid service.runtimeDetails.process.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.process.lineage.userId service.runtimeDetails.process.lineage.uuid service.runtimeDetails.process.name service.runtimeDetails.process.namespacePid service.runtimeDetails.process.parentUuid service.runtimeDetails.process.pid service.runtimeDetails.process.pwd service.runtimeDetails.process.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.process.user service.runtimeDetails.process.userId service.runtimeDetails.process.uuid service.serviceName service.userFeedback severity To configure severity based filters, use the following for the FindingCriteria condition: Low: \\[\"1\", \"2\", \"3\"\\] Medium: \\[\"4\", \"5\", \"6\"\\] High: \\[\"7\", \"8\"\\] Critical: \\[\"9\", \"10\"\\] For more information, see Findings severity levels in the Amazon GuardDuty User Guide. title type updatedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000"]}
    let context_ = "UpdateFilterRequest"
    let make ?description =
      fun ?action ->
        fun ?rank ->
          fun ?findingCriteria ->
            fun ~detectorId ->
              fun ~filterName ->
                fun () ->
                  {
                    description;
                    action;
                    rank;
                    findingCriteria;
                    detectorId;
                    filterName
                  }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("FilterName", (Some (String_.to_value x.filterName)));
        ("description",
          (Option.map x.description ~f:FilterDescription.to_value));
        ("action", (Option.map x.action ~f:FilterAction.to_value));
        ("rank", (Option.map x.rank ~f:FilterRank.to_value));
        ("findingCriteria",
          (Option.map x.findingCriteria ~f:FindingCriteria.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let findingCriteria =
        (Option.map ~f:FindingCriteria.of_xml)
          (Xml.child xml_arg0 "findingCriteria") in
      let rank =
        (Option.map ~f:FilterRank.of_xml) (Xml.child xml_arg0 "rank") in
      let action =
        (Option.map ~f:FilterAction.of_xml) (Xml.child xml_arg0 "action") in
      let description =
        (Option.map ~f:FilterDescription.of_xml)
          (Xml.child xml_arg0 "description") in
      let filterName =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "FilterName") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?findingCriteria ?rank ?action ?description ~filterName
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let findingCriteria =
        field_map json__ "FindingCriteria" FindingCriteria.of_json in
      let rank = field_map json__ "Rank" FilterRank.of_json in
      let action = field_map json__ "Action" FilterAction.of_json in
      let description =
        field_map json__ "Description" FilterDescription.of_json in
      let filterName = field_map_exn json__ "FilterName" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?findingCriteria ?rank ?action ?description ~filterName
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Updates the filter specified by the filter name."]
module UpdateDetectorResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the GuardDuty detector specified by the detector ID. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module UpdateDetectorRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      enable: Boolean.t option
        [@ocaml.doc
          "Specifies whether the detector is enabled or not enabled."];
      findingPublishingFrequency: FindingPublishingFrequency.t option
        [@ocaml.doc
          "An enum value that specifies how frequently findings are exported, such as to CloudWatch Events."];
      dataSources: DataSourceConfigurations.t option
        [@ocaml.doc
          "Describes which data sources will be updated. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."];
      features: DetectorFeatureConfigurations.t option
        [@ocaml.doc
          "Provides the features that will be updated for the detector."]}
    let context_ = "UpdateDetectorRequest"
    let make ?enable =
      fun ?findingPublishingFrequency ->
        fun ?dataSources ->
          fun ?features ->
            fun ~detectorId ->
              fun () ->
                {
                  enable;
                  findingPublishingFrequency;
                  dataSources;
                  features;
                  detectorId
                }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("enable", (Option.map x.enable ~f:Boolean.to_value));
        ("findingPublishingFrequency",
          (Option.map x.findingPublishingFrequency
             ~f:FindingPublishingFrequency.to_value));
        ("dataSources",
          (Option.map x.dataSources ~f:DataSourceConfigurations.to_value));
        ("features",
          (Option.map x.features ~f:DetectorFeatureConfigurations.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let features =
        (Option.map ~f:DetectorFeatureConfigurations.of_xml)
          (Xml.child xml_arg0 "features") in
      let dataSources =
        (Option.map ~f:DataSourceConfigurations.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let findingPublishingFrequency =
        (Option.map ~f:FindingPublishingFrequency.of_xml)
          (Xml.child xml_arg0 "findingPublishingFrequency") in
      let enable =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "enable") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?features ?dataSources ?findingPublishingFrequency ?enable
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let features =
        field_map json__ "Features" DetectorFeatureConfigurations.of_json in
      let dataSources =
        field_map json__ "DataSources" DataSourceConfigurations.of_json in
      let findingPublishingFrequency =
        field_map json__ "FindingPublishingFrequency"
          FindingPublishingFrequency.of_json in
      let enable = field_map json__ "Enable" Boolean.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?features ?dataSources ?findingPublishingFrequency ?enable
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Updates the GuardDuty detector specified by the detector ID. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module UntagResourceResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Removes tags from a resource."]
module UntagResourceRequest =
  struct
    type nonrec t =
      {
      resourceArn: GuardDutyArn.t
        [@ocaml.doc
          "The Amazon Resource Name (ARN) for the resource to remove tags from."];
      tagKeys: TagKeyList.t
        [@ocaml.doc "The tag keys to remove from the resource."]}
    let context_ = "UntagResourceRequest"
    let make ~resourceArn =
      fun ~tagKeys -> fun () -> { resourceArn; tagKeys }
    let to_value x =
      structure_to_value
        [("ResourceArn", (Some (GuardDutyArn.to_value x.resourceArn)));
        ("tagKeys", (Some (TagKeyList.to_value x.tagKeys)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tagKeys =
        TagKeyList.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "tagKeys") in
      let resourceArn =
        GuardDutyArn.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ResourceArn") in
      make ~tagKeys ~resourceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tagKeys = field_map_exn json__ "TagKeys" TagKeyList.of_json in
      let resourceArn =
        field_map_exn json__ "ResourceArn" GuardDutyArn.of_json in
      make ~tagKeys ~resourceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Removes tags from a resource."]
module UnarchiveFindingsResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Unarchives GuardDuty findings specified by the findingIds."]
module UnarchiveFindingsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector associated with the findings to unarchive. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      findingIds: FindingIds.t
        [@ocaml.doc "The IDs of the findings to unarchive."]}
    let context_ = "UnarchiveFindingsRequest"
    let make ~detectorId =
      fun ~findingIds -> fun () -> { detectorId; findingIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("findingIds", (Some (FindingIds.to_value x.findingIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let findingIds =
        FindingIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "findingIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~findingIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let findingIds = field_map_exn json__ "FindingIds" FindingIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~findingIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Unarchives GuardDuty findings specified by the findingIds."]
module TagResourceResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Adds tags to a resource."]
module TagResourceRequest =
  struct
    type nonrec t =
      {
      resourceArn: GuardDutyArn.t
        [@ocaml.doc
          "The Amazon Resource Name (ARN) for the GuardDuty resource to apply a tag to."];
      tags: TagMap.t [@ocaml.doc "The tags to be added to a resource."]}
    let context_ = "TagResourceRequest"
    let make ~resourceArn = fun ~tags -> fun () -> { resourceArn; tags }
    let to_value x =
      structure_to_value
        [("ResourceArn", (Some (GuardDutyArn.to_value x.resourceArn)));
        ("tags", (Some (TagMap.to_value x.tags)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags =
        TagMap.of_xml (Xml.child_exn ~context:context_ xml_arg0 "tags") in
      let resourceArn =
        GuardDutyArn.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ResourceArn") in
      make ~tags ~resourceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map_exn json__ "Tags" TagMap.of_json in
      let resourceArn =
        field_map_exn json__ "ResourceArn" GuardDutyArn.of_json in
      make ~tags ~resourceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Adds tags to a resource."]
module StopMonitoringMembersResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of objects that contain an accountId for each account that could not be processed, and a result string that indicates why the account was not processed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization."]
module StopMonitoringMembersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector associated with the GuardDuty administrator account that is monitoring member accounts. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account IDs for the member accounts to stop monitoring."]}
    let context_ = "StopMonitoringMembersRequest"
    let make ~detectorId =
      fun ~accountIds -> fun () -> { detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization."]
module StartMonitoringMembersResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of objects that contain the unprocessed account and a result string that explains why it was unprocessed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation."]
module StartMonitoringMembersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty administrator account associated with the member accounts to monitor. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account IDs of the GuardDuty member accounts to start monitoring."]}
    let context_ = "StartMonitoringMembersRequest"
    let make ~detectorId =
      fun ~accountIds -> fun () -> { detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation."]
module StartMalwareScanResponse =
  struct
    type nonrec t =
      {
      scanId: NonEmptyString.t option
        [@ocaml.doc
          "A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `ConflictException of ConflictException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?scanId = fun () -> { scanId }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "ConflictException" ->
          `ConflictException (ConflictException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "ConflictException" ->
          `ConflictException (ConflictException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `ConflictException e ->
          `Assoc
            [("error", (`String "ConflictException"));
            ("details", (ConflictException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("scanId", (Option.map x.scanId ~f:NonEmptyString.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanId =
        (Option.map ~f:NonEmptyString.of_xml) (Xml.child xml_arg0 "scanId") in
      make ?scanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanId = field_map json__ "ScanId" NonEmptyString.of_json in
      make ?scanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account if the resourceArn belongs to an EC2 instance. When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see ListMalwareScans and GetMalwareScan. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection."]
module StartMalwareScanRequest =
  struct
    type nonrec t =
      {
      resourceArn: ResourceArn.t
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the resource for which you invoked the API."];
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the create request."];
      scanConfiguration: StartMalwareScanConfiguration.t option
        [@ocaml.doc
          "Contains information about the configuration to be used for the malware scan."]}
    let context_ = "StartMalwareScanRequest"
    let make ?clientToken =
      fun ?scanConfiguration ->
        fun ~resourceArn ->
          fun () -> { clientToken; scanConfiguration; resourceArn }
    let to_value x =
      structure_to_value
        [("resourceArn", (Some (ResourceArn.to_value x.resourceArn)));
        ("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("scanConfiguration",
          (Option.map x.scanConfiguration
             ~f:StartMalwareScanConfiguration.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanConfiguration =
        (Option.map ~f:StartMalwareScanConfiguration.of_xml)
          (Xml.child xml_arg0 "scanConfiguration") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      let resourceArn =
        ResourceArn.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "resourceArn") in
      make ?scanConfiguration ?clientToken ~resourceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanConfiguration =
        field_map json__ "ScanConfiguration"
          StartMalwareScanConfiguration.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      let resourceArn =
        field_map_exn json__ "ResourceArn" ResourceArn.of_json in
      make ?scanConfiguration ?clientToken ~resourceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account if the resourceArn belongs to an EC2 instance. When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see ListMalwareScans and GetMalwareScan. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection."]
module SendObjectMalwareScanResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Initiates a malware scan for a specific S3 object. This API allows you to perform on-demand malware scanning of individual objects in S3 buckets that have Malware Protection for S3 enabled. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection."]
module SendObjectMalwareScanRequest =
  struct
    type nonrec t =
      {
      s3Object: S3ObjectForSendObjectMalwareScan.t option
        [@ocaml.doc
          "The S3 object information for the object you want to scan. The bucket must have a Malware Protection plan configured to use this API."]}
    let make ?s3Object = fun () -> { s3Object }
    let to_value x =
      structure_to_value
        [("s3Object",
           (Option.map x.s3Object
              ~f:S3ObjectForSendObjectMalwareScan.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let s3Object =
        (Option.map ~f:S3ObjectForSendObjectMalwareScan.of_xml)
          (Xml.child xml_arg0 "s3Object") in
      make ?s3Object ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let s3Object =
        field_map json__ "S3Object" S3ObjectForSendObjectMalwareScan.of_json in
      make ?s3Object ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Initiates a malware scan for a specific S3 object. This API allows you to perform on-demand malware scanning of individual objects in S3 buckets that have Malware Protection for S3 enabled. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection."]
module ListTrustedEntitySetsResponse =
  struct
    type nonrec t =
      {
      trustedEntitySetIds: TrustedEntitySetIds.t option
        [@ocaml.doc "The IDs of the trusted entity set resources."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?trustedEntitySetIds =
      fun ?nextToken -> fun () -> { trustedEntitySetIds; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("trustedEntitySetIds",
           (Option.map x.trustedEntitySetIds ~f:TrustedEntitySetIds.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let trustedEntitySetIds =
        (Option.map ~f:TrustedEntitySetIds.of_xml)
          (Xml.child xml_arg0 "trustedEntitySetIds") in
      make ?nextToken ?trustedEntitySetIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let trustedEntitySetIds =
        field_map json__ "TrustedEntitySetIds" TrustedEntitySetIds.of_json in
      make ?nextToken ?trustedEntitySetIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the trusted entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the trusted entity sets that are returned as a response, belong to the administrator account."]
module ListTrustedEntitySetsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the GuardDuty detector that is associated with this threat entity set. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let context_ = "ListTrustedEntitySetsRequest"
    let make ?maxResults =
      fun ?nextToken ->
        fun ~detectorId -> fun () -> { maxResults; nextToken; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the trusted entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the trusted entity sets that are returned as a response, belong to the administrator account."]
module ListThreatIntelSetsResponse =
  struct
    type nonrec t =
      {
      threatIntelSetIds: ThreatIntelSetIds.t option
        [@ocaml.doc "The IDs of the ThreatIntelSet resources."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?threatIntelSetIds =
      fun ?nextToken -> fun () -> { threatIntelSetIds; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("threatIntelSetIds",
           (Option.map x.threatIntelSetIds ~f:ThreatIntelSetIds.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let threatIntelSetIds =
        (Option.map ~f:ThreatIntelSetIds.of_xml)
          (Xml.child xml_arg0 "threatIntelSetIds") in
      make ?nextToken ?threatIntelSetIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let threatIntelSetIds =
        field_map json__ "ThreatIntelSetIds" ThreatIntelSetIds.of_json in
      make ?nextToken ?threatIntelSetIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned."]
module ListThreatIntelSetsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with the threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter to paginate results in the response. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let context_ = "ListThreatIntelSetsRequest"
    let make ?maxResults =
      fun ?nextToken ->
        fun ~detectorId -> fun () -> { maxResults; nextToken; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned."]
module ListThreatEntitySetsResponse =
  struct
    type nonrec t =
      {
      threatEntitySetIds: ThreatEntitySetIds.t option
        [@ocaml.doc "The IDs of the threat entity set resources."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?threatEntitySetIds =
      fun ?nextToken -> fun () -> { threatEntitySetIds; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("threatEntitySetIds",
           (Option.map x.threatEntitySetIds ~f:ThreatEntitySetIds.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let threatEntitySetIds =
        (Option.map ~f:ThreatEntitySetIds.of_xml)
          (Xml.child xml_arg0 "threatEntitySetIds") in
      make ?nextToken ?threatEntitySetIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let threatEntitySetIds =
        field_map json__ "ThreatEntitySetIds" ThreatEntitySetIds.of_json in
      make ?nextToken ?threatEntitySetIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account."]
module ListThreatEntitySetsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the GuardDuty detector that is associated with this threat entity set. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let context_ = "ListThreatEntitySetsRequest"
    let make ?maxResults =
      fun ?nextToken ->
        fun ~detectorId -> fun () -> { maxResults; nextToken; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account."]
module ListTagsForResourceResponse =
  struct
    type nonrec t =
      {
      tags: TagMap.t option
        [@ocaml.doc "The tags associated with the resource."]}
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?tags = fun () -> { tags }
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value [("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      make ?tags ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in make ?tags ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, threat intel sets, and publishing destination, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource."]
module ListTagsForResourceRequest =
  struct
    type nonrec t =
      {
      resourceArn: GuardDutyArn.t
        [@ocaml.doc
          "The Amazon Resource Name (ARN) for the given GuardDuty resource."]}
    let context_ = "ListTagsForResourceRequest"
    let make ~resourceArn = fun () -> { resourceArn }
    let to_value x =
      structure_to_value
        [("ResourceArn", (Some (GuardDutyArn.to_value x.resourceArn)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let resourceArn =
        GuardDutyArn.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ResourceArn") in
      make ~resourceArn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let resourceArn =
        field_map_exn json__ "ResourceArn" GuardDutyArn.of_json in
      make ~resourceArn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, threat intel sets, and publishing destination, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource."]
module ListPublishingDestinationsResponse =
  struct
    type nonrec t =
      {
      destinations: Destinations.t option
        [@ocaml.doc
          "A Destinations object that includes information about each publishing destination returned."];
      nextToken: String_.t option
        [@ocaml.doc
          "A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?destinations =
      fun ?nextToken -> fun () -> { destinations; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("destinations",
           (Option.map x.destinations ~f:Destinations.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let destinations =
        (Option.map ~f:Destinations.of_xml)
          (Xml.child xml_arg0 "destinations") in
      make ?nextToken ?destinations ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let destinations = field_map json__ "Destinations" Destinations.of_json in
      make ?nextToken ?destinations ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns a list of publishing destinations associated with the specified detectorId."]
module ListPublishingDestinationsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The detector ID for which you want to retrieve the publishing destination. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "The maximum number of results to return in the response."];
      nextToken: String_.t option
        [@ocaml.doc
          "A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page."]}
    let context_ = "ListPublishingDestinationsRequest"
    let make ?maxResults =
      fun ?nextToken ->
        fun ~detectorId -> fun () -> { maxResults; nextToken; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns a list of publishing destinations associated with the specified detectorId."]
module ListOrganizationAdminAccountsResponse =
  struct
    type nonrec t =
      {
      adminAccounts: AdminAccounts.t option
        [@ocaml.doc
          "A list of accounts configured as GuardDuty delegated administrators."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?adminAccounts =
      fun ?nextToken -> fun () -> { adminAccounts; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("adminAccounts",
           (Option.map x.adminAccounts ~f:AdminAccounts.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let adminAccounts =
        (Option.map ~f:AdminAccounts.of_xml)
          (Xml.child xml_arg0 "adminAccounts") in
      make ?nextToken ?adminAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let adminAccounts =
        field_map json__ "AdminAccounts" AdminAccounts.of_json in
      make ?nextToken ?adminAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the accounts designated as GuardDuty delegated administrators. Only the organization's management account can run this API operation."]
module ListOrganizationAdminAccountsRequest =
  struct
    type nonrec t =
      {
      maxResults: MaxResults.t option
        [@ocaml.doc
          "The maximum number of results to return in the response."];
      nextToken: String_.t option
        [@ocaml.doc
          "A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page."]}
    let make ?maxResults =
      fun ?nextToken -> fun () -> { maxResults; nextToken }
    let to_value x =
      structure_to_value
        [("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      make ?nextToken ?maxResults ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      make ?nextToken ?maxResults ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the accounts designated as GuardDuty delegated administrators. Only the organization's management account can run this API operation."]
module ListMembersResponse =
  struct
    type nonrec t =
      {
      members: Members.t option
        [@ocaml.doc
          "A list of members. The values for email and invitedAt are available only if the member accounts are added by invitation."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?members = fun ?nextToken -> fun () -> { members; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("members", (Option.map x.members ~f:Members.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let members =
        (Option.map ~f:Members.of_xml) (Xml.child xml_arg0 "members") in
      make ?nextToken ?members ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let members = field_map json__ "Members" Members.of_json in
      make ?nextToken ?members ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists details about all member accounts for the current GuardDuty administrator account."]
module ListMembersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with the member. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."];
      onlyAssociated: String_.t option
        [@ocaml.doc
          "Specifies whether to only return associated members or to return all members (including members who haven't been invited yet or have been disassociated). Member accounts must have been previously associated with the GuardDuty administrator account using Create Members ."]}
    let context_ = "ListMembersRequest"
    let make ?maxResults =
      fun ?nextToken ->
        fun ?onlyAssociated ->
          fun ~detectorId ->
            fun () -> { maxResults; nextToken; onlyAssociated; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value));
        ("onlyAssociated", (Option.map x.onlyAssociated ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let onlyAssociated =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "onlyAssociated") in
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?onlyAssociated ?nextToken ?maxResults ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let onlyAssociated = field_map json__ "OnlyAssociated" String_.of_json in
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?onlyAssociated ?nextToken ?maxResults ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists details about all member accounts for the current GuardDuty administrator account."]
module ListMalwareScansResponse =
  struct
    type nonrec t =
      {
      scans: MalwareScans.t option
        [@ocaml.doc
          "The list of malware scans associated with the provided input parameters."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more scans."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?scans = fun ?nextToken -> fun () -> { scans; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("scans", (Option.map x.scans ~f:MalwareScans.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let scans =
        (Option.map ~f:MalwareScans.of_xml) (Xml.child xml_arg0 "scans") in
      make ?nextToken ?scans ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let scans = field_map json__ "Scans" MalwareScans.of_json in
      make ?nextToken ?scans ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts."]
module ListMalwareScansRequest =
  struct
    type nonrec t =
      {
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing results."];
      filterCriteria: ListMalwareScansFilterCriteria.t option
        [@ocaml.doc
          "Represents the criteria used to filter the malware scan entries."];
      sortCriteria: SortCriteria.t option
        [@ocaml.doc
          "Represents the criteria used for sorting malware scan entries."]}
    let make ?maxResults =
      fun ?nextToken ->
        fun ?filterCriteria ->
          fun ?sortCriteria ->
            fun () -> { maxResults; nextToken; filterCriteria; sortCriteria }
    let to_value x =
      structure_to_value
        [("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value));
        ("filterCriteria",
          (Option.map x.filterCriteria
             ~f:ListMalwareScansFilterCriteria.to_value));
        ("sortCriteria",
          (Option.map x.sortCriteria ~f:SortCriteria.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let sortCriteria =
        (Option.map ~f:SortCriteria.of_xml)
          (Xml.child xml_arg0 "sortCriteria") in
      let filterCriteria =
        (Option.map ~f:ListMalwareScansFilterCriteria.of_xml)
          (Xml.child xml_arg0 "filterCriteria") in
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      make ?sortCriteria ?filterCriteria ?nextToken ?maxResults ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let sortCriteria = field_map json__ "SortCriteria" SortCriteria.of_json in
      let filterCriteria =
        field_map json__ "FilterCriteria"
          ListMalwareScansFilterCriteria.of_json in
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      make ?sortCriteria ?filterCriteria ?nextToken ?maxResults ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts."]
module ListMalwareProtectionPlansResponse =
  struct
    type nonrec t =
      {
      malwareProtectionPlans: MalwareProtectionPlansSummary.t option
        [@ocaml.doc
          "A list of unique identifiers associated with each Malware Protection plan."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?malwareProtectionPlans =
      fun ?nextToken -> fun () -> { malwareProtectionPlans; nextToken }
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("malwareProtectionPlans",
           (Option.map x.malwareProtectionPlans
              ~f:MalwareProtectionPlansSummary.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let malwareProtectionPlans =
        (Option.map ~f:MalwareProtectionPlansSummary.of_xml)
          (Xml.child xml_arg0 "malwareProtectionPlans") in
      make ?nextToken ?malwareProtectionPlans ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let malwareProtectionPlans =
        field_map json__ "MalwareProtectionPlans"
          MalwareProtectionPlansSummary.of_json in
      make ?nextToken ?malwareProtectionPlans ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the Malware Protection plan IDs associated with the protected resources in your Amazon Web Services account."]
module ListMalwareProtectionPlansRequest =
  struct
    type nonrec t =
      {
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data. The default page size is 100 plans."]}
    let make ?nextToken = fun () -> { nextToken }
    let to_value x =
      structure_to_value
        [("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      make ?nextToken ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      make ?nextToken ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the Malware Protection plan IDs associated with the protected resources in your Amazon Web Services account."]
module ListInvitationsResponse =
  struct
    type nonrec t =
      {
      invitations: Invitations.t option
        [@ocaml.doc "A list of invitation descriptions."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?invitations =
      fun ?nextToken -> fun () -> { invitations; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("invitations", (Option.map x.invitations ~f:Invitations.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let invitations =
        (Option.map ~f:Invitations.of_xml) (Xml.child xml_arg0 "invitations") in
      make ?nextToken ?invitations ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let invitations = field_map json__ "Invitations" Invitations.of_json in
      make ?nextToken ?invitations ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists all GuardDuty membership invitations that were sent to the current Amazon Web Services account."]
module ListInvitationsRequest =
  struct
    type nonrec t =
      {
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let make ?maxResults =
      fun ?nextToken -> fun () -> { maxResults; nextToken }
    let to_value x =
      structure_to_value
        [("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      make ?nextToken ?maxResults ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      make ?nextToken ?maxResults ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists all GuardDuty membership invitations that were sent to the current Amazon Web Services account."]
module ListIPSetsResponse =
  struct
    type nonrec t =
      {
      ipSetIds: IpSetIds.t option
        [@ocaml.doc "The IDs of the IPSet resources."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?ipSetIds = fun ?nextToken -> fun () -> { ipSetIds; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("ipSetIds", (Option.map x.ipSetIds ~f:IpSetIds.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let ipSetIds =
        (Option.map ~f:IpSetIds.of_xml) (Xml.child xml_arg0 "ipSetIds") in
      make ?nextToken ?ipSetIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let ipSetIds = field_map json__ "IpSetIds" IpSetIds.of_json in
      make ?nextToken ?ipSetIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account."]
module ListIPSetsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let context_ = "ListIPSetsRequest"
    let make ?maxResults =
      fun ?nextToken ->
        fun ~detectorId -> fun () -> { maxResults; nextToken; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account."]
module ListFindingsResponse =
  struct
    type nonrec t =
      {
      findingIds: FindingIds.t option
        [@ocaml.doc "The IDs of the findings that you're listing."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?findingIds =
      fun ?nextToken -> fun () -> { findingIds; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("findingIds", (Option.map x.findingIds ~f:FindingIds.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let findingIds =
        (Option.map ~f:FindingIds.of_xml) (Xml.child xml_arg0 "findingIds") in
      make ?nextToken ?findingIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let findingIds = field_map json__ "FindingIds" FindingIds.of_json in
      make ?nextToken ?findingIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists GuardDuty findings for the specified detector ID. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints."]
module ListFindingsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector that specifies the GuardDuty service whose findings you want to list. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      findingCriteria: FindingCriteria.t option
        [@ocaml.doc
          "Represents the criteria used for querying findings. Valid values include: JSON field name accountId region confidence id resource.accessKeyDetails.accessKeyId resource.accessKeyDetails.principalId resource.accessKeyDetails.userName resource.accessKeyDetails.userType resource.instanceDetails.iamInstanceProfile.id resource.instanceDetails.imageId resource.instanceDetails.instanceId resource.instanceDetails.networkInterfaces.ipv6Addresses resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress resource.instanceDetails.networkInterfaces.publicDnsName resource.instanceDetails.networkInterfaces.publicIp resource.instanceDetails.networkInterfaces.securityGroups.groupId resource.instanceDetails.networkInterfaces.securityGroups.groupName resource.instanceDetails.networkInterfaces.subnetId resource.instanceDetails.networkInterfaces.vpcId resource.instanceDetails.tags.key resource.instanceDetails.tags.value resource.resourceType service.action.actionType service.action.awsApiCallAction.api service.action.awsApiCallAction.callerType service.action.awsApiCallAction.remoteIpDetails.city.cityName service.action.awsApiCallAction.remoteIpDetails.country.countryName service.action.awsApiCallAction.remoteIpDetails.ipAddressV4 service.action.awsApiCallAction.remoteIpDetails.organization.asn service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg service.action.awsApiCallAction.serviceName service.action.dnsRequestAction.domain service.action.dnsRequestAction.domainWithSuffix service.action.networkConnectionAction.blocked service.action.networkConnectionAction.connectionDirection service.action.networkConnectionAction.localPortDetails.port service.action.networkConnectionAction.protocol service.action.networkConnectionAction.remoteIpDetails.country.countryName service.action.networkConnectionAction.remoteIpDetails.ipAddressV4 service.action.networkConnectionAction.remoteIpDetails.organization.asn service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg service.action.networkConnectionAction.remotePortDetails.port service.additionalInfo.threatListName service.archived When this attribute is set to 'true', only archived findings are listed. When it's set to 'false', only unarchived findings are listed. When this attribute is not set, all existing findings are listed. service.ebsVolumeScanDetails.scanId service.resourceRole severity type updatedAt Type: Timestamp in Unix Epoch millisecond format: 1486685375000"];
      sortCriteria: SortCriteria.t option
        [@ocaml.doc "Represents the criteria used for sorting findings."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let context_ = "ListFindingsRequest"
    let make ?findingCriteria =
      fun ?sortCriteria ->
        fun ?maxResults ->
          fun ?nextToken ->
            fun ~detectorId ->
              fun () ->
                {
                  findingCriteria;
                  sortCriteria;
                  maxResults;
                  nextToken;
                  detectorId
                }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("findingCriteria",
          (Option.map x.findingCriteria ~f:FindingCriteria.to_value));
        ("sortCriteria",
          (Option.map x.sortCriteria ~f:SortCriteria.to_value));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let sortCriteria =
        (Option.map ~f:SortCriteria.of_xml)
          (Xml.child xml_arg0 "sortCriteria") in
      let findingCriteria =
        (Option.map ~f:FindingCriteria.of_xml)
          (Xml.child xml_arg0 "findingCriteria") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ?sortCriteria ?findingCriteria ~detectorId
        ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let sortCriteria = field_map json__ "SortCriteria" SortCriteria.of_json in
      let findingCriteria =
        field_map json__ "FindingCriteria" FindingCriteria.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ?sortCriteria ?findingCriteria ~detectorId
        ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists GuardDuty findings for the specified detector ID. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints."]
module ListFiltersResponse =
  struct
    type nonrec t =
      {
      filterNames: FilterNames.t option
        [@ocaml.doc "A list of filter names."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?filterNames =
      fun ?nextToken -> fun () -> { filterNames; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("filterNames", (Option.map x.filterNames ~f:FilterNames.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let filterNames =
        (Option.map ~f:FilterNames.of_xml) (Xml.child xml_arg0 "filterNames") in
      make ?nextToken ?filterNames ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let filterNames = field_map json__ "FilterNames" FilterNames.of_json in
      make ?nextToken ?filterNames ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Returns a paginated list of the current filters."]
module ListFiltersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with the filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let context_ = "ListFiltersRequest"
    let make ?maxResults =
      fun ?nextToken ->
        fun ~detectorId -> fun () -> { maxResults; nextToken; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Returns a paginated list of the current filters."]
module ListDetectorsResponse =
  struct
    type nonrec t =
      {
      detectorIds: DetectorIds.t option
        [@ocaml.doc "A list of detector IDs."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?detectorIds =
      fun ?nextToken -> fun () -> { detectorIds; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("detectorIds", (Option.map x.detectorIds ~f:DetectorIds.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let detectorIds =
        (Option.map ~f:DetectorIds.of_xml) (Xml.child xml_arg0 "detectorIds") in
      make ?nextToken ?detectorIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let detectorIds = field_map json__ "DetectorIds" DetectorIds.of_json in
      make ?nextToken ?detectorIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists detectorIds of all the existing Amazon GuardDuty detector resources."]
module ListDetectorsRequest =
  struct
    type nonrec t =
      {
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let make ?maxResults =
      fun ?nextToken -> fun () -> { maxResults; nextToken }
    let to_value x =
      structure_to_value
        [("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      make ?nextToken ?maxResults ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      make ?nextToken ?maxResults ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists detectorIds of all the existing Amazon GuardDuty detector resources."]
module ListCoverageResponse =
  struct
    type nonrec t =
      {
      resources: CoverageResources.t option
        [@ocaml.doc
          "A list of resources and their attributes providing cluster details."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?resources =
      fun ?nextToken -> fun () -> { resources; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("resources",
           (Option.map x.resources ~f:CoverageResources.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let resources =
        (Option.map ~f:CoverageResources.of_xml)
          (Xml.child xml_arg0 "resources") in
      make ?nextToken ?resources ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let resources = field_map json__ "Resources" CoverageResources.of_json in
      make ?nextToken ?resources ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization. Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources."]
module ListCoverageRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector whose coverage details you want to retrieve. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      nextToken: String_.t option
        [@ocaml.doc
          "A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "The maximum number of results to return in the response."];
      filterCriteria: CoverageFilterCriteria.t option
        [@ocaml.doc
          "Represents the criteria used to filter the coverage details."];
      sortCriteria: CoverageSortCriteria.t option
        [@ocaml.doc
          "Represents the criteria used to sort the coverage details."]}
    let context_ = "ListCoverageRequest"
    let make ?nextToken =
      fun ?maxResults ->
        fun ?filterCriteria ->
          fun ?sortCriteria ->
            fun ~detectorId ->
              fun () ->
                {
                  nextToken;
                  maxResults;
                  filterCriteria;
                  sortCriteria;
                  detectorId
                }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("filterCriteria",
          (Option.map x.filterCriteria ~f:CoverageFilterCriteria.to_value));
        ("sortCriteria",
          (Option.map x.sortCriteria ~f:CoverageSortCriteria.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let sortCriteria =
        (Option.map ~f:CoverageSortCriteria.of_xml)
          (Xml.child xml_arg0 "sortCriteria") in
      let filterCriteria =
        (Option.map ~f:CoverageFilterCriteria.of_xml)
          (Xml.child xml_arg0 "filterCriteria") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?sortCriteria ?filterCriteria ?maxResults ?nextToken ~detectorId
        ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let sortCriteria =
        field_map json__ "SortCriteria" CoverageSortCriteria.of_json in
      let filterCriteria =
        field_map json__ "FilterCriteria" CoverageFilterCriteria.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?sortCriteria ?filterCriteria ?maxResults ?nextToken ~detectorId
        ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization. Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources."]
module InviteMembersResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of objects that contain the unprocessed account and a result string that explains why it was unprocessed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations. To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation. After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API."]
module InviteMembersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account with which you want to invite members. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account IDs of the accounts that you want to invite to GuardDuty as members."];
      disableEmailNotification: Boolean.t option
        [@ocaml.doc
          "A Boolean value that specifies whether you want to disable email notification to the accounts that you are inviting to GuardDuty as members."];
      message: String_.t option
        [@ocaml.doc
          "The invitation message that you want to send to the accounts that you're inviting to GuardDuty as members."]}
    let context_ = "InviteMembersRequest"
    let make ?disableEmailNotification =
      fun ?message ->
        fun ~detectorId ->
          fun ~accountIds ->
            fun () ->
              { disableEmailNotification; message; detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)));
        ("disableEmailNotification",
          (Option.map x.disableEmailNotification ~f:Boolean.to_value));
        ("message", (Option.map x.message ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let message =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "message") in
      let disableEmailNotification =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "disableEmailNotification") in
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?message ?disableEmailNotification ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let message = field_map json__ "Message" String_.of_json in
      let disableEmailNotification =
        field_map json__ "DisableEmailNotification" Boolean.of_json in
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?message ?disableEmailNotification ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations. To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation. After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API."]
module GetUsageStatisticsResponse =
  struct
    type nonrec t =
      {
      usageStatistics: UsageStatistics.t option
        [@ocaml.doc
          "The usage statistics object. If a UsageStatisticType was provided, the objects representing other types will be null."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?usageStatistics =
      fun ?nextToken -> fun () -> { usageStatistics; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("usageStatistics",
           (Option.map x.usageStatistics ~f:UsageStatistics.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let usageStatistics =
        (Option.map ~f:UsageStatistics.of_xml)
          (Xml.child xml_arg0 "usageStatistics") in
      make ?nextToken ?usageStatistics ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let usageStatistics =
        field_map json__ "UsageStatistics" UsageStatistics.of_json in
      make ?nextToken ?usageStatistics ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated."]
module GetUsageStatisticsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector that specifies the GuardDuty service whose usage statistics you want to retrieve. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      usageStatisticType: UsageStatisticType.t
        [@ocaml.doc "The type of usage statistics to retrieve."];
      usageCriteria: UsageCriteria.t
        [@ocaml.doc "Represents the criteria used for querying usage."];
      unit: String_.t option
        [@ocaml.doc
          "The currency unit you would like to view your usage statistics in. Current valid values are USD."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "The maximum number of results to return in the response."];
      nextToken: String_.t option
        [@ocaml.doc
          "A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page."]}
    let context_ = "GetUsageStatisticsRequest"
    let make ?unit =
      fun ?maxResults ->
        fun ?nextToken ->
          fun ~detectorId ->
            fun ~usageStatisticType ->
              fun ~usageCriteria ->
                fun () ->
                  {
                    unit;
                    maxResults;
                    nextToken;
                    detectorId;
                    usageStatisticType;
                    usageCriteria
                  }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("usageStatisticsType",
          (Some (UsageStatisticType.to_value x.usageStatisticType)));
        ("usageCriteria", (Some (UsageCriteria.to_value x.usageCriteria)));
        ("unit", (Option.map x.unit ~f:String_.to_value));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let unit = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "unit") in
      let usageCriteria =
        UsageCriteria.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "usageCriteria") in
      let usageStatisticType =
        UsageStatisticType.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "usageStatisticsType") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ?unit ~usageCriteria ~usageStatisticType
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let unit = field_map json__ "Unit" String_.of_json in
      let usageCriteria =
        field_map_exn json__ "UsageCriteria" UsageCriteria.of_json in
      let usageStatisticType =
        field_map_exn json__ "UsageStatisticType" UsageStatisticType.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ?unit ~usageCriteria ~usageStatisticType
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated."]
module GetTrustedEntitySetResponse =
  struct
    type nonrec t =
      {
      name: Name.t option
        [@ocaml.doc
          "The name of the threat entity set associated with the specified trustedEntitySetId."];
      format: TrustedEntitySetFormat.t option
        [@ocaml.doc
          "The format of the file that contains the trusted entity set."];
      location: Location.t option
        [@ocaml.doc
          "The URI of the file that contains the trusted entity set."];
      expectedBucketOwner: ExpectedBucketOwner.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."];
      status: TrustedEntitySetStatus.t option
        [@ocaml.doc "The status of the associated trusted entity set."];
      tags: TagMap.t option
        [@ocaml.doc "The tags associated with trusted entity set resource."];
      createdAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the associated trusted entity set was created."];
      updatedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the associated trusted entity set was updated."];
      errorDetails: String_.t option
        [@ocaml.doc "The error details when the status is shown as ERROR."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?name =
      fun ?format ->
        fun ?location ->
          fun ?expectedBucketOwner ->
            fun ?status ->
              fun ?tags ->
                fun ?createdAt ->
                  fun ?updatedAt ->
                    fun ?errorDetails ->
                      fun () ->
                        {
                          name;
                          format;
                          location;
                          expectedBucketOwner;
                          status;
                          tags;
                          createdAt;
                          updatedAt;
                          errorDetails
                        }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:Name.to_value));
        ("format", (Option.map x.format ~f:TrustedEntitySetFormat.to_value));
        ("location", (Option.map x.location ~f:Location.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:ExpectedBucketOwner.to_value));
        ("status", (Option.map x.status ~f:TrustedEntitySetStatus.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value));
        ("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value));
        ("errorDetails", (Option.map x.errorDetails ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let errorDetails =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "errorDetails") in
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let status =
        (Option.map ~f:TrustedEntitySetStatus.of_xml)
          (Xml.child xml_arg0 "status") in
      let expectedBucketOwner =
        (Option.map ~f:ExpectedBucketOwner.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let location =
        (Option.map ~f:Location.of_xml) (Xml.child xml_arg0 "location") in
      let format =
        (Option.map ~f:TrustedEntitySetFormat.of_xml)
          (Xml.child xml_arg0 "format") in
      let name = (Option.map ~f:Name.of_xml) (Xml.child xml_arg0 "name") in
      make ?errorDetails ?updatedAt ?createdAt ?tags ?status
        ?expectedBucketOwner ?location ?format ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let errorDetails = field_map json__ "ErrorDetails" String_.of_json in
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      let tags = field_map json__ "Tags" TagMap.of_json in
      let status = field_map json__ "Status" TrustedEntitySetStatus.of_json in
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" ExpectedBucketOwner.of_json in
      let location = field_map json__ "Location" Location.of_json in
      let format = field_map json__ "Format" TrustedEntitySetFormat.of_json in
      let name = field_map json__ "Name" Name.of_json in
      make ?errorDetails ?updatedAt ?createdAt ?tags ?status
        ?expectedBucketOwner ?location ?format ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the trusted entity set associated with the specified trustedEntitySetId."]
module GetTrustedEntitySetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the GuardDuty detector associated with this trusted entity set."];
      trustedEntitySetId: String_.t
        [@ocaml.doc
          "The unique ID that helps GuardDuty identify the trusted entity set."]}
    let context_ = "GetTrustedEntitySetRequest"
    let make ~detectorId =
      fun ~trustedEntitySetId -> fun () -> { detectorId; trustedEntitySetId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("TrustedEntitySetId",
          (Some (String_.to_value x.trustedEntitySetId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let trustedEntitySetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "TrustedEntitySetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~trustedEntitySetId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let trustedEntitySetId =
        field_map_exn json__ "TrustedEntitySetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~trustedEntitySetId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the trusted entity set associated with the specified trustedEntitySetId."]
module GetThreatIntelSetResponse =
  struct
    type nonrec t =
      {
      name: Name.t option
        [@ocaml.doc
          "A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet."];
      format: ThreatIntelSetFormat.t option
        [@ocaml.doc "The format of the threatIntelSet."];
      location: Location.t option
        [@ocaml.doc "The URI of the file that contains the ThreatIntelSet."];
      status: ThreatIntelSetStatus.t option
        [@ocaml.doc "The status of threatIntelSet file uploaded."];
      tags: TagMap.t option
        [@ocaml.doc "The tags of the threat list resource."];
      expectedBucketOwner: AccountId.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter. This field appears in the response only if it was provided during ThreatIntelSet creation or update."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?name =
      fun ?format ->
        fun ?location ->
          fun ?status ->
            fun ?tags ->
              fun ?expectedBucketOwner ->
                fun () ->
                  { name; format; location; status; tags; expectedBucketOwner
                  }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:Name.to_value));
        ("format", (Option.map x.format ~f:ThreatIntelSetFormat.to_value));
        ("location", (Option.map x.location ~f:Location.to_value));
        ("status", (Option.map x.status ~f:ThreatIntelSetStatus.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:AccountId.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let expectedBucketOwner =
        (Option.map ~f:AccountId.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let status =
        (Option.map ~f:ThreatIntelSetStatus.of_xml)
          (Xml.child xml_arg0 "status") in
      let location =
        (Option.map ~f:Location.of_xml) (Xml.child xml_arg0 "location") in
      let format =
        (Option.map ~f:ThreatIntelSetFormat.of_xml)
          (Xml.child xml_arg0 "format") in
      let name = (Option.map ~f:Name.of_xml) (Xml.child xml_arg0 "name") in
      make ?expectedBucketOwner ?tags ?status ?location ?format ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" AccountId.of_json in
      let tags = field_map json__ "Tags" TagMap.of_json in
      let status = field_map json__ "Status" ThreatIntelSetStatus.of_json in
      let location = field_map json__ "Location" Location.of_json in
      let format = field_map json__ "Format" ThreatIntelSetFormat.of_json in
      let name = field_map json__ "Name" Name.of_json in
      make ?expectedBucketOwner ?tags ?status ?location ?format ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID."]
module GetThreatIntelSetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with the threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      threatIntelSetId: String_.t
        [@ocaml.doc
          "The unique ID of the threatIntelSet that you want to get."]}
    let context_ = "GetThreatIntelSetRequest"
    let make ~detectorId =
      fun ~threatIntelSetId -> fun () -> { detectorId; threatIntelSetId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("ThreatIntelSetId", (Some (String_.to_value x.threatIntelSetId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatIntelSetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ThreatIntelSetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~threatIntelSetId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatIntelSetId =
        field_map_exn json__ "ThreatIntelSetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~threatIntelSetId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID."]
module GetThreatEntitySetResponse =
  struct
    type nonrec t =
      {
      name: Name.t option
        [@ocaml.doc
          "The name of the threat entity set associated with the specified threatEntitySetId."];
      format: ThreatEntitySetFormat.t option
        [@ocaml.doc
          "The format of the file that contains the threat entity set."];
      location: Location.t option
        [@ocaml.doc
          "The URI of the file that contains the threat entity set."];
      expectedBucketOwner: ExpectedBucketOwner.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."];
      status: ThreatEntitySetStatus.t option
        [@ocaml.doc "The status of the associated threat entity set."];
      tags: TagMap.t option
        [@ocaml.doc
          "The tags associated with the threat entity set resource."];
      createdAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the associated threat entity set was created."];
      updatedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the associated threat entity set was updated."];
      errorDetails: String_.t option
        [@ocaml.doc "The error details when the status is shown as ERROR."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?name =
      fun ?format ->
        fun ?location ->
          fun ?expectedBucketOwner ->
            fun ?status ->
              fun ?tags ->
                fun ?createdAt ->
                  fun ?updatedAt ->
                    fun ?errorDetails ->
                      fun () ->
                        {
                          name;
                          format;
                          location;
                          expectedBucketOwner;
                          status;
                          tags;
                          createdAt;
                          updatedAt;
                          errorDetails
                        }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:Name.to_value));
        ("format", (Option.map x.format ~f:ThreatEntitySetFormat.to_value));
        ("location", (Option.map x.location ~f:Location.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:ExpectedBucketOwner.to_value));
        ("status", (Option.map x.status ~f:ThreatEntitySetStatus.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value));
        ("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:Timestamp.to_value));
        ("errorDetails", (Option.map x.errorDetails ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let errorDetails =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "errorDetails") in
      let updatedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let status =
        (Option.map ~f:ThreatEntitySetStatus.of_xml)
          (Xml.child xml_arg0 "status") in
      let expectedBucketOwner =
        (Option.map ~f:ExpectedBucketOwner.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let location =
        (Option.map ~f:Location.of_xml) (Xml.child xml_arg0 "location") in
      let format =
        (Option.map ~f:ThreatEntitySetFormat.of_xml)
          (Xml.child xml_arg0 "format") in
      let name = (Option.map ~f:Name.of_xml) (Xml.child xml_arg0 "name") in
      make ?errorDetails ?updatedAt ?createdAt ?tags ?status
        ?expectedBucketOwner ?location ?format ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let errorDetails = field_map json__ "ErrorDetails" String_.of_json in
      let updatedAt = field_map json__ "UpdatedAt" Timestamp.of_json in
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      let tags = field_map json__ "Tags" TagMap.of_json in
      let status = field_map json__ "Status" ThreatEntitySetStatus.of_json in
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" ExpectedBucketOwner.of_json in
      let location = field_map json__ "Location" Location.of_json in
      let format = field_map json__ "Format" ThreatEntitySetFormat.of_json in
      let name = field_map json__ "Name" Name.of_json in
      make ?errorDetails ?updatedAt ?createdAt ?tags ?status
        ?expectedBucketOwner ?location ?format ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the threat entity set associated with the specified threatEntitySetId."]
module GetThreatEntitySetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector associated with the threat entity set resource. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      threatEntitySetId: String_.t
        [@ocaml.doc
          "The unique ID that helps GuardDuty identify the threat entity set."]}
    let context_ = "GetThreatEntitySetRequest"
    let make ~detectorId =
      fun ~threatEntitySetId -> fun () -> { detectorId; threatEntitySetId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("ThreatEntitySetId", (Some (String_.to_value x.threatEntitySetId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatEntitySetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ThreatEntitySetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~threatEntitySetId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatEntitySetId =
        field_map_exn json__ "ThreatEntitySetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~threatEntitySetId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the threat entity set associated with the specified threatEntitySetId."]
module GetRemainingFreeTrialDaysResponse =
  struct
    type nonrec t =
      {
      accounts: AccountFreeTrialInfos.t option
        [@ocaml.doc
          "The member accounts which were included in a request and were processed successfully."];
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "The member account that was included in a request but for which the request could not be processed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?accounts =
      fun ?unprocessedAccounts -> fun () -> { accounts; unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("accounts",
           (Option.map x.accounts ~f:AccountFreeTrialInfos.to_value));
        ("unprocessedAccounts",
          (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      let accounts =
        (Option.map ~f:AccountFreeTrialInfos.of_xml)
          (Xml.child xml_arg0 "accounts") in
      make ?unprocessedAccounts ?accounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      let accounts =
        field_map json__ "Accounts" AccountFreeTrialInfos.of_json in
      make ?unprocessedAccounts ?accounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides the number of days left for each data source used in the free trial period."]
module GetRemainingFreeTrialDaysRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty member account. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account identifiers of the GuardDuty member account."]}
    let context_ = "GetRemainingFreeTrialDaysRequest"
    let make ~detectorId =
      fun ~accountIds -> fun () -> { detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides the number of days left for each data source used in the free trial period."]
module GetOrganizationStatisticsResponse =
  struct
    type nonrec t =
      {
      organizationDetails: OrganizationDetails.t option
        [@ocaml.doc
          "Information about the statistics report for your organization."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?organizationDetails = fun () -> { organizationDetails }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("organizationDetails",
           (Option.map x.organizationDetails ~f:OrganizationDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let organizationDetails =
        (Option.map ~f:OrganizationDetails.of_xml)
          (Xml.child xml_arg0 "organizationDetails") in
      make ?organizationDetails ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let organizationDetails =
        field_map json__ "OrganizationDetails" OrganizationDetails.of_json in
      make ?organizationDetails ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves how many active member accounts have each feature enabled within GuardDuty. Only a delegated GuardDuty administrator of an organization can run this API. When you create a new organization, it might take up to 24 hours to generate the statistics for the entire organization."]
module GetMembersResponse =
  struct
    type nonrec t =
      {
      members: Members.t option [@ocaml.doc "A list of members."];
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of objects that contain the unprocessed account and a result string that explains why it was unprocessed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?members =
      fun ?unprocessedAccounts -> fun () -> { members; unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("members", (Option.map x.members ~f:Members.to_value));
        ("unprocessedAccounts",
          (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      let members =
        (Option.map ~f:Members.of_xml) (Xml.child xml_arg0 "members") in
      make ?unprocessedAccounts ?members ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      let members = field_map json__ "Members" Members.of_json in
      make ?unprocessedAccounts ?members ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs."]
module GetMembersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account whose members you want to retrieve. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account IDs of the GuardDuty member accounts that you want to describe."]}
    let context_ = "GetMembersRequest"
    let make ~detectorId =
      fun ~accountIds -> fun () -> { detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs."]
module GetMemberDetectorsResponse =
  struct
    type nonrec t =
      {
      memberDataSourceConfigurations: MemberDataSourceConfigurations.t option
        [@ocaml.doc
          "An object that describes which data sources are enabled for a member account."];
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of member account IDs that were unable to be processed along with an explanation for why they were not processed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?memberDataSourceConfigurations =
      fun ?unprocessedAccounts ->
        fun () -> { memberDataSourceConfigurations; unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("members",
           (Option.map x.memberDataSourceConfigurations
              ~f:MemberDataSourceConfigurations.to_value));
        ("unprocessedAccounts",
          (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      let memberDataSourceConfigurations =
        (Option.map ~f:MemberDataSourceConfigurations.of_xml)
          (Xml.child xml_arg0 "members") in
      make ?unprocessedAccounts ?memberDataSourceConfigurations ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      let memberDataSourceConfigurations =
        field_map json__ "MemberDataSourceConfigurations"
          MemberDataSourceConfigurations.of_json in
      make ?unprocessedAccounts ?memberDataSourceConfigurations ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module GetMemberDetectorsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The detector ID for the administrator account. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountIds: AccountIds.t [@ocaml.doc "A list of member account IDs."]}
    let context_ = "GetMemberDetectorsRequest"
    let make ~detectorId =
      fun ~accountIds -> fun () -> { detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module GetMasterAccountResponse =
  struct
    type nonrec t =
      {
      master: Master.t option
        [@ocaml.doc "The administrator account details."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?master = fun () -> { master }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("master", (Option.map x.master ~f:Master.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let master =
        (Option.map ~f:Master.of_xml) (Xml.child xml_arg0 "master") in
      make ?master ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let master = field_map json__ "Master" Master.of_json in
      make ?master ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account."]
module GetMasterAccountRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty member account. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."]}
    let context_ = "GetMasterAccountRequest"
    let make ~detectorId = fun () -> { detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account."]
module GetMalwareScanSettingsResponse =
  struct
    type nonrec t =
      {
      scanResourceCriteria: ScanResourceCriteria.t option
        [@ocaml.doc
          "Represents the criteria to be used in the filter for scanning resources."];
      ebsSnapshotPreservation: EbsSnapshotPreservation.t option
        [@ocaml.doc
          "An enum value representing possible snapshot preservation settings."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?scanResourceCriteria =
      fun ?ebsSnapshotPreservation ->
        fun () -> { scanResourceCriteria; ebsSnapshotPreservation }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("scanResourceCriteria",
           (Option.map x.scanResourceCriteria
              ~f:ScanResourceCriteria.to_value));
        ("ebsSnapshotPreservation",
          (Option.map x.ebsSnapshotPreservation
             ~f:EbsSnapshotPreservation.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ebsSnapshotPreservation =
        (Option.map ~f:EbsSnapshotPreservation.of_xml)
          (Xml.child xml_arg0 "ebsSnapshotPreservation") in
      let scanResourceCriteria =
        (Option.map ~f:ScanResourceCriteria.of_xml)
          (Xml.child xml_arg0 "scanResourceCriteria") in
      make ?ebsSnapshotPreservation ?scanResourceCriteria ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ebsSnapshotPreservation =
        field_map json__ "EbsSnapshotPreservation"
          EbsSnapshotPreservation.of_json in
      let scanResourceCriteria =
        field_map json__ "ScanResourceCriteria" ScanResourceCriteria.of_json in
      make ?ebsSnapshotPreservation ?scanResourceCriteria ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns the details of the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module GetMalwareScanSettingsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with this scan. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."]}
    let context_ = "GetMalwareScanSettingsRequest"
    let make ~detectorId = fun () -> { detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns the details of the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module GetMalwareScanResponse =
  struct
    type nonrec t =
      {
      scanId: NonEmptyString.t option
        [@ocaml.doc
          "A unique identifier associated with the malware scan. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan."];
      detectorId: DetectorId.t option
        [@ocaml.doc
          "The unique ID of the detector that is associated with the request, if it belongs to an account which is a GuardDuty customer. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      adminDetectorId: DetectorId.t option
        [@ocaml.doc
          "The unique detector ID of the administrator account that the request is associated with. If the account is an administrator, the AdminDetectorId will be the same as the one used for DetectorId. If the customer is not a GuardDuty customer, this field will not be present.. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      resourceArn: NonEmptyString.t option
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the resource on which a malware scan was invoked."];
      resourceType: MalwareProtectionResourceType.t option
        [@ocaml.doc "The type of resource that was scanned for malware."];
      scannedResourcesCount: NonNegativeInteger.t option
        [@ocaml.doc
          "The total number of resources that were successfully scanned. This is dependent on the resource type."];
      skippedResourcesCount: NonNegativeInteger.t option
        [@ocaml.doc
          "The total number of resources that were skipped during the scan."];
      failedResourcesCount: NonNegativeInteger.t option
        [@ocaml.doc
          "The total number of resources that failed to be scanned."];
      scannedResources: ScannedResources.t option
        [@ocaml.doc
          "A list of resources along with their metadata that were scanned as part of the malware scan operation."];
      scanConfiguration: ScanConfiguration.t option
        [@ocaml.doc
          "Information about the scan configuration used for the malware scan."];
      scanCategory: ScanCategory.t option
        [@ocaml.doc
          "The category of the malware scan, indicating the type of scan performed."];
      scanStatus: MalwareProtectionScanStatus.t option
        [@ocaml.doc
          "A value representing the current status of the malware scan."];
      scanStatusReason: ScanStatusReason.t option
        [@ocaml.doc
          "Represents the reason for the current scan status, if applicable."];
      scanType: MalwareProtectionScanType.t option
        [@ocaml.doc "A value representing the initiator of the scan."];
      scanStartedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp representing when the malware scan was started."];
      scanCompletedAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp representing when the malware scan was completed."];
      scanResultDetails: GetMalwareScanResultDetails.t option
        [@ocaml.doc
          "Detailed information about the results of the malware scan, if the scan completed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `ResourceNotFoundException of ResourceNotFoundException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?scanId =
      fun ?detectorId ->
        fun ?adminDetectorId ->
          fun ?resourceArn ->
            fun ?resourceType ->
              fun ?scannedResourcesCount ->
                fun ?skippedResourcesCount ->
                  fun ?failedResourcesCount ->
                    fun ?scannedResources ->
                      fun ?scanConfiguration ->
                        fun ?scanCategory ->
                          fun ?scanStatus ->
                            fun ?scanStatusReason ->
                              fun ?scanType ->
                                fun ?scanStartedAt ->
                                  fun ?scanCompletedAt ->
                                    fun ?scanResultDetails ->
                                      fun () ->
                                        {
                                          scanId;
                                          detectorId;
                                          adminDetectorId;
                                          resourceArn;
                                          resourceType;
                                          scannedResourcesCount;
                                          skippedResourcesCount;
                                          failedResourcesCount;
                                          scannedResources;
                                          scanConfiguration;
                                          scanCategory;
                                          scanStatus;
                                          scanStatusReason;
                                          scanType;
                                          scanStartedAt;
                                          scanCompletedAt;
                                          scanResultDetails
                                        }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | "ResourceNotFoundException" ->
          `ResourceNotFoundException (ResourceNotFoundException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | "ResourceNotFoundException" ->
          `ResourceNotFoundException (ResourceNotFoundException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `ResourceNotFoundException e ->
          `Assoc
            [("error", (`String "ResourceNotFoundException"));
            ("details", (ResourceNotFoundException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("scanId", (Option.map x.scanId ~f:NonEmptyString.to_value));
        ("detectorId", (Option.map x.detectorId ~f:DetectorId.to_value));
        ("adminDetectorId",
          (Option.map x.adminDetectorId ~f:DetectorId.to_value));
        ("resourceArn",
          (Option.map x.resourceArn ~f:NonEmptyString.to_value));
        ("resourceType",
          (Option.map x.resourceType
             ~f:MalwareProtectionResourceType.to_value));
        ("scannedResourcesCount",
          (Option.map x.scannedResourcesCount ~f:NonNegativeInteger.to_value));
        ("skippedResourcesCount",
          (Option.map x.skippedResourcesCount ~f:NonNegativeInteger.to_value));
        ("failedResourcesCount",
          (Option.map x.failedResourcesCount ~f:NonNegativeInteger.to_value));
        ("scannedResources",
          (Option.map x.scannedResources ~f:ScannedResources.to_value));
        ("scanConfiguration",
          (Option.map x.scanConfiguration ~f:ScanConfiguration.to_value));
        ("scanCategory",
          (Option.map x.scanCategory ~f:ScanCategory.to_value));
        ("scanStatus",
          (Option.map x.scanStatus ~f:MalwareProtectionScanStatus.to_value));
        ("scanStatusReason",
          (Option.map x.scanStatusReason ~f:ScanStatusReason.to_value));
        ("scanType",
          (Option.map x.scanType ~f:MalwareProtectionScanType.to_value));
        ("scanStartedAt", (Option.map x.scanStartedAt ~f:Timestamp.to_value));
        ("scanCompletedAt",
          (Option.map x.scanCompletedAt ~f:Timestamp.to_value));
        ("scanResultDetails",
          (Option.map x.scanResultDetails
             ~f:GetMalwareScanResultDetails.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanResultDetails =
        (Option.map ~f:GetMalwareScanResultDetails.of_xml)
          (Xml.child xml_arg0 "scanResultDetails") in
      let scanCompletedAt =
        (Option.map ~f:Timestamp.of_xml)
          (Xml.child xml_arg0 "scanCompletedAt") in
      let scanStartedAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "scanStartedAt") in
      let scanType =
        (Option.map ~f:MalwareProtectionScanType.of_xml)
          (Xml.child xml_arg0 "scanType") in
      let scanStatusReason =
        (Option.map ~f:ScanStatusReason.of_xml)
          (Xml.child xml_arg0 "scanStatusReason") in
      let scanStatus =
        (Option.map ~f:MalwareProtectionScanStatus.of_xml)
          (Xml.child xml_arg0 "scanStatus") in
      let scanCategory =
        (Option.map ~f:ScanCategory.of_xml)
          (Xml.child xml_arg0 "scanCategory") in
      let scanConfiguration =
        (Option.map ~f:ScanConfiguration.of_xml)
          (Xml.child xml_arg0 "scanConfiguration") in
      let scannedResources =
        (Option.map ~f:ScannedResources.of_xml)
          (Xml.child xml_arg0 "scannedResources") in
      let failedResourcesCount =
        (Option.map ~f:NonNegativeInteger.of_xml)
          (Xml.child xml_arg0 "failedResourcesCount") in
      let skippedResourcesCount =
        (Option.map ~f:NonNegativeInteger.of_xml)
          (Xml.child xml_arg0 "skippedResourcesCount") in
      let scannedResourcesCount =
        (Option.map ~f:NonNegativeInteger.of_xml)
          (Xml.child xml_arg0 "scannedResourcesCount") in
      let resourceType =
        (Option.map ~f:MalwareProtectionResourceType.of_xml)
          (Xml.child xml_arg0 "resourceType") in
      let resourceArn =
        (Option.map ~f:NonEmptyString.of_xml)
          (Xml.child xml_arg0 "resourceArn") in
      let adminDetectorId =
        (Option.map ~f:DetectorId.of_xml)
          (Xml.child xml_arg0 "adminDetectorId") in
      let detectorId =
        (Option.map ~f:DetectorId.of_xml) (Xml.child xml_arg0 "detectorId") in
      let scanId =
        (Option.map ~f:NonEmptyString.of_xml) (Xml.child xml_arg0 "scanId") in
      make ?scanResultDetails ?scanCompletedAt ?scanStartedAt ?scanType
        ?scanStatusReason ?scanStatus ?scanCategory ?scanConfiguration
        ?scannedResources ?failedResourcesCount ?skippedResourcesCount
        ?scannedResourcesCount ?resourceType ?resourceArn ?adminDetectorId
        ?detectorId ?scanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanResultDetails =
        field_map json__ "ScanResultDetails"
          GetMalwareScanResultDetails.of_json in
      let scanCompletedAt =
        field_map json__ "ScanCompletedAt" Timestamp.of_json in
      let scanStartedAt = field_map json__ "ScanStartedAt" Timestamp.of_json in
      let scanType =
        field_map json__ "ScanType" MalwareProtectionScanType.of_json in
      let scanStatusReason =
        field_map json__ "ScanStatusReason" ScanStatusReason.of_json in
      let scanStatus =
        field_map json__ "ScanStatus" MalwareProtectionScanStatus.of_json in
      let scanCategory = field_map json__ "ScanCategory" ScanCategory.of_json in
      let scanConfiguration =
        field_map json__ "ScanConfiguration" ScanConfiguration.of_json in
      let scannedResources =
        field_map json__ "ScannedResources" ScannedResources.of_json in
      let failedResourcesCount =
        field_map json__ "FailedResourcesCount" NonNegativeInteger.of_json in
      let skippedResourcesCount =
        field_map json__ "SkippedResourcesCount" NonNegativeInteger.of_json in
      let scannedResourcesCount =
        field_map json__ "ScannedResourcesCount" NonNegativeInteger.of_json in
      let resourceType =
        field_map json__ "ResourceType" MalwareProtectionResourceType.of_json in
      let resourceArn = field_map json__ "ResourceArn" NonEmptyString.of_json in
      let adminDetectorId =
        field_map json__ "AdminDetectorId" DetectorId.of_json in
      let detectorId = field_map json__ "DetectorId" DetectorId.of_json in
      let scanId = field_map json__ "ScanId" NonEmptyString.of_json in
      make ?scanResultDetails ?scanCompletedAt ?scanStartedAt ?scanType
        ?scanStatusReason ?scanStatus ?scanCategory ?scanConfiguration
        ?scannedResources ?failedResourcesCount ?skippedResourcesCount
        ?scannedResourcesCount ?resourceType ?resourceArn ?adminDetectorId
        ?detectorId ?scanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the detailed information for a specific malware scan. Each member account can view the malware scan details for their own account. An administrator can view malware scan details for all accounts in the organization. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module GetMalwareScanRequest =
  struct
    type nonrec t =
      {
      scanId: String_.t
        [@ocaml.doc
          "A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan."]}
    let context_ = "GetMalwareScanRequest"
    let make ~scanId = fun () -> { scanId }
    let to_value x =
      structure_to_value [("ScanId", (Some (String_.to_value x.scanId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let scanId =
        String_.of_xml (Xml.child_exn ~context:context_ xml_arg0 "ScanId") in
      make ~scanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let scanId = field_map_exn json__ "ScanId" String_.of_json in
      make ~scanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the detailed information for a specific malware scan. Each member account can view the malware scan details for their own account. An administrator can view malware scan details for all accounts in the organization. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module GetMalwareProtectionPlanResponse =
  struct
    type nonrec t =
      {
      arn: String_.t option
        [@ocaml.doc "Amazon Resource Name (ARN) of the protected resource."];
      role: String_.t option
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the IAM role that includes the permissions to scan and add tags to the associated protected resource."];
      protectedResource: CreateProtectedResource.t option
        [@ocaml.doc
          "Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource."];
      actions: MalwareProtectionPlanActions.t option
        [@ocaml.doc
          "Information about whether the tags will be added to the S3 object after scanning."];
      createdAt: Timestamp.t option
        [@ocaml.doc
          "The timestamp when the Malware Protection plan resource was created."];
      status: MalwareProtectionPlanStatus.t option
        [@ocaml.doc "Malware Protection plan status."];
      statusReasons: MalwareProtectionPlanStatusReasonsList.t option
        [@ocaml.doc
          "Information about the issue code and message associated to the status of your Malware Protection plan."];
      tags: TagMap.t option
        [@ocaml.doc "Tags added to the Malware Protection plan resource."]}
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `ResourceNotFoundException of ResourceNotFoundException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?arn =
      fun ?role ->
        fun ?protectedResource ->
          fun ?actions ->
            fun ?createdAt ->
              fun ?status ->
                fun ?statusReasons ->
                  fun ?tags ->
                    fun () ->
                      {
                        arn;
                        role;
                        protectedResource;
                        actions;
                        createdAt;
                        status;
                        statusReasons;
                        tags
                      }
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | "ResourceNotFoundException" ->
          `ResourceNotFoundException (ResourceNotFoundException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | "ResourceNotFoundException" ->
          `ResourceNotFoundException (ResourceNotFoundException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `ResourceNotFoundException e ->
          `Assoc
            [("error", (`String "ResourceNotFoundException"));
            ("details", (ResourceNotFoundException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("arn", (Option.map x.arn ~f:String_.to_value));
        ("role", (Option.map x.role ~f:String_.to_value));
        ("protectedResource",
          (Option.map x.protectedResource ~f:CreateProtectedResource.to_value));
        ("actions",
          (Option.map x.actions ~f:MalwareProtectionPlanActions.to_value));
        ("createdAt", (Option.map x.createdAt ~f:Timestamp.to_value));
        ("status",
          (Option.map x.status ~f:MalwareProtectionPlanStatus.to_value));
        ("statusReasons",
          (Option.map x.statusReasons
             ~f:MalwareProtectionPlanStatusReasonsList.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let statusReasons =
        (Option.map ~f:MalwareProtectionPlanStatusReasonsList.of_xml)
          (Xml.child xml_arg0 "statusReasons") in
      let status =
        (Option.map ~f:MalwareProtectionPlanStatus.of_xml)
          (Xml.child xml_arg0 "status") in
      let createdAt =
        (Option.map ~f:Timestamp.of_xml) (Xml.child xml_arg0 "createdAt") in
      let actions =
        (Option.map ~f:MalwareProtectionPlanActions.of_xml)
          (Xml.child xml_arg0 "actions") in
      let protectedResource =
        (Option.map ~f:CreateProtectedResource.of_xml)
          (Xml.child xml_arg0 "protectedResource") in
      let role = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "role") in
      let arn = (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "arn") in
      make ?tags ?statusReasons ?status ?createdAt ?actions
        ?protectedResource ?role ?arn ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in
      let statusReasons =
        field_map json__ "StatusReasons"
          MalwareProtectionPlanStatusReasonsList.of_json in
      let status =
        field_map json__ "Status" MalwareProtectionPlanStatus.of_json in
      let createdAt = field_map json__ "CreatedAt" Timestamp.of_json in
      let actions =
        field_map json__ "Actions" MalwareProtectionPlanActions.of_json in
      let protectedResource =
        field_map json__ "ProtectedResource" CreateProtectedResource.of_json in
      let role = field_map json__ "Role" String_.of_json in
      let arn = field_map json__ "Arn" String_.of_json in
      make ?tags ?statusReasons ?status ?createdAt ?actions
        ?protectedResource ?role ?arn ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the Malware Protection plan details associated with a Malware Protection plan ID."]
module GetMalwareProtectionPlanRequest =
  struct
    type nonrec t =
      {
      malwareProtectionPlanId: String_.t
        [@ocaml.doc
          "A unique identifier associated with Malware Protection plan resource."]}
    let context_ = "GetMalwareProtectionPlanRequest"
    let make ~malwareProtectionPlanId = fun () -> { malwareProtectionPlanId }
    let to_value x =
      structure_to_value
        [("MalwareProtectionPlanId",
           (Some (String_.to_value x.malwareProtectionPlanId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtectionPlanId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "MalwareProtectionPlanId") in
      make ~malwareProtectionPlanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtectionPlanId =
        field_map_exn json__ "MalwareProtectionPlanId" String_.of_json in
      make ~malwareProtectionPlanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves the Malware Protection plan details associated with a Malware Protection plan ID."]
module GetInvitationsCountResponse =
  struct
    type nonrec t =
      {
      invitationsCount: Integer.t option
        [@ocaml.doc "The number of received invitations."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?invitationsCount = fun () -> { invitationsCount }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("invitationsCount",
           (Option.map x.invitationsCount ~f:Integer.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let invitationsCount =
        (Option.map ~f:Integer.of_xml)
          (Xml.child xml_arg0 "invitationsCount") in
      make ?invitationsCount ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let invitationsCount =
        field_map json__ "InvitationsCount" Integer.of_json in
      make ?invitationsCount ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns the count of all GuardDuty membership invitations that were sent to the current member account except the currently accepted invitation."]
module GetInvitationsCountRequest =
  struct
    type nonrec t = unit
    let make () = ()
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns the count of all GuardDuty membership invitations that were sent to the current member account except the currently accepted invitation."]
module GetIPSetResponse =
  struct
    type nonrec t =
      {
      name: Name.t option
        [@ocaml.doc "The user-friendly name for the IPSet."];
      format: IpSetFormat.t option
        [@ocaml.doc "The format of the file that contains the IPSet."];
      location: Location.t option
        [@ocaml.doc "The URI of the file that contains the IPSet."];
      status: IpSetStatus.t option
        [@ocaml.doc "The status of IPSet file that was uploaded."];
      tags: TagMap.t option [@ocaml.doc "The tags of the IPSet resource."];
      expectedBucketOwner: AccountId.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter. This field appears in the response only if it was provided during IPSet creation or update."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?name =
      fun ?format ->
        fun ?location ->
          fun ?status ->
            fun ?tags ->
              fun ?expectedBucketOwner ->
                fun () ->
                  { name; format; location; status; tags; expectedBucketOwner
                  }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:Name.to_value));
        ("format", (Option.map x.format ~f:IpSetFormat.to_value));
        ("location", (Option.map x.location ~f:Location.to_value));
        ("status", (Option.map x.status ~f:IpSetStatus.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:AccountId.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let expectedBucketOwner =
        (Option.map ~f:AccountId.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let status =
        (Option.map ~f:IpSetStatus.of_xml) (Xml.child xml_arg0 "status") in
      let location =
        (Option.map ~f:Location.of_xml) (Xml.child xml_arg0 "location") in
      let format =
        (Option.map ~f:IpSetFormat.of_xml) (Xml.child xml_arg0 "format") in
      let name = (Option.map ~f:Name.of_xml) (Xml.child xml_arg0 "name") in
      make ?expectedBucketOwner ?tags ?status ?location ?format ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" AccountId.of_json in
      let tags = field_map json__ "Tags" TagMap.of_json in
      let status = field_map json__ "Status" IpSetStatus.of_json in
      let location = field_map json__ "Location" Location.of_json in
      let format = field_map json__ "Format" IpSetFormat.of_json in
      let name = field_map json__ "Name" Name.of_json in
      make ?expectedBucketOwner ?tags ?status ?location ?format ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Retrieves the IPSet specified by the ipSetId."]
module GetIPSetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with the IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      ipSetId: String_.t
        [@ocaml.doc "The unique ID of the IPSet to retrieve."]}
    let context_ = "GetIPSetRequest"
    let make ~detectorId = fun ~ipSetId -> fun () -> { detectorId; ipSetId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("IpSetId", (Some (String_.to_value x.ipSetId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ipSetId =
        String_.of_xml (Xml.child_exn ~context:context_ xml_arg0 "IpSetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~ipSetId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ipSetId = field_map_exn json__ "IpSetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~ipSetId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Retrieves the IPSet specified by the ipSetId."]
module GetFindingsStatisticsResponse =
  struct
    type nonrec t =
      {
      findingStatistics: FindingStatistics.t option
        [@ocaml.doc "The finding statistics object."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items. This parameter is currently not supported."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?findingStatistics =
      fun ?nextToken -> fun () -> { findingStatistics; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("findingStatistics",
           (Option.map x.findingStatistics ~f:FindingStatistics.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let findingStatistics =
        (Option.map ~f:FindingStatistics.of_xml)
          (Xml.child xml_arg0 "findingStatistics") in
      make ?nextToken ?findingStatistics ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let findingStatistics =
        field_map json__ "FindingStatistics" FindingStatistics.of_json in
      make ?nextToken ?findingStatistics ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists GuardDuty findings statistics for the specified detector ID. You must provide either findingStatisticTypes or groupBy parameter, and not both. You can use the maxResults and orderBy parameters only when using groupBy. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints."]
module GetFindingsStatisticsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector whose findings statistics you want to retrieve. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      findingStatisticTypes: FindingStatisticTypes.t option
        [@ocaml.doc "The types of finding statistics to retrieve."];
      findingCriteria: FindingCriteria.t option
        [@ocaml.doc
          "Represents the criteria that is used for querying findings."];
      groupBy: GroupByType.t option
        [@ocaml.doc
          "Displays the findings statistics grouped by one of the listed valid values."];
      orderBy: OrderBy.t option
        [@ocaml.doc
          "Displays the sorted findings in the requested order. The default value of orderBy is DESC. You can use this parameter only with the groupBy parameter."];
      maxResults: MaxResults100.t option
        [@ocaml.doc
          "The maximum number of results to be returned in the response. The default value is 25. You can use this parameter only with the groupBy parameter."]}
    let context_ = "GetFindingsStatisticsRequest"
    let make ?findingStatisticTypes =
      fun ?findingCriteria ->
        fun ?groupBy ->
          fun ?orderBy ->
            fun ?maxResults ->
              fun ~detectorId ->
                fun () ->
                  {
                    findingStatisticTypes;
                    findingCriteria;
                    groupBy;
                    orderBy;
                    maxResults;
                    detectorId
                  }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("findingStatisticTypes",
          (Option.map x.findingStatisticTypes
             ~f:FindingStatisticTypes.to_value));
        ("findingCriteria",
          (Option.map x.findingCriteria ~f:FindingCriteria.to_value));
        ("groupBy", (Option.map x.groupBy ~f:GroupByType.to_value));
        ("orderBy", (Option.map x.orderBy ~f:OrderBy.to_value));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults100.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let maxResults =
        (Option.map ~f:MaxResults100.of_xml)
          (Xml.child xml_arg0 "maxResults") in
      let orderBy =
        (Option.map ~f:OrderBy.of_xml) (Xml.child xml_arg0 "orderBy") in
      let groupBy =
        (Option.map ~f:GroupByType.of_xml) (Xml.child xml_arg0 "groupBy") in
      let findingCriteria =
        (Option.map ~f:FindingCriteria.of_xml)
          (Xml.child xml_arg0 "findingCriteria") in
      let findingStatisticTypes =
        (Option.map ~f:FindingStatisticTypes.of_xml)
          (Xml.child xml_arg0 "findingStatisticTypes") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?maxResults ?orderBy ?groupBy ?findingCriteria
        ?findingStatisticTypes ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let maxResults = field_map json__ "MaxResults" MaxResults100.of_json in
      let orderBy = field_map json__ "OrderBy" OrderBy.of_json in
      let groupBy = field_map json__ "GroupBy" GroupByType.of_json in
      let findingCriteria =
        field_map json__ "FindingCriteria" FindingCriteria.of_json in
      let findingStatisticTypes =
        field_map json__ "FindingStatisticTypes"
          FindingStatisticTypes.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?maxResults ?orderBy ?groupBy ?findingCriteria
        ?findingStatisticTypes ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Lists GuardDuty findings statistics for the specified detector ID. You must provide either findingStatisticTypes or groupBy parameter, and not both. You can use the maxResults and orderBy parameters only when using groupBy. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints."]
module GetFindingsResponse =
  struct
    type nonrec t =
      {
      findings: Findings.t option [@ocaml.doc "A list of findings."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?findings = fun () -> { findings }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("findings", (Option.map x.findings ~f:Findings.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let findings =
        (Option.map ~f:Findings.of_xml) (Xml.child xml_arg0 "findings") in
      make ?findings ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let findings = field_map json__ "Findings" Findings.of_json in
      make ?findings ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes Amazon GuardDuty findings specified by finding IDs."]
module GetFindingsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      findingIds: FindingIds.t
        [@ocaml.doc "The IDs of the findings that you want to retrieve."];
      sortCriteria: SortCriteria.t option
        [@ocaml.doc "Represents the criteria used for sorting findings."]}
    let context_ = "GetFindingsRequest"
    let make ?sortCriteria =
      fun ~detectorId ->
        fun ~findingIds -> fun () -> { sortCriteria; detectorId; findingIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("findingIds", (Some (FindingIds.to_value x.findingIds)));
        ("sortCriteria",
          (Option.map x.sortCriteria ~f:SortCriteria.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let sortCriteria =
        (Option.map ~f:SortCriteria.of_xml)
          (Xml.child xml_arg0 "sortCriteria") in
      let findingIds =
        FindingIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "findingIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?sortCriteria ~findingIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let sortCriteria = field_map json__ "SortCriteria" SortCriteria.of_json in
      let findingIds = field_map_exn json__ "FindingIds" FindingIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?sortCriteria ~findingIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Describes Amazon GuardDuty findings specified by finding IDs."]
module GetFilterResponse =
  struct
    type nonrec t =
      {
      name: FilterName.t option [@ocaml.doc "The name of the filter."];
      description: FilterDescription.t option
        [@ocaml.doc "The description of the filter."];
      action: FilterAction.t option
        [@ocaml.doc
          "Specifies the action that is to be applied to the findings that match the filter."];
      rank: FilterRank.t option
        [@ocaml.doc
          "Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings."];
      findingCriteria: FindingCriteria.t option
        [@ocaml.doc
          "Represents the criteria to be used in the filter for querying findings."];
      tags: TagMap.t option [@ocaml.doc "The tags of the filter resource."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?name =
      fun ?description ->
        fun ?action ->
          fun ?rank ->
            fun ?findingCriteria ->
              fun ?tags ->
                fun () ->
                  { name; description; action; rank; findingCriteria; tags }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:FilterName.to_value));
        ("description",
          (Option.map x.description ~f:FilterDescription.to_value));
        ("action", (Option.map x.action ~f:FilterAction.to_value));
        ("rank", (Option.map x.rank ~f:FilterRank.to_value));
        ("findingCriteria",
          (Option.map x.findingCriteria ~f:FindingCriteria.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let findingCriteria =
        (Option.map ~f:FindingCriteria.of_xml)
          (Xml.child xml_arg0 "findingCriteria") in
      let rank =
        (Option.map ~f:FilterRank.of_xml) (Xml.child xml_arg0 "rank") in
      let action =
        (Option.map ~f:FilterAction.of_xml) (Xml.child xml_arg0 "action") in
      let description =
        (Option.map ~f:FilterDescription.of_xml)
          (Xml.child xml_arg0 "description") in
      let name =
        (Option.map ~f:FilterName.of_xml) (Xml.child xml_arg0 "name") in
      make ?tags ?findingCriteria ?rank ?action ?description ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in
      let findingCriteria =
        field_map json__ "FindingCriteria" FindingCriteria.of_json in
      let rank = field_map json__ "Rank" FilterRank.of_json in
      let action = field_map json__ "Action" FilterAction.of_json in
      let description =
        field_map json__ "Description" FilterDescription.of_json in
      let name = field_map json__ "Name" FilterName.of_json in
      make ?tags ?findingCriteria ?rank ?action ?description ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns the details of the filter specified by the filter name."]
module GetFilterRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with this filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      filterName: String_.t
        [@ocaml.doc "The name of the filter you want to get."]}
    let context_ = "GetFilterRequest"
    let make ~detectorId =
      fun ~filterName -> fun () -> { detectorId; filterName }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("FilterName", (Some (String_.to_value x.filterName)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let filterName =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "FilterName") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~filterName ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let filterName = field_map_exn json__ "FilterName" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~filterName ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns the details of the filter specified by the filter name."]
module GetDetectorResponse =
  struct
    type nonrec t =
      {
      createdAt: String_.t option
        [@ocaml.doc "The timestamp of when the detector was created."];
      findingPublishingFrequency: FindingPublishingFrequency.t option
        [@ocaml.doc "The publishing frequency of the finding."];
      serviceRole: String_.t option
        [@ocaml.doc "The GuardDuty service role."];
      status: DetectorStatus.t option [@ocaml.doc "The detector status."];
      updatedAt: String_.t option
        [@ocaml.doc "The last-updated timestamp for the detector."];
      dataSources: DataSourceConfigurationsResult.t option
        [@ocaml.doc
          "Describes which data sources are enabled for the detector."];
      tags: TagMap.t option [@ocaml.doc "The tags of the detector resource."];
      features: DetectorFeatureConfigurationsResults.t option
        [@ocaml.doc
          "Describes the features that have been enabled for the detector."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?createdAt =
      fun ?findingPublishingFrequency ->
        fun ?serviceRole ->
          fun ?status ->
            fun ?updatedAt ->
              fun ?dataSources ->
                fun ?tags ->
                  fun ?features ->
                    fun () ->
                      {
                        createdAt;
                        findingPublishingFrequency;
                        serviceRole;
                        status;
                        updatedAt;
                        dataSources;
                        tags;
                        features
                      }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("createdAt", (Option.map x.createdAt ~f:String_.to_value));
        ("findingPublishingFrequency",
          (Option.map x.findingPublishingFrequency
             ~f:FindingPublishingFrequency.to_value));
        ("serviceRole", (Option.map x.serviceRole ~f:String_.to_value));
        ("status", (Option.map x.status ~f:DetectorStatus.to_value));
        ("updatedAt", (Option.map x.updatedAt ~f:String_.to_value));
        ("dataSources",
          (Option.map x.dataSources
             ~f:DataSourceConfigurationsResult.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value));
        ("features",
          (Option.map x.features
             ~f:DetectorFeatureConfigurationsResults.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let features =
        (Option.map ~f:DetectorFeatureConfigurationsResults.of_xml)
          (Xml.child xml_arg0 "features") in
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let dataSources =
        (Option.map ~f:DataSourceConfigurationsResult.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let updatedAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "updatedAt") in
      let status =
        (Option.map ~f:DetectorStatus.of_xml) (Xml.child xml_arg0 "status") in
      let serviceRole =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "serviceRole") in
      let findingPublishingFrequency =
        (Option.map ~f:FindingPublishingFrequency.of_xml)
          (Xml.child xml_arg0 "findingPublishingFrequency") in
      let createdAt =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "createdAt") in
      make ?features ?tags ?dataSources ?updatedAt ?status ?serviceRole
        ?findingPublishingFrequency ?createdAt ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let features =
        field_map json__ "Features"
          DetectorFeatureConfigurationsResults.of_json in
      let tags = field_map json__ "Tags" TagMap.of_json in
      let dataSources =
        field_map json__ "DataSources" DataSourceConfigurationsResult.of_json in
      let updatedAt = field_map json__ "UpdatedAt" String_.of_json in
      let status = field_map json__ "Status" DetectorStatus.of_json in
      let serviceRole = field_map json__ "ServiceRole" String_.of_json in
      let findingPublishingFrequency =
        field_map json__ "FindingPublishingFrequency"
          FindingPublishingFrequency.of_json in
      let createdAt = field_map json__ "CreatedAt" String_.of_json in
      make ?features ?tags ?dataSources ?updatedAt ?status ?serviceRole
        ?findingPublishingFrequency ?createdAt ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves a GuardDuty detector specified by the detectorId. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module GetDetectorRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that you want to get. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."]}
    let context_ = "GetDetectorRequest"
    let make ~detectorId = fun () -> { detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves a GuardDuty detector specified by the detectorId. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module GetCoverageStatisticsResponse =
  struct
    type nonrec t =
      {
      coverageStatistics: CoverageStatistics.t option
        [@ocaml.doc
          "Represents the count aggregated by the statusCode and resourceType."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?coverageStatistics = fun () -> { coverageStatistics }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("coverageStatistics",
           (Option.map x.coverageStatistics ~f:CoverageStatistics.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let coverageStatistics =
        (Option.map ~f:CoverageStatistics.of_xml)
          (Xml.child xml_arg0 "coverageStatistics") in
      make ?coverageStatistics ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let coverageStatistics =
        field_map json__ "CoverageStatistics" CoverageStatistics.of_json in
      make ?coverageStatistics ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled Runtime Monitoring and have the GuardDuty security agent running on their resources."]
module GetCoverageStatisticsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the GuardDuty detector. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      filterCriteria: CoverageFilterCriteria.t option
        [@ocaml.doc
          "Represents the criteria used to filter the coverage statistics."];
      statisticsType: CoverageStatisticsTypeList.t
        [@ocaml.doc
          "Represents the statistics type used to aggregate the coverage details."]}
    let context_ = "GetCoverageStatisticsRequest"
    let make ?filterCriteria =
      fun ~detectorId ->
        fun ~statisticsType ->
          fun () -> { filterCriteria; detectorId; statisticsType }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("filterCriteria",
          (Option.map x.filterCriteria ~f:CoverageFilterCriteria.to_value));
        ("statisticsType",
          (Some (CoverageStatisticsTypeList.to_value x.statisticsType)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let statisticsType =
        CoverageStatisticsTypeList.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "statisticsType") in
      let filterCriteria =
        (Option.map ~f:CoverageFilterCriteria.of_xml)
          (Xml.child xml_arg0 "filterCriteria") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~statisticsType ?filterCriteria ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let statisticsType =
        field_map_exn json__ "StatisticsType"
          CoverageStatisticsTypeList.of_json in
      let filterCriteria =
        field_map json__ "FilterCriteria" CoverageFilterCriteria.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~statisticsType ?filterCriteria ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled Runtime Monitoring and have the GuardDuty security agent running on their resources."]
module GetAdministratorAccountResponse =
  struct
    type nonrec t =
      {
      administrator: Administrator.t option
        [@ocaml.doc "The administrator account details."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?administrator = fun () -> { administrator }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("administrator",
           (Option.map x.administrator ~f:Administrator.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let administrator =
        (Option.map ~f:Administrator.of_xml)
          (Xml.child xml_arg0 "administrator") in
      make ?administrator ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let administrator =
        field_map json__ "Administrator" Administrator.of_json in
      make ?administrator ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides the details of the GuardDuty administrator account associated with the current GuardDuty member account. Based on the type of account that runs this API, the following list shows how the API behavior varies: When the GuardDuty administrator account runs this API, it will return success (HTTP 200) but no content. When a member account runs this API, it will return the details of the GuardDuty administrator account that is associated with this calling member account. When an individual account (not associated with an organization) runs this API, it will return success (HTTP 200) but no content."]
module GetAdministratorAccountRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty member account."]}
    let context_ = "GetAdministratorAccountRequest"
    let make ~detectorId = fun () -> { detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Provides the details of the GuardDuty administrator account associated with the current GuardDuty member account. Based on the type of account that runs this API, the following list shows how the API behavior varies: When the GuardDuty administrator account runs this API, it will return success (HTTP 200) but no content. When a member account runs this API, it will return the details of the GuardDuty administrator account that is associated with this calling member account. When an individual account (not associated with an organization) runs this API, it will return success (HTTP 200) but no content."]
module EnableOrganizationAdminAccountResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Designates an Amazon Web Services account within the organization as your GuardDuty delegated administrator. Only the organization's management account can run this API operation."]
module EnableOrganizationAdminAccountRequest =
  struct
    type nonrec t =
      {
      adminAccountId: String_.t
        [@ocaml.doc
          "The Amazon Web Services account ID for the organization account to be enabled as a GuardDuty delegated administrator."]}
    let context_ = "EnableOrganizationAdminAccountRequest"
    let make ~adminAccountId = fun () -> { adminAccountId }
    let to_value x =
      structure_to_value
        [("adminAccountId", (Some (String_.to_value x.adminAccountId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let adminAccountId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "adminAccountId") in
      make ~adminAccountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let adminAccountId =
        field_map_exn json__ "AdminAccountId" String_.of_json in
      make ~adminAccountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Designates an Amazon Web Services account within the organization as your GuardDuty delegated administrator. Only the organization's management account can run this API operation."]
module DisassociateMembersResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of objects that contain the unprocessed account and a result string that explains why it was unprocessed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Disassociates GuardDuty member accounts (from the current administrator account) specified by the account IDs. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disassociate a member account before removing them from your organization. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API."]
module DisassociateMembersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account whose members you want to disassociate from the administrator account."];
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account IDs of the GuardDuty member accounts that you want to disassociate from the administrator account."]}
    let context_ = "DisassociateMembersRequest"
    let make ~detectorId =
      fun ~accountIds -> fun () -> { detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Disassociates GuardDuty member accounts (from the current administrator account) specified by the account IDs. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disassociate a member account before removing them from your organization. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API."]
module DisassociateFromMasterAccountResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API."]
module DisassociateFromMasterAccountRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty member account."]}
    let context_ = "DisassociateFromMasterAccountRequest"
    let make ~detectorId = fun () -> { detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API."]
module DisassociateFromAdministratorAccountResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty in a member account."]
module DisassociateFromAdministratorAccountRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty member account."]}
    let context_ = "DisassociateFromAdministratorAccountRequest"
    let make ~detectorId = fun () -> { detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty in a member account."]
module DisableOrganizationAdminAccountResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Removes the existing GuardDuty delegated administrator of the organization. Only the organization's management account can run this API operation."]
module DisableOrganizationAdminAccountRequest =
  struct
    type nonrec t =
      {
      adminAccountId: String_.t
        [@ocaml.doc
          "The Amazon Web Services Account ID for the organizations account to be disabled as a GuardDuty delegated administrator."]}
    let context_ = "DisableOrganizationAdminAccountRequest"
    let make ~adminAccountId = fun () -> { adminAccountId }
    let to_value x =
      structure_to_value
        [("adminAccountId", (Some (String_.to_value x.adminAccountId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let adminAccountId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "adminAccountId") in
      make ~adminAccountId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let adminAccountId =
        field_map_exn json__ "AdminAccountId" String_.of_json in
      make ~adminAccountId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Removes the existing GuardDuty delegated administrator of the organization. Only the organization's management account can run this API operation."]
module DescribePublishingDestinationResponse =
  struct
    type nonrec t =
      {
      destinationId: String_.t option
        [@ocaml.doc "The ID of the publishing destination."];
      destinationType: DestinationType.t option
        [@ocaml.doc
          "The type of publishing destination. Currently, only Amazon S3 buckets are supported."];
      status: PublishingStatus.t option
        [@ocaml.doc "The status of the publishing destination."];
      publishingFailureStartTimestamp: Long.t option
        [@ocaml.doc
          "The time, in epoch millisecond format, at which GuardDuty was first unable to publish findings to the destination."];
      destinationProperties: DestinationProperties.t option
        [@ocaml.doc
          "A DestinationProperties object that includes the DestinationArn and KmsKeyArn of the publishing destination."];
      tags: TagMap.t option
        [@ocaml.doc "The tags of the publishing destination resource."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?destinationId =
      fun ?destinationType ->
        fun ?status ->
          fun ?publishingFailureStartTimestamp ->
            fun ?destinationProperties ->
              fun ?tags ->
                fun () ->
                  {
                    destinationId;
                    destinationType;
                    status;
                    publishingFailureStartTimestamp;
                    destinationProperties;
                    tags
                  }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("destinationId", (Option.map x.destinationId ~f:String_.to_value));
        ("destinationType",
          (Option.map x.destinationType ~f:DestinationType.to_value));
        ("status", (Option.map x.status ~f:PublishingStatus.to_value));
        ("publishingFailureStartTimestamp",
          (Option.map x.publishingFailureStartTimestamp ~f:Long.to_value));
        ("destinationProperties",
          (Option.map x.destinationProperties
             ~f:DestinationProperties.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let destinationProperties =
        (Option.map ~f:DestinationProperties.of_xml)
          (Xml.child xml_arg0 "destinationProperties") in
      let publishingFailureStartTimestamp =
        (Option.map ~f:Long.of_xml)
          (Xml.child xml_arg0 "publishingFailureStartTimestamp") in
      let status =
        (Option.map ~f:PublishingStatus.of_xml) (Xml.child xml_arg0 "status") in
      let destinationType =
        (Option.map ~f:DestinationType.of_xml)
          (Xml.child xml_arg0 "destinationType") in
      let destinationId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "destinationId") in
      make ?tags ?destinationProperties ?publishingFailureStartTimestamp
        ?status ?destinationType ?destinationId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in
      let destinationProperties =
        field_map json__ "DestinationProperties"
          DestinationProperties.of_json in
      let publishingFailureStartTimestamp =
        field_map json__ "PublishingFailureStartTimestamp" Long.of_json in
      let status = field_map json__ "Status" PublishingStatus.of_json in
      let destinationType =
        field_map json__ "DestinationType" DestinationType.of_json in
      let destinationId = field_map json__ "DestinationId" String_.of_json in
      make ?tags ?destinationProperties ?publishingFailureStartTimestamp
        ?status ?destinationType ?destinationId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns information about the publishing destination specified by the provided destinationId."]
module DescribePublishingDestinationRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector associated with the publishing destination to retrieve. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      destinationId: String_.t
        [@ocaml.doc "The ID of the publishing destination to retrieve."]}
    let context_ = "DescribePublishingDestinationRequest"
    let make ~detectorId =
      fun ~destinationId -> fun () -> { detectorId; destinationId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("DestinationId", (Some (String_.to_value x.destinationId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let destinationId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DestinationId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~destinationId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let destinationId =
        field_map_exn json__ "DestinationId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~destinationId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns information about the publishing destination specified by the provided destinationId."]
module DescribeOrganizationConfigurationResponse =
  struct
    type nonrec t =
      {
      autoEnable: Boolean.t option
        [@ocaml.doc
          "Indicates whether GuardDuty is automatically enabled for accounts added to the organization. Even though this is still supported, we recommend using AutoEnableOrganizationMembers to achieve the similar results."];
      memberAccountLimitReached: Boolean.t option
        [@ocaml.doc
          "Indicates whether the maximum number of allowed member accounts are already associated with the delegated administrator account for your organization."];
      dataSources: OrganizationDataSourceConfigurationsResult.t option
        [@ocaml.doc
          "Describes which data sources are enabled automatically for member accounts."];
      features: OrganizationFeaturesConfigurationsResults.t option
        [@ocaml.doc
          "A list of features that are configured for this organization."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."];
      autoEnableOrganizationMembers: AutoEnableMembers.t option
        [@ocaml.doc
          "Indicates the auto-enablement configuration of GuardDuty or any of the corresponding protection plans for the member accounts in the organization. NEW: Indicates that when a new account joins the organization, they will have GuardDuty or any of the corresponding protection plans enabled automatically. ALL: Indicates that all accounts in the organization have GuardDuty and any of the corresponding protection plans enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. NONE: Indicates that GuardDuty or any of the corresponding protection plans will not be automatically enabled for any account in the organization. The administrator must manage GuardDuty for each account in the organization individually. When you update the auto-enable setting from ALL or NEW to NONE, this action doesn't disable the corresponding option for your existing accounts. This configuration will apply to the new accounts that join the organization. After you update the auto-enable settings, no new account will have the corresponding option as enabled."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?autoEnable =
      fun ?memberAccountLimitReached ->
        fun ?dataSources ->
          fun ?features ->
            fun ?nextToken ->
              fun ?autoEnableOrganizationMembers ->
                fun () ->
                  {
                    autoEnable;
                    memberAccountLimitReached;
                    dataSources;
                    features;
                    nextToken;
                    autoEnableOrganizationMembers
                  }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("autoEnable", (Option.map x.autoEnable ~f:Boolean.to_value));
        ("memberAccountLimitReached",
          (Option.map x.memberAccountLimitReached ~f:Boolean.to_value));
        ("dataSources",
          (Option.map x.dataSources
             ~f:OrganizationDataSourceConfigurationsResult.to_value));
        ("features",
          (Option.map x.features
             ~f:OrganizationFeaturesConfigurationsResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value));
        ("autoEnableOrganizationMembers",
          (Option.map x.autoEnableOrganizationMembers
             ~f:AutoEnableMembers.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let autoEnableOrganizationMembers =
        (Option.map ~f:AutoEnableMembers.of_xml)
          (Xml.child xml_arg0 "autoEnableOrganizationMembers") in
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let features =
        (Option.map ~f:OrganizationFeaturesConfigurationsResults.of_xml)
          (Xml.child xml_arg0 "features") in
      let dataSources =
        (Option.map ~f:OrganizationDataSourceConfigurationsResult.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let memberAccountLimitReached =
        (Option.map ~f:Boolean.of_xml)
          (Xml.child xml_arg0 "memberAccountLimitReached") in
      let autoEnable =
        (Option.map ~f:Boolean.of_xml) (Xml.child xml_arg0 "autoEnable") in
      make ?autoEnableOrganizationMembers ?nextToken ?features ?dataSources
        ?memberAccountLimitReached ?autoEnable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let autoEnableOrganizationMembers =
        field_map json__ "AutoEnableOrganizationMembers"
          AutoEnableMembers.of_json in
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let features =
        field_map json__ "Features"
          OrganizationFeaturesConfigurationsResults.of_json in
      let dataSources =
        field_map json__ "DataSources"
          OrganizationDataSourceConfigurationsResult.of_json in
      let memberAccountLimitReached =
        field_map json__ "MemberAccountLimitReached" Boolean.of_json in
      let autoEnable = field_map json__ "AutoEnable" Boolean.of_json in
      make ?autoEnableOrganizationMembers ?nextToken ?features ?dataSources
        ?memberAccountLimitReached ?autoEnable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns information about the account selected as the delegated administrator for GuardDuty. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module DescribeOrganizationConfigurationRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The detector ID of the delegated administrator for which you need to retrieve the information. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      maxResults: MaxResults.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items that you want in the response."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."]}
    let context_ = "DescribeOrganizationConfigurationRequest"
    let make ?maxResults =
      fun ?nextToken ->
        fun ~detectorId -> fun () -> { maxResults; nextToken; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("maxResults", (Option.map x.maxResults ~f:MaxResults.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let maxResults =
        (Option.map ~f:MaxResults.of_xml) (Xml.child xml_arg0 "maxResults") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?nextToken ?maxResults ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let maxResults = field_map json__ "MaxResults" MaxResults.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?nextToken ?maxResults ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns information about the account selected as the delegated administrator for GuardDuty. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module DescribeMalwareScansResponse =
  struct
    type nonrec t =
      {
      scans: Scans.t option
        [@ocaml.doc
          "Contains information about malware scans associated with GuardDuty Malware Protection for EC2."];
      nextToken: String_.t option
        [@ocaml.doc
          "The pagination parameter to be used on the next list operation to retrieve more items."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?scans = fun ?nextToken -> fun () -> { scans; nextToken }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("scans", (Option.map x.scans ~f:Scans.to_value));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let scans = (Option.map ~f:Scans.of_xml) (Xml.child xml_arg0 "scans") in
      make ?nextToken ?scans ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let scans = field_map json__ "Scans" Scans.of_json in
      make ?nextToken ?scans ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module DescribeMalwareScansRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that the request is associated with. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      nextToken: String_.t option
        [@ocaml.doc
          "You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data."];
      maxResults: IntegerValueWithMax.t option
        [@ocaml.doc
          "You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50."];
      filterCriteria: FilterCriteria.t option
        [@ocaml.doc
          "Represents the criteria to be used in the filter for describing scan entries."];
      sortCriteria: SortCriteria.t option
        [@ocaml.doc
          "Represents the criteria used for sorting scan entries. The attributeName is required and it must be scanStartTime."]}
    let context_ = "DescribeMalwareScansRequest"
    let make ?nextToken =
      fun ?maxResults ->
        fun ?filterCriteria ->
          fun ?sortCriteria ->
            fun ~detectorId ->
              fun () ->
                {
                  nextToken;
                  maxResults;
                  filterCriteria;
                  sortCriteria;
                  detectorId
                }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("nextToken", (Option.map x.nextToken ~f:String_.to_value));
        ("maxResults",
          (Option.map x.maxResults ~f:IntegerValueWithMax.to_value));
        ("filterCriteria",
          (Option.map x.filterCriteria ~f:FilterCriteria.to_value));
        ("sortCriteria",
          (Option.map x.sortCriteria ~f:SortCriteria.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let sortCriteria =
        (Option.map ~f:SortCriteria.of_xml)
          (Xml.child xml_arg0 "sortCriteria") in
      let filterCriteria =
        (Option.map ~f:FilterCriteria.of_xml)
          (Xml.child xml_arg0 "filterCriteria") in
      let maxResults =
        (Option.map ~f:IntegerValueWithMax.of_xml)
          (Xml.child xml_arg0 "maxResults") in
      let nextToken =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "nextToken") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?sortCriteria ?filterCriteria ?maxResults ?nextToken ~detectorId
        ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let sortCriteria = field_map json__ "SortCriteria" SortCriteria.of_json in
      let filterCriteria =
        field_map json__ "FilterCriteria" FilterCriteria.of_json in
      let maxResults =
        field_map json__ "MaxResults" IntegerValueWithMax.of_json in
      let nextToken = field_map json__ "NextToken" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?sortCriteria ?filterCriteria ?maxResults ?nextToken ~detectorId
        ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module DeleteTrustedEntitySetResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the trusted entity set that is associated with the specified trustedEntitySetId."]
module DeleteTrustedEntitySetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector associated with the trusted entity set resource. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      trustedEntitySetId: String_.t
        [@ocaml.doc
          "The unique ID that helps GuardDuty identify which trusted entity set needs to be deleted."]}
    let context_ = "DeleteTrustedEntitySetRequest"
    let make ~detectorId =
      fun ~trustedEntitySetId -> fun () -> { detectorId; trustedEntitySetId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("TrustedEntitySetId",
          (Some (String_.to_value x.trustedEntitySetId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let trustedEntitySetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "TrustedEntitySetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~trustedEntitySetId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let trustedEntitySetId =
        field_map_exn json__ "TrustedEntitySetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~trustedEntitySetId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the trusted entity set that is associated with the specified trustedEntitySetId."]
module DeleteThreatIntelSetResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the ThreatIntelSet specified by the ThreatIntelSet ID."]
module DeleteThreatIntelSetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with the threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      threatIntelSetId: String_.t
        [@ocaml.doc
          "The unique ID of the threatIntelSet that you want to delete."]}
    let context_ = "DeleteThreatIntelSetRequest"
    let make ~detectorId =
      fun ~threatIntelSetId -> fun () -> { detectorId; threatIntelSetId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("ThreatIntelSetId", (Some (String_.to_value x.threatIntelSetId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatIntelSetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ThreatIntelSetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~threatIntelSetId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatIntelSetId =
        field_map_exn json__ "ThreatIntelSetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~threatIntelSetId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the ThreatIntelSet specified by the ThreatIntelSet ID."]
module DeleteThreatEntitySetResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the threat entity set that is associated with the specified threatEntitySetId."]
module DeleteThreatEntitySetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector associated with the threat entity set resource. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      threatEntitySetId: String_.t
        [@ocaml.doc
          "The unique ID that helps GuardDuty identify which threat entity set needs to be deleted."]}
    let context_ = "DeleteThreatEntitySetRequest"
    let make ~detectorId =
      fun ~threatEntitySetId -> fun () -> { detectorId; threatEntitySetId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("ThreatEntitySetId", (Some (String_.to_value x.threatEntitySetId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatEntitySetId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "ThreatEntitySetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~threatEntitySetId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatEntitySetId =
        field_map_exn json__ "ThreatEntitySetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~threatEntitySetId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the threat entity set that is associated with the specified threatEntitySetId."]
module DeletePublishingDestinationResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the publishing definition with the specified destinationId."]
module DeletePublishingDestinationRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector associated with the publishing destination to delete. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      destinationId: String_.t
        [@ocaml.doc "The ID of the publishing destination to delete."]}
    let context_ = "DeletePublishingDestinationRequest"
    let make ~detectorId =
      fun ~destinationId -> fun () -> { detectorId; destinationId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("DestinationId", (Some (String_.to_value x.destinationId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let destinationId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DestinationId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~destinationId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let destinationId =
        field_map_exn json__ "DestinationId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~destinationId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the publishing definition with the specified destinationId."]
module DeleteMembersResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc "The accounts that could not be processed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty for a member account in your organization."]
module DeleteMembersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account whose members you want to delete. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account IDs of the GuardDuty member accounts that you want to delete."]}
    let context_ = "DeleteMembersRequest"
    let make ~detectorId =
      fun ~accountIds -> fun () -> { detectorId; accountIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~accountIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~accountIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty for a member account in your organization."]
module DeleteMalwareProtectionPlanRequest =
  struct
    type nonrec t =
      {
      malwareProtectionPlanId: String_.t
        [@ocaml.doc
          "A unique identifier associated with Malware Protection plan resource."]}
    let context_ = "DeleteMalwareProtectionPlanRequest"
    let make ~malwareProtectionPlanId = fun () -> { malwareProtectionPlanId }
    let to_value x =
      structure_to_value
        [("MalwareProtectionPlanId",
           (Some (String_.to_value x.malwareProtectionPlanId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtectionPlanId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "MalwareProtectionPlanId") in
      make ~malwareProtectionPlanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtectionPlanId =
        field_map_exn json__ "MalwareProtectionPlanId" String_.of_json in
      make ~malwareProtectionPlanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the Malware Protection plan ID associated with the Malware Protection plan resource. Use this API only when you no longer want to protect the resource associated with this Malware Protection plan ID."]
module DeleteInvitationsResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of objects that contain the unprocessed account and a result string that explains why it was unprocessed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs."]
module DeleteInvitationsRequest =
  struct
    type nonrec t =
      {
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account IDs of the Amazon Web Services accounts that sent invitations to the current member account that you want to delete invitations from."]}
    let context_ = "DeleteInvitationsRequest"
    let make ~accountIds = fun () -> { accountIds }
    let to_value x =
      structure_to_value
        [("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      make ~accountIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      make ~accountIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs."]
module DeleteIPSetResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface."]
module DeleteIPSetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector associated with the IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      ipSetId: String_.t [@ocaml.doc "The unique ID of the IPSet to delete."]}
    let context_ = "DeleteIPSetRequest"
    let make ~detectorId = fun ~ipSetId -> fun () -> { detectorId; ipSetId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("IpSetId", (Some (String_.to_value x.ipSetId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ipSetId =
        String_.of_xml (Xml.child_exn ~context:context_ xml_arg0 "IpSetId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~ipSetId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ipSetId = field_map_exn json__ "IpSetId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~ipSetId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface."]
module DeleteFilterResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Deletes the filter specified by the filter name."]
module DeleteFilterRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that is associated with the filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      filterName: String_.t
        [@ocaml.doc "The name of the filter that you want to delete."]}
    let context_ = "DeleteFilterRequest"
    let make ~detectorId =
      fun ~filterName -> fun () -> { detectorId; filterName }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("FilterName", (Some (String_.to_value x.filterName)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let filterName =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "FilterName") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~filterName ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let filterName = field_map_exn json__ "FilterName" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~filterName ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc "Deletes the filter specified by the filter name."]
module DeleteDetectorResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes an Amazon GuardDuty detector that is specified by the detector ID."]
module DeleteDetectorRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector that you want to delete. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."]}
    let context_ = "DeleteDetectorRequest"
    let make ~detectorId = fun () -> { detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Deletes an Amazon GuardDuty detector that is specified by the detector ID."]
module DeclineInvitationsResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of objects that contain the unprocessed account and a result string that explains why it was unprocessed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Declines invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs."]
module DeclineInvitationsRequest =
  struct
    type nonrec t =
      {
      accountIds: AccountIds.t
        [@ocaml.doc
          "A list of account IDs of the Amazon Web Services accounts that sent invitations to the current member account that you want to decline invitations from."]}
    let context_ = "DeclineInvitationsRequest"
    let make ~accountIds = fun () -> { accountIds }
    let to_value x =
      structure_to_value
        [("accountIds", (Some (AccountIds.to_value x.accountIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountIds =
        AccountIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountIds") in
      make ~accountIds ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountIds = field_map_exn json__ "AccountIds" AccountIds.of_json in
      make ~accountIds ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Declines invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs."]
module CreateTrustedEntitySetResponse =
  struct
    type nonrec t =
      {
      trustedEntitySetId: String_.t option
        [@ocaml.doc
          "The ID returned by GuardDuty after creation of the trusted entity set resource."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?trustedEntitySetId = fun () -> { trustedEntitySetId }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("trustedEntitySetId",
           (Option.map x.trustedEntitySetId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let trustedEntitySetId =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "trustedEntitySetId") in
      make ?trustedEntitySetId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let trustedEntitySetId =
        field_map json__ "TrustedEntitySetId" String_.of_json in
      make ?trustedEntitySetId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new trusted entity set. In the trusted entity set, you can provide IP addresses and domains that you believe are secure for communication in your Amazon Web Services environment. GuardDuty will not generate findings for the entries that are specified in a trusted entity set. At any given time, you can have only one trusted entity set. Only users of the administrator account can manage the entity sets, which automatically apply to member accounts."]
module CreateTrustedEntitySetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account for which you want to create a trusted entity set. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      name: Name.t
        [@ocaml.doc
          "A user-friendly name to identify the trusted entity set. The name of your list can include lowercase letters, uppercase letters, numbers, dash (-), and underscore (_)."];
      format: TrustedEntitySetFormat.t
        [@ocaml.doc
          "The format of the file that contains the trusted entity set."];
      location: Location.t
        [@ocaml.doc
          "The URI of the file that contains the threat entity set. The format of the Location URL must be a valid Amazon S3 URL format. Invalid URL formats will result in an error, regardless of whether you activate the entity set or not. For more information about format of the location URLs, see Format of location URL under Step 2: Adding trusted or threat intelligence data in the Amazon GuardDuty User Guide."];
      expectedBucketOwner: ExpectedBucketOwner.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."];
      activate: Boolean.t
        [@ocaml.doc
          "A boolean value that indicates whether GuardDuty is to start using the uploaded trusted entity set."];
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the create request."];
      tags: TagMap.t option
        [@ocaml.doc
          "The tags to be added to a new trusted entity set resource."]}
    let context_ = "CreateTrustedEntitySetRequest"
    let make ?expectedBucketOwner =
      fun ?clientToken ->
        fun ?tags ->
          fun ~detectorId ->
            fun ~name ->
              fun ~format ->
                fun ~location ->
                  fun ~activate ->
                    fun () ->
                      {
                        expectedBucketOwner;
                        clientToken;
                        tags;
                        detectorId;
                        name;
                        format;
                        location;
                        activate
                      }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("name", (Some (Name.to_value x.name)));
        ("format", (Some (TrustedEntitySetFormat.to_value x.format)));
        ("location", (Some (Location.to_value x.location)));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:ExpectedBucketOwner.to_value));
        ("activate", (Some (Boolean.to_value x.activate)));
        ("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      let activate =
        Boolean.of_xml (Xml.child_exn ~context:context_ xml_arg0 "activate") in
      let expectedBucketOwner =
        (Option.map ~f:ExpectedBucketOwner.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let location =
        Location.of_xml (Xml.child_exn ~context:context_ xml_arg0 "location") in
      let format =
        TrustedEntitySetFormat.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "format") in
      let name =
        Name.of_xml (Xml.child_exn ~context:context_ xml_arg0 "name") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?tags ?clientToken ~activate ?expectedBucketOwner ~location
        ~format ~name ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      let activate = field_map_exn json__ "Activate" Boolean.of_json in
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" ExpectedBucketOwner.of_json in
      let location = field_map_exn json__ "Location" Location.of_json in
      let format =
        field_map_exn json__ "Format" TrustedEntitySetFormat.of_json in
      let name = field_map_exn json__ "Name" Name.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?tags ?clientToken ~activate ?expectedBucketOwner ~location
        ~format ~name ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new trusted entity set. In the trusted entity set, you can provide IP addresses and domains that you believe are secure for communication in your Amazon Web Services environment. GuardDuty will not generate findings for the entries that are specified in a trusted entity set. At any given time, you can have only one trusted entity set. Only users of the administrator account can manage the entity sets, which automatically apply to member accounts."]
module CreateThreatIntelSetResponse =
  struct
    type nonrec t =
      {
      threatIntelSetId: String_.t option
        [@ocaml.doc "The ID of the ThreatIntelSet resource."]}
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?threatIntelSetId = fun () -> { threatIntelSetId }
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("threatIntelSetId",
           (Option.map x.threatIntelSetId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatIntelSetId =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "threatIntelSetId") in
      make ?threatIntelSetId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatIntelSetId =
        field_map json__ "ThreatIntelSetId" String_.of_json in
      make ?threatIntelSetId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation."]
module CreateThreatIntelSetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account for which you want to create a threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      name: Name.t
        [@ocaml.doc
          "A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet."];
      format: ThreatIntelSetFormat.t
        [@ocaml.doc
          "The format of the file that contains the ThreatIntelSet."];
      location: Location.t
        [@ocaml.doc "The URI of the file that contains the ThreatIntelSet."];
      activate: Boolean.t
        [@ocaml.doc
          "A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet."];
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the create request."];
      tags: TagMap.t option
        [@ocaml.doc "The tags to be added to a new threat list resource."];
      expectedBucketOwner: AccountId.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."]}
    let context_ = "CreateThreatIntelSetRequest"
    let make ?clientToken =
      fun ?tags ->
        fun ?expectedBucketOwner ->
          fun ~detectorId ->
            fun ~name ->
              fun ~format ->
                fun ~location ->
                  fun ~activate ->
                    fun () ->
                      {
                        clientToken;
                        tags;
                        expectedBucketOwner;
                        detectorId;
                        name;
                        format;
                        location;
                        activate
                      }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("name", (Some (Name.to_value x.name)));
        ("format", (Some (ThreatIntelSetFormat.to_value x.format)));
        ("location", (Some (Location.to_value x.location)));
        ("activate", (Some (Boolean.to_value x.activate)));
        ("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:AccountId.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let expectedBucketOwner =
        (Option.map ~f:AccountId.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      let activate =
        Boolean.of_xml (Xml.child_exn ~context:context_ xml_arg0 "activate") in
      let location =
        Location.of_xml (Xml.child_exn ~context:context_ xml_arg0 "location") in
      let format =
        ThreatIntelSetFormat.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "format") in
      let name =
        Name.of_xml (Xml.child_exn ~context:context_ xml_arg0 "name") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?expectedBucketOwner ?tags ?clientToken ~activate ~location
        ~format ~name ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" AccountId.of_json in
      let tags = field_map json__ "Tags" TagMap.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      let activate = field_map_exn json__ "Activate" Boolean.of_json in
      let location = field_map_exn json__ "Location" Location.of_json in
      let format = field_map_exn json__ "Format" ThreatIntelSetFormat.of_json in
      let name = field_map_exn json__ "Name" Name.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?expectedBucketOwner ?tags ?clientToken ~activate ~location
        ~format ~name ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation."]
module CreateThreatEntitySetResponse =
  struct
    type nonrec t =
      {
      threatEntitySetId: String_.t option
        [@ocaml.doc
          "The ID returned by GuardDuty after creation of the threat entity set resource."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?threatEntitySetId = fun () -> { threatEntitySetId }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("threatEntitySetId",
           (Option.map x.threatEntitySetId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let threatEntitySetId =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "threatEntitySetId") in
      make ?threatEntitySetId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let threatEntitySetId =
        field_map json__ "ThreatEntitySetId" String_.of_json in
      make ?threatEntitySetId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new threat entity set. In a threat entity set, you can provide known malicious IP addresses and domains for your Amazon Web Services environment. GuardDuty generates findings based on the entries in the threat entity sets. Only users of the administrator account can manage entity sets, which automatically apply to member accounts."]
module CreateThreatEntitySetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account for which you want to create a threat entity set. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      name: Name.t
        [@ocaml.doc
          "A user-friendly name to identify the threat entity set. The name of your list can include lowercase letters, uppercase letters, numbers, dash (-), and underscore (_)."];
      format: ThreatEntitySetFormat.t
        [@ocaml.doc
          "The format of the file that contains the threat entity set."];
      location: Location.t
        [@ocaml.doc
          "The URI of the file that contains the threat entity set. The format of the Location URL must be a valid Amazon S3 URL format. Invalid URL formats will result in an error, regardless of whether you activate the entity set or not. For more information about format of the location URLs, see Format of location URL under Step 2: Adding trusted or threat intelligence data in the Amazon GuardDuty User Guide."];
      expectedBucketOwner: ExpectedBucketOwner.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."];
      activate: Boolean.t
        [@ocaml.doc
          "A boolean value that indicates whether GuardDuty should start using the uploaded threat entity set to generate findings."];
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the create request."];
      tags: TagMap.t option
        [@ocaml.doc
          "The tags to be added to a new threat entity set resource."]}
    let context_ = "CreateThreatEntitySetRequest"
    let make ?expectedBucketOwner =
      fun ?clientToken ->
        fun ?tags ->
          fun ~detectorId ->
            fun ~name ->
              fun ~format ->
                fun ~location ->
                  fun ~activate ->
                    fun () ->
                      {
                        expectedBucketOwner;
                        clientToken;
                        tags;
                        detectorId;
                        name;
                        format;
                        location;
                        activate
                      }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("name", (Some (Name.to_value x.name)));
        ("format", (Some (ThreatEntitySetFormat.to_value x.format)));
        ("location", (Some (Location.to_value x.location)));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:ExpectedBucketOwner.to_value));
        ("activate", (Some (Boolean.to_value x.activate)));
        ("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      let activate =
        Boolean.of_xml (Xml.child_exn ~context:context_ xml_arg0 "activate") in
      let expectedBucketOwner =
        (Option.map ~f:ExpectedBucketOwner.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let location =
        Location.of_xml (Xml.child_exn ~context:context_ xml_arg0 "location") in
      let format =
        ThreatEntitySetFormat.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "format") in
      let name =
        Name.of_xml (Xml.child_exn ~context:context_ xml_arg0 "name") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?tags ?clientToken ~activate ?expectedBucketOwner ~location
        ~format ~name ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      let activate = field_map_exn json__ "Activate" Boolean.of_json in
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" ExpectedBucketOwner.of_json in
      let location = field_map_exn json__ "Location" Location.of_json in
      let format =
        field_map_exn json__ "Format" ThreatEntitySetFormat.of_json in
      let name = field_map_exn json__ "Name" Name.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?tags ?clientToken ~activate ?expectedBucketOwner ~location
        ~format ~name ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new threat entity set. In a threat entity set, you can provide known malicious IP addresses and domains for your Amazon Web Services environment. GuardDuty generates findings based on the entries in the threat entity sets. Only users of the administrator account can manage entity sets, which automatically apply to member accounts."]
module CreateSampleFindingsResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types."]
module CreateSampleFindingsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector for which you need to create sample findings. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      findingTypes: FindingTypes.t option
        [@ocaml.doc "The types of sample findings to generate."]}
    let context_ = "CreateSampleFindingsRequest"
    let make ?findingTypes =
      fun ~detectorId -> fun () -> { findingTypes; detectorId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("findingTypes",
          (Option.map x.findingTypes ~f:FindingTypes.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let findingTypes =
        (Option.map ~f:FindingTypes.of_xml)
          (Xml.child xml_arg0 "findingTypes") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?findingTypes ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let findingTypes = field_map json__ "FindingTypes" FindingTypes.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?findingTypes ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types."]
module CreatePublishingDestinationResponse =
  struct
    type nonrec t =
      {
      destinationId: String_.t option
        [@ocaml.doc "The ID of the publishing destination that is created."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?destinationId = fun () -> { destinationId }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("destinationId", (Option.map x.destinationId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let destinationId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "destinationId") in
      make ?destinationId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let destinationId = field_map json__ "DestinationId" String_.of_json in
      make ?destinationId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist."]
module CreatePublishingDestinationRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the GuardDuty detector associated with the publishing destination. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      destinationType: DestinationType.t
        [@ocaml.doc
          "The type of resource for the publishing destination. Currently only Amazon S3 buckets are supported."];
      destinationProperties: DestinationProperties.t
        [@ocaml.doc
          "The properties of the publishing destination, including the ARNs for the destination and the KMS key used for encryption."];
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the request."];
      tags: TagMap.t option
        [@ocaml.doc
          "The tags to be added to a new publishing destination resource."]}
    let context_ = "CreatePublishingDestinationRequest"
    let make ?clientToken =
      fun ?tags ->
        fun ~detectorId ->
          fun ~destinationType ->
            fun ~destinationProperties ->
              fun () ->
                {
                  clientToken;
                  tags;
                  detectorId;
                  destinationType;
                  destinationProperties
                }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("destinationType",
          (Some (DestinationType.to_value x.destinationType)));
        ("destinationProperties",
          (Some (DestinationProperties.to_value x.destinationProperties)));
        ("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      let destinationProperties =
        DestinationProperties.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "destinationProperties") in
      let destinationType =
        DestinationType.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "destinationType") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?tags ?clientToken ~destinationProperties ~destinationType
        ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      let destinationProperties =
        field_map_exn json__ "DestinationProperties"
          DestinationProperties.of_json in
      let destinationType =
        field_map_exn json__ "DestinationType" DestinationType.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?tags ?clientToken ~destinationProperties ~destinationType
        ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist."]
module CreateMembersResponse =
  struct
    type nonrec t =
      {
      unprocessedAccounts: UnprocessedAccounts.t option
        [@ocaml.doc
          "A list of objects that include the accountIds of the unprocessed accounts and a result string that explains why each was unprocessed."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?unprocessedAccounts = fun () -> { unprocessedAccounts }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("unprocessedAccounts",
           (Option.map x.unprocessedAccounts ~f:UnprocessedAccounts.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedAccounts =
        (Option.map ~f:UnprocessedAccounts.of_xml)
          (Xml.child xml_arg0 "unprocessedAccounts") in
      make ?unprocessedAccounts ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedAccounts =
        field_map json__ "UnprocessedAccounts" UnprocessedAccounts.of_json in
      make ?unprocessedAccounts ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates member accounts of the current Amazon Web Services account by specifying a list of Amazon Web Services account IDs. This step is a prerequisite for managing the associated member accounts either by invitation or through an organization. As a delegated administrator, using CreateMembers will enable GuardDuty in the added member accounts, with the exception of the organization delegated administrator account. A delegated administrator must enable GuardDuty prior to being added as a member. When you use CreateMembers as an Organizations delegated administrator, GuardDuty applies your organization's auto-enable settings to the member accounts in this request, irrespective of the accounts being new or existing members. For more information about the existing auto-enable settings for your organization, see DescribeOrganizationConfiguration. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API."]
module CreateMembersRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account for which you want to associate member accounts. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      accountDetails: AccountDetails.t
        [@ocaml.doc
          "A list of account ID and email address pairs of the accounts that you want to associate with the GuardDuty administrator account."]}
    let context_ = "CreateMembersRequest"
    let make ~detectorId =
      fun ~accountDetails -> fun () -> { detectorId; accountDetails }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("accountDetails", (Some (AccountDetails.to_value x.accountDetails)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let accountDetails =
        AccountDetails.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "accountDetails") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~accountDetails ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let accountDetails =
        field_map_exn json__ "AccountDetails" AccountDetails.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~accountDetails ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates member accounts of the current Amazon Web Services account by specifying a list of Amazon Web Services account IDs. This step is a prerequisite for managing the associated member accounts either by invitation or through an organization. As a delegated administrator, using CreateMembers will enable GuardDuty in the added member accounts, with the exception of the organization delegated administrator account. A delegated administrator must enable GuardDuty prior to being added as a member. When you use CreateMembers as an Organizations delegated administrator, GuardDuty applies your organization's auto-enable settings to the member accounts in this request, irrespective of the accounts being new or existing members. For more information about the existing auto-enable settings for your organization, see DescribeOrganizationConfiguration. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API."]
module CreateMalwareProtectionPlanResponse =
  struct
    type nonrec t =
      {
      malwareProtectionPlanId: String_.t option
        [@ocaml.doc
          "A unique identifier associated with the Malware Protection plan resource."]}
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `ConflictException of ConflictException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?malwareProtectionPlanId = fun () -> { malwareProtectionPlanId }
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "ConflictException" ->
          `ConflictException (ConflictException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "ConflictException" ->
          `ConflictException (ConflictException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `ConflictException e ->
          `Assoc
            [("error", (`String "ConflictException"));
            ("details", (ConflictException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("malwareProtectionPlanId",
           (Option.map x.malwareProtectionPlanId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let malwareProtectionPlanId =
        (Option.map ~f:String_.of_xml)
          (Xml.child xml_arg0 "malwareProtectionPlanId") in
      make ?malwareProtectionPlanId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let malwareProtectionPlanId =
        field_map json__ "MalwareProtectionPlanId" String_.of_json in
      make ?malwareProtectionPlanId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new Malware Protection plan for the protected resource. When you create a Malware Protection plan, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection."]
module CreateMalwareProtectionPlanRequest =
  struct
    type nonrec t =
      {
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the create request."];
      role: String_.t
        [@ocaml.doc
          "Amazon Resource Name (ARN) of the IAM role that has the permissions to scan and add tags to the associated protected resource."];
      protectedResource: CreateProtectedResource.t
        [@ocaml.doc
          "Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource."];
      actions: MalwareProtectionPlanActions.t option
        [@ocaml.doc
          "Information about whether the tags will be added to the S3 object after scanning."];
      tags: TagMap.t option
        [@ocaml.doc "Tags added to the Malware Protection plan resource."]}
    let context_ = "CreateMalwareProtectionPlanRequest"
    let make ?clientToken =
      fun ?actions ->
        fun ?tags ->
          fun ~role ->
            fun ~protectedResource ->
              fun () ->
                { clientToken; actions; tags; role; protectedResource }
    let to_value x =
      structure_to_value
        [("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("role", (Some (String_.to_value x.role)));
        ("protectedResource",
          (Some (CreateProtectedResource.to_value x.protectedResource)));
        ("actions",
          (Option.map x.actions ~f:MalwareProtectionPlanActions.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let actions =
        (Option.map ~f:MalwareProtectionPlanActions.of_xml)
          (Xml.child xml_arg0 "actions") in
      let protectedResource =
        CreateProtectedResource.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "protectedResource") in
      let role =
        String_.of_xml (Xml.child_exn ~context:context_ xml_arg0 "role") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      make ?tags ?actions ~protectedResource ~role ?clientToken ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in
      let actions =
        field_map json__ "Actions" MalwareProtectionPlanActions.of_json in
      let protectedResource =
        field_map_exn json__ "ProtectedResource"
          CreateProtectedResource.of_json in
      let role = field_map_exn json__ "Role" String_.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      make ?tags ?actions ~protectedResource ~role ?clientToken ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new Malware Protection plan for the protected resource. When you create a Malware Protection plan, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection."]
module CreateIPSetResponse =
  struct
    type nonrec t =
      {
      ipSetId: String_.t option [@ocaml.doc "The ID of the IPSet resource."]}
    type nonrec error =
      [ `AccessDeniedException of AccessDeniedException.t 
      | `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?ipSetId = fun () -> { ipSetId }
    let error_of_json name json =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_json json)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "AccessDeniedException" ->
          `AccessDeniedException (AccessDeniedException.of_xml xml)
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `AccessDeniedException e ->
          `Assoc
            [("error", (`String "AccessDeniedException"));
            ("details", (AccessDeniedException.to_json e))]
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("ipSetId", (Option.map x.ipSetId ~f:String_.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let ipSetId =
        (Option.map ~f:String_.of_xml) (Xml.child xml_arg0 "ipSetId") in
      make ?ipSetId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let ipSetId = field_map json__ "IpSetId" String_.of_json in
      make ?ipSetId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation."]
module CreateIPSetRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty account for which you want to create an IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      name: Name.t
        [@ocaml.doc
          "The user-friendly name to identify the IPSet. Allowed characters are alphanumeric, whitespace, dash (-), and underscores (_)."];
      format: IpSetFormat.t
        [@ocaml.doc "The format of the file that contains the IPSet."];
      location: Location.t
        [@ocaml.doc "The URI of the file that contains the IPSet."];
      activate: Boolean.t
        [@ocaml.doc
          "A Boolean value that indicates whether GuardDuty is to start using the uploaded IPSet."];
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the create request."];
      tags: TagMap.t option
        [@ocaml.doc "The tags to be added to a new IP set resource."];
      expectedBucketOwner: AccountId.t option
        [@ocaml.doc
          "The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter."]}
    let context_ = "CreateIPSetRequest"
    let make ?clientToken =
      fun ?tags ->
        fun ?expectedBucketOwner ->
          fun ~detectorId ->
            fun ~name ->
              fun ~format ->
                fun ~location ->
                  fun ~activate ->
                    fun () ->
                      {
                        clientToken;
                        tags;
                        expectedBucketOwner;
                        detectorId;
                        name;
                        format;
                        location;
                        activate
                      }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("name", (Some (Name.to_value x.name)));
        ("format", (Some (IpSetFormat.to_value x.format)));
        ("location", (Some (Location.to_value x.location)));
        ("activate", (Some (Boolean.to_value x.activate)));
        ("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value));
        ("expectedBucketOwner",
          (Option.map x.expectedBucketOwner ~f:AccountId.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let expectedBucketOwner =
        (Option.map ~f:AccountId.of_xml)
          (Xml.child xml_arg0 "expectedBucketOwner") in
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      let activate =
        Boolean.of_xml (Xml.child_exn ~context:context_ xml_arg0 "activate") in
      let location =
        Location.of_xml (Xml.child_exn ~context:context_ xml_arg0 "location") in
      let format =
        IpSetFormat.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "format") in
      let name =
        Name.of_xml (Xml.child_exn ~context:context_ xml_arg0 "name") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?expectedBucketOwner ?tags ?clientToken ~activate ~location
        ~format ~name ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let expectedBucketOwner =
        field_map json__ "ExpectedBucketOwner" AccountId.of_json in
      let tags = field_map json__ "Tags" TagMap.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      let activate = field_map_exn json__ "Activate" Boolean.of_json in
      let location = field_map_exn json__ "Location" Location.of_json in
      let format = field_map_exn json__ "Format" IpSetFormat.of_json in
      let name = field_map_exn json__ "Name" Name.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?expectedBucketOwner ?tags ?clientToken ~activate ~location
        ~format ~name ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation."]
module CreateFilterResponse =
  struct
    type nonrec t =
      {
      name: FilterName.t option
        [@ocaml.doc "The name of the successfully created filter."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?name = fun () -> { name }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("name", (Option.map x.name ~f:FilterName.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let name =
        (Option.map ~f:FilterName.of_xml) (Xml.child xml_arg0 "name") in
      make ?name ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let name = field_map json__ "Name" FilterName.of_json in make ?name ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty."]
module CreateFilterRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The detector ID associated with the GuardDuty account for which you want to create a filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      name: FilterName.t
        [@ocaml.doc
          "The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character."];
      description: FilterDescription.t option
        [@ocaml.doc
          "The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses (\\{ \\}, \\[ \\], and ( )), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace."];
      action: FilterAction.t option
        [@ocaml.doc
          "Specifies the action that is to be applied to the findings that match the filter. Default: NOOP"];
      rank: FilterRank.t option
        [@ocaml.doc
          "Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings."];
      findingCriteria: FindingCriteria.t
        [@ocaml.doc
          "Represents the criteria to be used in the filter for querying findings. The following fields are available for filtering: accountId arn associatedAttackSequenceArn confidence createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 description id partition region resource.accessKeyDetails.accessKeyId resource.accessKeyDetails.principalId resource.accessKeyDetails.userIdentity.accessKeyId resource.accessKeyDetails.userIdentity.accountId resource.accessKeyDetails.userIdentity.arn resource.accessKeyDetails.userIdentity.principalId resource.accessKeyDetails.userIdentity.sessionContext.attributes.mfaAuthenticated resource.accessKeyDetails.userIdentity.sessionContext.ec2RoleDelivery resource.accessKeyDetails.userIdentity.sessionContext.invokedBy resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.accountId resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.arn resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.principalId resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.type resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.userName resource.accessKeyDetails.userIdentity.sessionContext.sourceIdentity resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.attributes resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.federatedProvider resource.accessKeyDetails.userIdentity.type resource.accessKeyDetails.userIdentity.userName resource.accessKeyDetails.userName resource.accessKeyDetails.userType resource.bedrockGuardrailDetails.guardrailArn resource.bedrockGuardrailDetails.guardrailVersion resource.containerDetails.containerRuntime resource.containerDetails.id resource.containerDetails.image resource.containerDetails.imagePrefix resource.containerDetails.name resource.containerDetails.securityContext.allowPrivilegeEscalation resource.containerDetails.securityContext.privileged resource.containerDetails.volumeMounts.mountPath resource.containerDetails.volumeMounts.name resource.ebsSnapshotDetails.snapshotArn resource.ebsVolumeDetails.scannedVolumeDetails.deviceName resource.ebsVolumeDetails.scannedVolumeDetails.encryptionType resource.ebsVolumeDetails.scannedVolumeDetails.kmsKeyArn resource.ebsVolumeDetails.scannedVolumeDetails.snapshotArn resource.ebsVolumeDetails.scannedVolumeDetails.volumeArn resource.ebsVolumeDetails.scannedVolumeDetails.volumeSizeInGB resource.ebsVolumeDetails.scannedVolumeDetails.volumeType resource.ebsVolumeDetails.skippedVolumeDetails.deviceName resource.ebsVolumeDetails.skippedVolumeDetails.encryptionType resource.ebsVolumeDetails.skippedVolumeDetails.kmsKeyArn resource.ebsVolumeDetails.skippedVolumeDetails.snapshotArn resource.ebsVolumeDetails.skippedVolumeDetails.volumeArn resource.ebsVolumeDetails.skippedVolumeDetails.volumeSizeInGB resource.ebsVolumeDetails.skippedVolumeDetails.volumeType resource.ec2ImageDetails.imageArn resource.ecsClusterDetails.activeServicesCount resource.ecsClusterDetails.arn resource.ecsClusterDetails.name resource.ecsClusterDetails.registeredContainerInstancesCount resource.ecsClusterDetails.runningTasksCount resource.ecsClusterDetails.status resource.ecsClusterDetails.tags.key resource.ecsClusterDetails.tags.value resource.ecsClusterDetails.taskDetails.arn resource.ecsClusterDetails.taskDetails.containers.containerRuntime resource.ecsClusterDetails.taskDetails.containers.id resource.ecsClusterDetails.taskDetails.containers.image resource.ecsClusterDetails.taskDetails.containers.imagePrefix resource.ecsClusterDetails.taskDetails.containers.name resource.ecsClusterDetails.taskDetails.containers.securityContext.allowPrivilegeEscalation resource.ecsClusterDetails.taskDetails.containers.securityContext.privileged resource.ecsClusterDetails.taskDetails.containers.volumeMounts.mountPath resource.ecsClusterDetails.taskDetails.containers.volumeMounts.name resource.ecsClusterDetails.taskDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.ecsClusterDetails.taskDetails.definitionArn resource.ecsClusterDetails.taskDetails.group resource.ecsClusterDetails.taskDetails.launchType resource.ecsClusterDetails.taskDetails.startedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.ecsClusterDetails.taskDetails.startedBy resource.ecsClusterDetails.taskDetails.tags.key resource.ecsClusterDetails.taskDetails.tags.value resource.ecsClusterDetails.taskDetails.version resource.ecsClusterDetails.taskDetails.volumes.hostPath.path resource.ecsClusterDetails.taskDetails.volumes.name resource.eksClusterDetails.arn resource.eksClusterDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.eksClusterDetails.name resource.eksClusterDetails.status resource.eksClusterDetails.tags.key resource.eksClusterDetails.tags.value resource.eksClusterDetails.vpcId resource.instanceDetails.availabilityZone resource.instanceDetails.iamInstanceProfile.arn resource.instanceDetails.iamInstanceProfile.id resource.instanceDetails.imageDescription resource.instanceDetails.imageId resource.instanceDetails.instanceId resource.instanceDetails.instanceState resource.instanceDetails.instanceType resource.instanceDetails.launchTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.instanceDetails.networkInterfaces.ipv6Addresses resource.instanceDetails.networkInterfaces.networkInterfaceId resource.instanceDetails.networkInterfaces.privateDnsName resource.instanceDetails.networkInterfaces.privateIpAddress resource.instanceDetails.networkInterfaces.privateIpAddresses.privateDnsName resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress resource.instanceDetails.networkInterfaces.publicDnsName resource.instanceDetails.networkInterfaces.publicIp resource.instanceDetails.networkInterfaces.securityGroups.groupId resource.instanceDetails.networkInterfaces.securityGroups.groupName resource.instanceDetails.networkInterfaces.subnetId resource.instanceDetails.networkInterfaces.vpcId resource.instanceDetails.outpostArn resource.instanceDetails.platform resource.instanceDetails.productCodes.productCodeId resource.instanceDetails.productCodes.productCodeType resource.instanceDetails.tags.key resource.instanceDetails.tags.value resource.kubernetesDetails.kubernetesUserDetails.groups resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.groups resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.username resource.kubernetesDetails.kubernetesUserDetails.sessionName resource.kubernetesDetails.kubernetesUserDetails.uid resource.kubernetesDetails.kubernetesUserDetails.username resource.kubernetesDetails.kubernetesWorkloadDetails.containers.containerRuntime resource.kubernetesDetails.kubernetesWorkloadDetails.containers.id resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix resource.kubernetesDetails.kubernetesWorkloadDetails.containers.name resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.allowPrivilegeEscalation resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.privileged resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.mountPath resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.name resource.kubernetesDetails.kubernetesWorkloadDetails.hostIpc resource.kubernetesDetails.kubernetesWorkloadDetails.hostNetwork resource.kubernetesDetails.kubernetesWorkloadDetails.hostPid resource.kubernetesDetails.kubernetesWorkloadDetails.name resource.kubernetesDetails.kubernetesWorkloadDetails.namespace resource.kubernetesDetails.kubernetesWorkloadDetails.serviceAccountName resource.kubernetesDetails.kubernetesWorkloadDetails.type resource.kubernetesDetails.kubernetesWorkloadDetails.uid resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.hostPath.path resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.name resource.lambdaDetails.description resource.lambdaDetails.functionArn resource.lambdaDetails.functionName resource.lambdaDetails.functionVersion resource.lambdaDetails.lastModifiedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.lambdaDetails.revisionId resource.lambdaDetails.role resource.lambdaDetails.tags.key resource.lambdaDetails.tags.value resource.lambdaDetails.vpcConfig.securityGroups.groupId resource.lambdaDetails.vpcConfig.securityGroups.groupName resource.lambdaDetails.vpcConfig.subnetIds resource.lambdaDetails.vpcConfig.vpcId resource.rdsDbInstanceDetails.dbClusterIdentifier resource.rdsDbInstanceDetails.dbInstanceArn resource.rdsDbInstanceDetails.dbInstanceIdentifier resource.rdsDbInstanceDetails.dbSecurityGroups.name resource.rdsDbInstanceDetails.dbSecurityGroups.status resource.rdsDbInstanceDetails.dbiResourceId resource.rdsDbInstanceDetails.engine resource.rdsDbInstanceDetails.engineVersion resource.rdsDbInstanceDetails.iamDatabaseAuthenticationEnabled resource.rdsDbInstanceDetails.publiclyAccessible resource.rdsDbInstanceDetails.tags.key resource.rdsDbInstanceDetails.tags.value resource.rdsDbInstanceDetails.vpcId resource.rdsDbInstanceDetails.vpcSecurityGroups.status resource.rdsDbInstanceDetails.vpcSecurityGroups.vpcSecurityGroupId resource.rdsDbUserDetails.application resource.rdsDbUserDetails.authMethod resource.rdsDbUserDetails.database resource.rdsDbUserDetails.ssl resource.rdsDbUserDetails.user resource.rdsLimitlessDbDetails.dbClusterIdentifier resource.rdsLimitlessDbDetails.dbShardGroupArn resource.rdsLimitlessDbDetails.dbShardGroupIdentifier resource.rdsLimitlessDbDetails.dbShardGroupResourceId resource.rdsLimitlessDbDetails.engine resource.rdsLimitlessDbDetails.engineVersion resource.rdsLimitlessDbDetails.tags.key resource.rdsLimitlessDbDetails.tags.value resource.recoveryPointDetails.backupVaultName resource.recoveryPointDetails.recoveryPointArn resource.resourceType resource.s3BucketDetails.arn resource.s3BucketDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.s3BucketDetails.defaultServerSideEncryption.encryptionType resource.s3BucketDetails.defaultServerSideEncryption.kmsMasterKeyArn resource.s3BucketDetails.name resource.s3BucketDetails.owner.id resource.s3BucketDetails.publicAccess.effectivePermission resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.blockPublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.blockPublicPolicy resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.ignorePublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.restrictPublicBuckets resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.accessControlList.allowsPublicReadAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.accessControlList.allowsPublicWriteAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.blockPublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.blockPublicPolicy resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.ignorePublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.restrictPublicBuckets resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicReadAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicWriteAccess resource.s3BucketDetails.s3ObjectDetails.eTag resource.s3BucketDetails.s3ObjectDetails.hash resource.s3BucketDetails.s3ObjectDetails.key resource.s3BucketDetails.s3ObjectDetails.objectArn resource.s3BucketDetails.s3ObjectDetails.versionId resource.s3BucketDetails.tags.key resource.s3BucketDetails.tags.value resource.s3BucketDetails.type schemaVersion service.action.actionType service.action.awsApiCallAction.affectedResources service.action.awsApiCallAction.api service.action.awsApiCallAction.callerType service.action.awsApiCallAction.domainDetails.domain service.action.awsApiCallAction.errorCode service.action.awsApiCallAction.remoteAccountDetails.accountId service.action.awsApiCallAction.remoteAccountDetails.affiliated service.action.awsApiCallAction.remoteAccountDetails.awsServiceName service.action.awsApiCallAction.remoteIpDetails.city.cityName service.action.awsApiCallAction.remoteIpDetails.country.countryCode service.action.awsApiCallAction.remoteIpDetails.country.countryName service.action.awsApiCallAction.remoteIpDetails.geoLocation.lat service.action.awsApiCallAction.remoteIpDetails.geoLocation.lon service.action.awsApiCallAction.remoteIpDetails.ipAddressV4 service.action.awsApiCallAction.remoteIpDetails.ipAddressV6 service.action.awsApiCallAction.remoteIpDetails.organization.asn service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg service.action.awsApiCallAction.remoteIpDetails.organization.isp service.action.awsApiCallAction.remoteIpDetails.organization.org service.action.awsApiCallAction.serviceName service.action.awsApiCallAction.userAgent service.action.dnsRequestAction.blocked service.action.dnsRequestAction.domain service.action.dnsRequestAction.domainWithSuffix service.action.dnsRequestAction.protocol service.action.dnsRequestAction.vpcOwnerAccountId service.action.kubernetesApiCallAction.namespace service.action.kubernetesApiCallAction.parameters service.action.kubernetesApiCallAction.remoteIpDetails.city.cityName service.action.kubernetesApiCallAction.remoteIpDetails.country.countryCode service.action.kubernetesApiCallAction.remoteIpDetails.country.countryName service.action.kubernetesApiCallAction.remoteIpDetails.geoLocation.lat service.action.kubernetesApiCallAction.remoteIpDetails.geoLocation.lon service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4 service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6 service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn service.action.kubernetesApiCallAction.remoteIpDetails.organization.asnOrg service.action.kubernetesApiCallAction.remoteIpDetails.organization.isp service.action.kubernetesApiCallAction.remoteIpDetails.organization.org service.action.kubernetesApiCallAction.requestUri service.action.kubernetesApiCallAction.resource service.action.kubernetesApiCallAction.resourceName service.action.kubernetesApiCallAction.sourceIPs service.action.kubernetesApiCallAction.statusCode service.action.kubernetesApiCallAction.subresource service.action.kubernetesApiCallAction.userAgent service.action.kubernetesApiCallAction.verb service.action.kubernetesPermissionCheckedDetails.allowed service.action.kubernetesPermissionCheckedDetails.namespace service.action.kubernetesPermissionCheckedDetails.resource service.action.kubernetesPermissionCheckedDetails.verb service.action.kubernetesRoleBindingDetails.kind service.action.kubernetesRoleBindingDetails.name service.action.kubernetesRoleBindingDetails.roleRefKind service.action.kubernetesRoleBindingDetails.roleRefName service.action.kubernetesRoleBindingDetails.uid service.action.kubernetesRoleDetails.kind service.action.kubernetesRoleDetails.name service.action.kubernetesRoleDetails.uid service.action.networkConnectionAction.blocked service.action.networkConnectionAction.connectionDirection service.action.networkConnectionAction.localIpDetails.ipAddressV4 service.action.networkConnectionAction.localIpDetails.ipAddressV6 service.action.networkConnectionAction.localNetworkInterface service.action.networkConnectionAction.localPortDetails.port service.action.networkConnectionAction.localPortDetails.portName service.action.networkConnectionAction.protocol service.action.networkConnectionAction.remoteIpDetails.city.cityName service.action.networkConnectionAction.remoteIpDetails.country.countryCode service.action.networkConnectionAction.remoteIpDetails.country.countryName service.action.networkConnectionAction.remoteIpDetails.geoLocation.lat service.action.networkConnectionAction.remoteIpDetails.geoLocation.lon service.action.networkConnectionAction.remoteIpDetails.ipAddressV4 service.action.networkConnectionAction.remoteIpDetails.ipAddressV6 service.action.networkConnectionAction.remoteIpDetails.organization.asn service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg service.action.networkConnectionAction.remoteIpDetails.organization.isp service.action.networkConnectionAction.remoteIpDetails.organization.org service.action.networkConnectionAction.remotePortDetails.port service.action.networkConnectionAction.remotePortDetails.portName service.action.portProbeAction.blocked service.action.portProbeAction.portProbeDetails.localIpDetails.ipAddressV4 service.action.portProbeAction.portProbeDetails.localIpDetails.ipAddressV6 service.action.portProbeAction.portProbeDetails.localPortDetails.port service.action.portProbeAction.portProbeDetails.localPortDetails.portName service.action.portProbeAction.portProbeDetails.remoteIpDetails.city.cityName service.action.portProbeAction.portProbeDetails.remoteIpDetails.country.countryCode service.action.portProbeAction.portProbeDetails.remoteIpDetails.country.countryName service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lat service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lon service.action.portProbeAction.portProbeDetails.remoteIpDetails.ipAddressV4 service.action.portProbeAction.portProbeDetails.remoteIpDetails.ipAddressV6 service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.asn service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.asnOrg service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.isp service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.org service.action.rdsLoginAttemptAction.loginAttributes.application service.action.rdsLoginAttemptAction.loginAttributes.failedLoginAttempts service.action.rdsLoginAttemptAction.loginAttributes.successfulLoginAttempts service.action.rdsLoginAttemptAction.loginAttributes.user service.action.rdsLoginAttemptAction.remoteIpDetails.city.cityName service.action.rdsLoginAttemptAction.remoteIpDetails.country.countryCode service.action.rdsLoginAttemptAction.remoteIpDetails.country.countryName service.action.rdsLoginAttemptAction.remoteIpDetails.geoLocation.lat service.action.rdsLoginAttemptAction.remoteIpDetails.geoLocation.lon service.action.rdsLoginAttemptAction.remoteIpDetails.ipAddressV4 service.action.rdsLoginAttemptAction.remoteIpDetails.ipAddressV6 service.action.rdsLoginAttemptAction.remoteIpDetails.organization.asn service.action.rdsLoginAttemptAction.remoteIpDetails.organization.asnOrg service.action.rdsLoginAttemptAction.remoteIpDetails.organization.isp service.action.rdsLoginAttemptAction.remoteIpDetails.organization.org service.additionalInfo.agentDetails.agentId service.additionalInfo.agentDetails.agentVersion service.additionalInfo.anomalies.anomalousAPIs service.additionalInfo.authenticationMethod service.additionalInfo.averagePacketSizeIn service.additionalInfo.averagePacketSizeOut service.additionalInfo.context service.additionalInfo.domain service.additionalInfo.inBytes service.additionalInfo.localNetworkInterfaceOwner service.additionalInfo.localPort service.additionalInfo.outBytes service.additionalInfo.packetsIn service.additionalInfo.packetsOut service.additionalInfo.policyArn service.additionalInfo.policyName service.additionalInfo.remotePort service.additionalInfo.sample service.additionalInfo.scannedPort service.additionalInfo.threatFileSha256 service.additionalInfo.threatListName service.additionalInfo.threatName service.additionalInfo.totalBytesIn service.additionalInfo.totalBytesOut service.additionalInfo.type service.additionalInfo.unusual.asnOrg service.additionalInfo.unusual.port service.additionalInfo.unusualProtocol service.additionalInfo.userAgent.fullUserAgent service.additionalInfo.userAgent.userAgentCategory service.additionalInfo.value service.additionalInfo.vpcOwnerAccountId service.archived service.count service.detection.anomaly.profiles service.detection.anomaly.unusual.behavior service.detection.sequence.actors.id service.detection.sequence.actors.process.name service.detection.sequence.actors.process.path service.detection.sequence.actors.process.sha256 service.detection.sequence.actors.session.createdTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.actors.session.issuer service.detection.sequence.actors.session.mfaStatus service.detection.sequence.actors.session.uid service.detection.sequence.actors.user.account.account service.detection.sequence.actors.user.account.uid service.detection.sequence.actors.user.credentialUid service.detection.sequence.actors.user.name service.detection.sequence.actors.user.type service.detection.sequence.actors.user.uid service.detection.sequence.additionalSequenceTypes service.detection.sequence.description service.detection.sequence.endpoints.autonomousSystem.name service.detection.sequence.endpoints.autonomousSystem.number service.detection.sequence.endpoints.connection.direction service.detection.sequence.endpoints.domain service.detection.sequence.endpoints.id service.detection.sequence.endpoints.ip service.detection.sequence.endpoints.location.city service.detection.sequence.endpoints.location.country service.detection.sequence.endpoints.location.lat service.detection.sequence.endpoints.location.lon service.detection.sequence.endpoints.port service.detection.sequence.resources.accountId service.detection.sequence.resources.cloudPartition service.detection.sequence.resources.data.accessKey.principalId service.detection.sequence.resources.data.accessKey.userName service.detection.sequence.resources.data.accessKey.userType service.detection.sequence.resources.data.autoscalingAutoScalingGroup.ec2InstanceUids service.detection.sequence.resources.data.cloudformationStack.ec2InstanceUids service.detection.sequence.resources.data.container.image service.detection.sequence.resources.data.container.imageUid service.detection.sequence.resources.data.ec2Image.ec2InstanceUids service.detection.sequence.resources.data.ec2Instance.availabilityZone service.detection.sequence.resources.data.ec2Instance.ec2NetworkInterfaceUids service.detection.sequence.resources.data.ec2Instance.iamInstanceProfile.arn service.detection.sequence.resources.data.ec2Instance.iamInstanceProfile.id service.detection.sequence.resources.data.ec2Instance.imageDescription service.detection.sequence.resources.data.ec2Instance.instanceState service.detection.sequence.resources.data.ec2Instance.instanceType service.detection.sequence.resources.data.ec2Instance.outpostArn service.detection.sequence.resources.data.ec2Instance.platform service.detection.sequence.resources.data.ec2Instance.productCodes.productCodeId service.detection.sequence.resources.data.ec2Instance.productCodes.productCodeType service.detection.sequence.resources.data.ec2LaunchTemplate.ec2InstanceUids service.detection.sequence.resources.data.ec2LaunchTemplate.version service.detection.sequence.resources.data.ec2NetworkInterface.ipv6Addresses service.detection.sequence.resources.data.ec2NetworkInterface.privateIpAddresses.privateDnsName service.detection.sequence.resources.data.ec2NetworkInterface.privateIpAddresses.privateIpAddress service.detection.sequence.resources.data.ec2NetworkInterface.publicIp service.detection.sequence.resources.data.ec2NetworkInterface.securityGroups.groupId service.detection.sequence.resources.data.ec2NetworkInterface.securityGroups.groupName service.detection.sequence.resources.data.ec2NetworkInterface.subNetId service.detection.sequence.resources.data.ec2NetworkInterface.vpcId service.detection.sequence.resources.data.ec2Vpc.ec2InstanceUids service.detection.sequence.resources.data.ecsCluster.ec2InstanceUids service.detection.sequence.resources.data.ecsCluster.status service.detection.sequence.resources.data.ecsTask.containerUids service.detection.sequence.resources.data.ecsTask.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.ecsTask.launchType service.detection.sequence.resources.data.ecsTask.taskDefinitionArn service.detection.sequence.resources.data.eksCluster.arn service.detection.sequence.resources.data.eksCluster.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.eksCluster.ec2InstanceUids service.detection.sequence.resources.data.eksCluster.status service.detection.sequence.resources.data.eksCluster.vpcId service.detection.sequence.resources.data.iamInstanceProfile.ec2InstanceUids service.detection.sequence.resources.data.iamInstanceProfile.id service.detection.sequence.resources.data.kubernetesWorkload.containerUids service.detection.sequence.resources.data.kubernetesWorkload.namespace service.detection.sequence.resources.data.kubernetesWorkload.type service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicAclAccess service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicAclIgnoreBehavior service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicBucketRestrictBehavior service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicPolicyAccess service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicAclAccess service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicAclIgnoreBehavior service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicBucketRestrictBehavior service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicPolicyAccess service.detection.sequence.resources.data.s3Bucket.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.s3Bucket.effectivePermission service.detection.sequence.resources.data.s3Bucket.encryptionKeyArn service.detection.sequence.resources.data.s3Bucket.encryptionType service.detection.sequence.resources.data.s3Bucket.ownerId service.detection.sequence.resources.data.s3Bucket.publicReadAccess service.detection.sequence.resources.data.s3Bucket.publicWriteAccess service.detection.sequence.resources.data.s3Bucket.s3ObjectUids service.detection.sequence.resources.data.s3Object.eTag service.detection.sequence.resources.data.s3Object.key service.detection.sequence.resources.data.s3Object.versionId service.detection.sequence.resources.name service.detection.sequence.resources.region service.detection.sequence.resources.resourceType service.detection.sequence.resources.service service.detection.sequence.resources.tags.key service.detection.sequence.resources.tags.value service.detection.sequence.resources.uid service.detection.sequence.sequenceIndicators.key service.detection.sequence.sequenceIndicators.title service.detection.sequence.sequenceIndicators.values service.detection.sequence.signals.actorIds service.detection.sequence.signals.count service.detection.sequence.signals.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.description service.detection.sequence.signals.endpointIds service.detection.sequence.signals.firstSeenAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.lastSeenAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.name service.detection.sequence.signals.resourceUids service.detection.sequence.signals.severity service.detection.sequence.signals.signalIndicators.key service.detection.sequence.signals.signalIndicators.title service.detection.sequence.signals.signalIndicators.values service.detection.sequence.signals.type service.detection.sequence.signals.uid service.detection.sequence.signals.updatedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.uid service.detectorId service.ebsVolumeScanDetails.scanCompletedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.count service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.severity service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.threatName service.ebsVolumeScanDetails.scanDetections.scannedItemCount.files service.ebsVolumeScanDetails.scanDetections.scannedItemCount.totalGb service.ebsVolumeScanDetails.scanDetections.scannedItemCount.volumes service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.itemCount service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.shortened service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.fileName service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.filePath service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.volumeArn service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.itemCount service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.uniqueThreatNameCount service.ebsVolumeScanDetails.scanDetections.threatsDetectedItemCount.files service.ebsVolumeScanDetails.scanId service.ebsVolumeScanDetails.scanStartedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.ebsVolumeScanDetails.scanType service.ebsVolumeScanDetails.sources service.ebsVolumeScanDetails.triggerFindingId service.eventFirstSeen Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.eventLastSeen Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.evidence.threatIntelligenceDetails.threatFileSha256 service.evidence.threatIntelligenceDetails.threatListName service.evidence.threatIntelligenceDetails.threatNames service.featureName service.malwareScanDetails.scanCategory service.malwareScanDetails.scanConfiguration.incrementalScanDetails.baselineResourceArn service.malwareScanDetails.scanConfiguration.triggerType service.malwareScanDetails.scanId service.malwareScanDetails.scanType service.malwareScanDetails.threats.count service.malwareScanDetails.threats.hash service.malwareScanDetails.threats.itemDetails.additionalInfo.deviceName service.malwareScanDetails.threats.itemDetails.additionalInfo.versionId service.malwareScanDetails.threats.itemDetails.hash service.malwareScanDetails.threats.itemDetails.itemPath service.malwareScanDetails.threats.itemDetails.resourceArn service.malwareScanDetails.threats.itemPaths.hash service.malwareScanDetails.threats.itemPaths.nestedItemPath service.malwareScanDetails.threats.name service.malwareScanDetails.threats.source service.malwareScanDetails.uniqueThreatCount service.resourceRole service.runtimeDetails.context.addressFamily service.runtimeDetails.context.commandLineExample service.runtimeDetails.context.fileOperation service.runtimeDetails.context.filePath service.runtimeDetails.context.fileSystemType service.runtimeDetails.context.flags service.runtimeDetails.context.ianaProtocolNumber service.runtimeDetails.context.ldPreloadValue service.runtimeDetails.context.libraryPath service.runtimeDetails.context.memoryRegions service.runtimeDetails.context.modifiedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.euid service.runtimeDetails.context.modifyingProcess.executablePath service.runtimeDetails.context.modifyingProcess.executableSha256 service.runtimeDetails.context.modifyingProcess.lineage.euid service.runtimeDetails.context.modifyingProcess.lineage.executablePath service.runtimeDetails.context.modifyingProcess.lineage.name service.runtimeDetails.context.modifyingProcess.lineage.namespacePid service.runtimeDetails.context.modifyingProcess.lineage.parentUuid service.runtimeDetails.context.modifyingProcess.lineage.pid service.runtimeDetails.context.modifyingProcess.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.lineage.userId service.runtimeDetails.context.modifyingProcess.lineage.uuid service.runtimeDetails.context.modifyingProcess.name service.runtimeDetails.context.modifyingProcess.namespacePid service.runtimeDetails.context.modifyingProcess.parentUuid service.runtimeDetails.context.modifyingProcess.pid service.runtimeDetails.context.modifyingProcess.pwd service.runtimeDetails.context.modifyingProcess.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.user service.runtimeDetails.context.modifyingProcess.userId service.runtimeDetails.context.modifyingProcess.uuid service.runtimeDetails.context.moduleFilePath service.runtimeDetails.context.moduleName service.runtimeDetails.context.moduleSha256 service.runtimeDetails.context.mountSource service.runtimeDetails.context.mountTarget service.runtimeDetails.context.relatedFilePaths service.runtimeDetails.context.releaseAgentPath service.runtimeDetails.context.runcBinaryPath service.runtimeDetails.context.scriptPath service.runtimeDetails.context.serviceName service.runtimeDetails.context.shellHistoryFilePath service.runtimeDetails.context.socketPath service.runtimeDetails.context.targetProcess.euid service.runtimeDetails.context.targetProcess.executablePath service.runtimeDetails.context.targetProcess.executableSha256 service.runtimeDetails.context.targetProcess.lineage.euid service.runtimeDetails.context.targetProcess.lineage.executablePath service.runtimeDetails.context.targetProcess.lineage.name service.runtimeDetails.context.targetProcess.lineage.namespacePid service.runtimeDetails.context.targetProcess.lineage.parentUuid service.runtimeDetails.context.targetProcess.lineage.pid service.runtimeDetails.context.targetProcess.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.targetProcess.lineage.userId service.runtimeDetails.context.targetProcess.lineage.uuid service.runtimeDetails.context.targetProcess.name service.runtimeDetails.context.targetProcess.namespacePid service.runtimeDetails.context.targetProcess.parentUuid service.runtimeDetails.context.targetProcess.pid service.runtimeDetails.context.targetProcess.pwd service.runtimeDetails.context.targetProcess.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.targetProcess.user service.runtimeDetails.context.targetProcess.userId service.runtimeDetails.context.targetProcess.uuid service.runtimeDetails.context.threatFilePath service.runtimeDetails.context.toolCategory service.runtimeDetails.context.toolName service.runtimeDetails.process.euid service.runtimeDetails.process.executablePath service.runtimeDetails.process.executableSha256 service.runtimeDetails.process.lineage.euid service.runtimeDetails.process.lineage.executablePath service.runtimeDetails.process.lineage.name service.runtimeDetails.process.lineage.namespacePid service.runtimeDetails.process.lineage.parentUuid service.runtimeDetails.process.lineage.pid service.runtimeDetails.process.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.process.lineage.userId service.runtimeDetails.process.lineage.uuid service.runtimeDetails.process.name service.runtimeDetails.process.namespacePid service.runtimeDetails.process.parentUuid service.runtimeDetails.process.pid service.runtimeDetails.process.pwd service.runtimeDetails.process.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.process.user service.runtimeDetails.process.userId service.runtimeDetails.process.uuid service.serviceName service.userFeedback severity To configure severity based filters, use the following for the FindingCriteria condition: Low: \\[\"1\", \"2\", \"3\"\\] Medium: \\[\"4\", \"5\", \"6\"\\] High: \\[\"7\", \"8\"\\] Critical: \\[\"9\", \"10\"\\] For more information, see Findings severity levels in the Amazon GuardDuty User Guide. title type updatedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000"];
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the create request."];
      tags: TagMap.t option
        [@ocaml.doc "The tags to be added to a new filter resource."]}
    let context_ = "CreateFilterRequest"
    let make ?description =
      fun ?action ->
        fun ?rank ->
          fun ?clientToken ->
            fun ?tags ->
              fun ~detectorId ->
                fun ~name ->
                  fun ~findingCriteria ->
                    fun () ->
                      {
                        description;
                        action;
                        rank;
                        clientToken;
                        tags;
                        detectorId;
                        name;
                        findingCriteria
                      }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("name", (Some (FilterName.to_value x.name)));
        ("description",
          (Option.map x.description ~f:FilterDescription.to_value));
        ("action", (Option.map x.action ~f:FilterAction.to_value));
        ("rank", (Option.map x.rank ~f:FilterRank.to_value));
        ("findingCriteria",
          (Some (FindingCriteria.to_value x.findingCriteria)));
        ("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      let findingCriteria =
        FindingCriteria.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "findingCriteria") in
      let rank =
        (Option.map ~f:FilterRank.of_xml) (Xml.child xml_arg0 "rank") in
      let action =
        (Option.map ~f:FilterAction.of_xml) (Xml.child xml_arg0 "action") in
      let description =
        (Option.map ~f:FilterDescription.of_xml)
          (Xml.child xml_arg0 "description") in
      let name =
        FilterName.of_xml (Xml.child_exn ~context:context_ xml_arg0 "name") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ?tags ?clientToken ~findingCriteria ?rank ?action ?description
        ~name ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let tags = field_map json__ "Tags" TagMap.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      let findingCriteria =
        field_map_exn json__ "FindingCriteria" FindingCriteria.of_json in
      let rank = field_map json__ "Rank" FilterRank.of_json in
      let action = field_map json__ "Action" FilterAction.of_json in
      let description =
        field_map json__ "Description" FilterDescription.of_json in
      let name = field_map_exn json__ "Name" FilterName.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ?tags ?clientToken ~findingCriteria ?rank ?action ?description
        ~name ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty."]
module CreateDetectorResponse =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t option
        [@ocaml.doc "The unique ID of the created detector."];
      unprocessedDataSources: UnprocessedDataSourcesResult.t option
        [@ocaml.doc
          "Specifies the data sources that couldn't be enabled when GuardDuty was enabled for the first time."]}
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make ?detectorId =
      fun ?unprocessedDataSources ->
        fun () -> { detectorId; unprocessedDataSources }
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let to_value x =
      structure_to_value
        [("detectorId", (Option.map x.detectorId ~f:DetectorId.to_value));
        ("unprocessedDataSources",
          (Option.map x.unprocessedDataSources
             ~f:UnprocessedDataSourcesResult.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let unprocessedDataSources =
        (Option.map ~f:UnprocessedDataSourcesResult.of_xml)
          (Xml.child xml_arg0 "unprocessedDataSources") in
      let detectorId =
        (Option.map ~f:DetectorId.of_xml) (Xml.child xml_arg0 "detectorId") in
      make ?unprocessedDataSources ?detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let unprocessedDataSources =
        field_map json__ "UnprocessedDataSources"
          UnprocessedDataSourcesResult.of_json in
      let detectorId = field_map json__ "DetectorId" DetectorId.of_json in
      make ?unprocessedDataSources ?detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a single GuardDuty detector. A detector is a resource that represents the GuardDuty service. To start using GuardDuty, you must create a detector in each Region where you enable the service. You can have only one detector per account per Region. All data sources are enabled in a new detector by default. When you don't specify any features, with an exception to RUNTIME_MONITORING, all the optional features are enabled by default. When you specify some of the features, any feature that is not specified in the API call gets enabled by default, with an exception to RUNTIME_MONITORING. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module CreateDetectorRequest =
  struct
    type nonrec t =
      {
      enable: Boolean.t
        [@ocaml.doc
          "A Boolean value that specifies whether the detector is to be enabled."];
      clientToken: ClientToken.t option
        [@ocaml.doc "The idempotency token for the create request."];
      findingPublishingFrequency: FindingPublishingFrequency.t option
        [@ocaml.doc
          "A value that specifies how frequently updated findings are exported."];
      dataSources: DataSourceConfigurations.t option
        [@ocaml.doc
          "Describes which data sources will be enabled for the detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."];
      tags: TagMap.t option
        [@ocaml.doc "The tags to be added to a new detector resource."];
      features: DetectorFeatureConfigurations.t option
        [@ocaml.doc
          "A list of features that will be configured for the detector."]}
    let context_ = "CreateDetectorRequest"
    let make ?clientToken =
      fun ?findingPublishingFrequency ->
        fun ?dataSources ->
          fun ?tags ->
            fun ?features ->
              fun ~enable ->
                fun () ->
                  {
                    clientToken;
                    findingPublishingFrequency;
                    dataSources;
                    tags;
                    features;
                    enable
                  }
    let to_value x =
      structure_to_value
        [("enable", (Some (Boolean.to_value x.enable)));
        ("clientToken", (Option.map x.clientToken ~f:ClientToken.to_value));
        ("findingPublishingFrequency",
          (Option.map x.findingPublishingFrequency
             ~f:FindingPublishingFrequency.to_value));
        ("dataSources",
          (Option.map x.dataSources ~f:DataSourceConfigurations.to_value));
        ("tags", (Option.map x.tags ~f:TagMap.to_value));
        ("features",
          (Option.map x.features ~f:DetectorFeatureConfigurations.to_value))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let features =
        (Option.map ~f:DetectorFeatureConfigurations.of_xml)
          (Xml.child xml_arg0 "features") in
      let tags = (Option.map ~f:TagMap.of_xml) (Xml.child xml_arg0 "tags") in
      let dataSources =
        (Option.map ~f:DataSourceConfigurations.of_xml)
          (Xml.child xml_arg0 "dataSources") in
      let findingPublishingFrequency =
        (Option.map ~f:FindingPublishingFrequency.of_xml)
          (Xml.child xml_arg0 "findingPublishingFrequency") in
      let clientToken =
        (Option.map ~f:ClientToken.of_xml) (Xml.child xml_arg0 "clientToken") in
      let enable =
        Boolean.of_xml (Xml.child_exn ~context:context_ xml_arg0 "enable") in
      make ?features ?tags ?dataSources ?findingPublishingFrequency
        ?clientToken ~enable ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let features =
        field_map json__ "Features" DetectorFeatureConfigurations.of_json in
      let tags = field_map json__ "Tags" TagMap.of_json in
      let dataSources =
        field_map json__ "DataSources" DataSourceConfigurations.of_json in
      let findingPublishingFrequency =
        field_map json__ "FindingPublishingFrequency"
          FindingPublishingFrequency.of_json in
      let clientToken = field_map json__ "ClientToken" ClientToken.of_json in
      let enable = field_map_exn json__ "Enable" Boolean.of_json in
      make ?features ?tags ?dataSources ?findingPublishingFrequency
        ?clientToken ~enable ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Creates a single GuardDuty detector. A detector is a resource that represents the GuardDuty service. To start using GuardDuty, you must create a detector in each Region where you enable the service. You can have only one detector per account per Region. All data sources are enabled in a new detector by default. When you don't specify any features, with an exception to RUNTIME_MONITORING, all the optional features are enabled by default. When you specify some of the features, any feature that is not specified in the API call gets enabled by default, with an exception to RUNTIME_MONITORING. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints."]
module ArchiveFindingsResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Archives GuardDuty findings that are specified by the list of finding IDs. Only the administrator account can archive findings. Member accounts don't have permission to archive findings from their accounts."]
module ArchiveFindingsRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The ID of the detector that specifies the GuardDuty service whose findings you want to archive. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      findingIds: FindingIds.t
        [@ocaml.doc "The IDs of the findings that you want to archive."]}
    let context_ = "ArchiveFindingsRequest"
    let make ~detectorId =
      fun ~findingIds -> fun () -> { detectorId; findingIds }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("findingIds", (Some (FindingIds.to_value x.findingIds)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let findingIds =
        FindingIds.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "findingIds") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~findingIds ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let findingIds = field_map_exn json__ "FindingIds" FindingIds.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~findingIds ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Archives GuardDuty findings that are specified by the list of finding IDs. Only the administrator account can archive findings. Member accounts don't have permission to archive findings from their accounts."]
module AcceptInvitationResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Accepts the invitation to be monitored by a GuardDuty administrator account."]
module AcceptInvitationRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty member account. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API."];
      masterId: String_.t
        [@ocaml.doc
          "The account ID of the GuardDuty administrator account whose invitation you're accepting."];
      invitationId: String_.t
        [@ocaml.doc
          "The value that is used to validate the administrator account to the member account."]}
    let context_ = "AcceptInvitationRequest"
    let make ~detectorId =
      fun ~masterId ->
        fun ~invitationId -> fun () -> { detectorId; masterId; invitationId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("masterId", (Some (String_.to_value x.masterId)));
        ("invitationId", (Some (String_.to_value x.invitationId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let invitationId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "invitationId") in
      let masterId =
        String_.of_xml (Xml.child_exn ~context:context_ xml_arg0 "masterId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~invitationId ~masterId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let invitationId = field_map_exn json__ "InvitationId" String_.of_json in
      let masterId = field_map_exn json__ "MasterId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~invitationId ~masterId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Accepts the invitation to be monitored by a GuardDuty administrator account."]
module AcceptAdministratorInvitationResponse =
  struct
    type nonrec t = unit
    type nonrec error =
      [ `BadRequestException of BadRequestException.t 
      | `InternalServerErrorException of InternalServerErrorException.t 
      | `Unknown_operation_error of (string * string option) ]
    let make () = ()
    let error_of_json name json =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_json json)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_json json)
      | name ->
          `Unknown_operation_error
            (name, (Some (Yojson.Safe.to_string json)))
    let error_of_xml name xml =
      match name with
      | "BadRequestException" ->
          `BadRequestException (BadRequestException.of_xml xml)
      | "InternalServerErrorException" ->
          `InternalServerErrorException
            (InternalServerErrorException.of_xml xml)
      | name ->
          `Unknown_operation_error (name, (Some (Awso.Xml.to_string xml)))
    let error_to_json : error -> Yojson.Safe.t =
      function
      | `BadRequestException e ->
          `Assoc
            [("error", (`String "BadRequestException"));
            ("details", (BadRequestException.to_json e))]
      | `InternalServerErrorException e ->
          `Assoc
            [("error", (`String "InternalServerErrorException"));
            ("details", (InternalServerErrorException.to_json e))]
      | `Unknown_operation_error (code, msg) ->
          `Assoc (("error", (`String code)) ::
            ((match msg with
              | None -> []
              | Some m -> [("message", (`String m))])))
    let of_header_and_body = ((fun (xs, pipe) -> make ())[@warning "-27"])
    let to_value _ = `Structure []
    let to_query v = to_query to_value v
    let of_xml _ = make ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json _ = make ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Accepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation."]
module AcceptAdministratorInvitationRequest =
  struct
    type nonrec t =
      {
      detectorId: DetectorId.t
        [@ocaml.doc
          "The unique ID of the detector of the GuardDuty member account."];
      administratorId: String_.t
        [@ocaml.doc
          "The account ID of the GuardDuty administrator account whose invitation you're accepting."];
      invitationId: String_.t
        [@ocaml.doc
          "The value that is used to validate the administrator account to the member account."]}
    let context_ = "AcceptAdministratorInvitationRequest"
    let make ~detectorId =
      fun ~administratorId ->
        fun ~invitationId ->
          fun () -> { detectorId; administratorId; invitationId }
    let to_value x =
      structure_to_value
        [("DetectorId", (Some (DetectorId.to_value x.detectorId)));
        ("administratorId", (Some (String_.to_value x.administratorId)));
        ("invitationId", (Some (String_.to_value x.invitationId)))]
    let to_query v = to_query to_value v
    let of_xml xml_arg0 =
      let invitationId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "invitationId") in
      let administratorId =
        String_.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "administratorId") in
      let detectorId =
        DetectorId.of_xml
          (Xml.child_exn ~context:context_ xml_arg0 "DetectorId") in
      make ~invitationId ~administratorId ~detectorId ()
    let of_string s = of_xml (Awso.Xml.parse_response s)[@@warning "-32"]
    let of_json json__ =
      let invitationId = field_map_exn json__ "InvitationId" String_.of_json in
      let administratorId =
        field_map_exn json__ "AdministratorId" String_.of_json in
      let detectorId = field_map_exn json__ "DetectorId" DetectorId.of_json in
      make ~invitationId ~administratorId ~detectorId ()
    let to_json v = composed_to_json to_value v
  end[@@ocaml.doc
       "Accepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation."]