diff --git a/LICENSE b/LICENSE
new file mode 100644
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,367 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
diff --git a/README.md b/README.md
new file mode 100644
--- /dev/null
+++ b/README.md
@@ -0,0 +1,52 @@
+# Amazon Certificate Manager SDK
+
+* [Version](#version)
+* [Description](#description)
+* [Contribute](#contribute)
+* [Licence](#licence)
+
+
+## Version
+
+`1.4.0`
+
+
+## Description
+
+AWS Certificate Manager
+
+Welcome to the AWS Certificate Manager (ACM) Command Reference. This
+guide provides descriptions, syntax, and usage examples for each ACM
+command. You can use AWS Certificate Manager to request ACM Certificates
+for your AWS-based websites and applications. For general information
+about using ACM and for more information about using the console, see
+the
+<http://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html AWS Certificate Manager User Guide>.
+For more information about using the ACM API, see the
+<http://docs.aws.amazon.com/acm/latest/APIReference/Welcome.html AWS Certificate Manager API Reference>.
+
+Documentation is available via [Hackage](http://hackage.haskell.org/package/amazonka-certificatemanager)
+and the [AWS API Reference](https://aws.amazon.com/documentation/).
+
+The types from this library are intended to be used with [amazonka](http://hackage.haskell.org/package/amazonka),
+which provides mechanisms for specifying AuthN/AuthZ information and sending requests.
+
+Use of lenses is required for constructing and manipulating types.
+This is due to the amount of nesting of AWS types and transparency regarding
+de/serialisation into more palatable Haskell values.
+The provided lenses should be compatible with any of the major lens libraries
+[lens](http://hackage.haskell.org/package/lens) or [lens-family-core](http://hackage.haskell.org/package/lens-family-core).
+
+## Contribute
+
+For any problems, comments, or feedback please create an issue [here on GitHub](https://github.com/brendanhay/amazonka/issues).
+
+> _Note:_ this library is an auto-generated Haskell package. Please see `amazonka-gen` for more information.
+
+
+## Licence
+
+`amazonka-certificatemanager` is released under the [Mozilla Public License Version 2.0](http://www.mozilla.org/MPL/).
+
+Parts of the code are derived from AWS service descriptions, licensed under Apache 2.0.
+Source files subject to this contain an additional licensing clause in their header.
diff --git a/Setup.hs b/Setup.hs
new file mode 100644
--- /dev/null
+++ b/Setup.hs
@@ -0,0 +1,2 @@
+import           Distribution.Simple
+main = defaultMain
diff --git a/amazonka-certificatemanager.cabal b/amazonka-certificatemanager.cabal
new file mode 100644
--- /dev/null
+++ b/amazonka-certificatemanager.cabal
@@ -0,0 +1,97 @@
+name:                  amazonka-certificatemanager
+version:               1.4.0
+synopsis:              Amazon Certificate Manager SDK.
+homepage:              https://github.com/brendanhay/amazonka
+bug-reports:           https://github.com/brendanhay/amazonka/issues
+license:               OtherLicense
+license-file:          LICENSE
+author:                Brendan Hay
+maintainer:            Brendan Hay <brendan.g.hay@gmail.com>
+copyright:             Copyright (c) 2013-2016 Brendan Hay
+category:              Network, AWS, Cloud, Distributed Computing
+build-type:            Simple
+cabal-version:         >= 1.10
+extra-source-files:    README.md fixture/*.yaml fixture/*.proto
+description:
+    AWS Certificate Manager
+
+    Welcome to the AWS Certificate Manager (ACM) Command Reference. This
+    guide provides descriptions, syntax, and usage examples for each ACM
+    command. You can use AWS Certificate Manager to request ACM Certificates
+    for your AWS-based websites and applications. For general information
+    about using ACM and for more information about using the console, see
+    the
+    <http://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html AWS Certificate Manager User Guide>.
+    For more information about using the ACM API, see the
+    <http://docs.aws.amazon.com/acm/latest/APIReference/Welcome.html AWS Certificate Manager API Reference>.
+    .
+    The types from this library are intended to be used with
+    <http://hackage.haskell.org/package/amazonka amazonka>, which provides
+    mechanisms for specifying AuthN/AuthZ information and sending requests.
+    .
+    Use of lenses is required for constructing and manipulating types.
+    This is due to the amount of nesting of AWS types and transparency regarding
+    de/serialisation into more palatable Haskell values.
+    The provided lenses should be compatible with any of the major lens libraries
+    such as <http://hackage.haskell.org/package/lens lens> or
+    <http://hackage.haskell.org/package/lens-family-core lens-family-core>.
+    .
+    See "Network.AWS.CertificateManager" or <https://aws.amazon.com/documentation/ the AWS Documentation>
+    to get started.
+
+source-repository head
+    type:     git
+    location: git://github.com/brendanhay/amazonka.git
+
+library
+    default-language:  Haskell2010
+    hs-source-dirs:    src gen
+
+    ghc-options:       -Wall
+
+    exposed-modules:
+          Network.AWS.CertificateManager
+        , Network.AWS.CertificateManager.DeleteCertificate
+        , Network.AWS.CertificateManager.DescribeCertificate
+        , Network.AWS.CertificateManager.GetCertificate
+        , Network.AWS.CertificateManager.ListCertificates
+        , Network.AWS.CertificateManager.RequestCertificate
+        , Network.AWS.CertificateManager.ResendValidationEmail
+        , Network.AWS.CertificateManager.Types
+        , Network.AWS.CertificateManager.Waiters
+
+    other-modules:
+          Network.AWS.CertificateManager.Types.Product
+        , Network.AWS.CertificateManager.Types.Sum
+
+    build-depends:
+          amazonka-core == 1.4.0.*
+        , base          >= 4.7     && < 5
+
+test-suite amazonka-certificatemanager-test
+    type:              exitcode-stdio-1.0
+    default-language:  Haskell2010
+    hs-source-dirs:    test
+    main-is:           Main.hs
+
+    ghc-options:       -Wall -threaded
+
+    -- This section is encoded by the template and any modules added by
+    -- hand outside these namespaces will not correctly be added to the
+    -- distribution package.
+    other-modules:
+          Test.AWS.CertificateManager
+        , Test.AWS.Gen.CertificateManager
+        , Test.AWS.CertificateManager.Internal
+
+    build-depends:
+          amazonka-core == 1.4.0.*
+        , amazonka-test == 1.4.0.*
+        , amazonka-certificatemanager == 1.4.0.*
+        , base
+        , bytestring
+        , tasty
+        , tasty-hunit
+        , text
+        , time
+        , unordered-containers
diff --git a/fixture/DeleteCertificate.yaml b/fixture/DeleteCertificate.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/DeleteCertificate.yaml
diff --git a/fixture/DeleteCertificateResponse.proto b/fixture/DeleteCertificateResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/DeleteCertificateResponse.proto
diff --git a/fixture/DescribeCertificate.yaml b/fixture/DescribeCertificate.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/DescribeCertificate.yaml
diff --git a/fixture/DescribeCertificateResponse.proto b/fixture/DescribeCertificateResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/DescribeCertificateResponse.proto
diff --git a/fixture/GetCertificate.yaml b/fixture/GetCertificate.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/GetCertificate.yaml
diff --git a/fixture/GetCertificateResponse.proto b/fixture/GetCertificateResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/GetCertificateResponse.proto
diff --git a/fixture/ListCertificates.yaml b/fixture/ListCertificates.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/ListCertificates.yaml
diff --git a/fixture/ListCertificatesResponse.proto b/fixture/ListCertificatesResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/ListCertificatesResponse.proto
diff --git a/fixture/RequestCertificate.yaml b/fixture/RequestCertificate.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/RequestCertificate.yaml
diff --git a/fixture/RequestCertificateResponse.proto b/fixture/RequestCertificateResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/RequestCertificateResponse.proto
diff --git a/fixture/ResendValidationEmail.yaml b/fixture/ResendValidationEmail.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/ResendValidationEmail.yaml
diff --git a/fixture/ResendValidationEmailResponse.proto b/fixture/ResendValidationEmailResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/ResendValidationEmailResponse.proto
diff --git a/gen/Network/AWS/CertificateManager.hs b/gen/Network/AWS/CertificateManager.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager.hs
@@ -0,0 +1,167 @@
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- AWS Certificate Manager
+--
+-- Welcome to the AWS Certificate Manager (ACM) Command Reference. This
+-- guide provides descriptions, syntax, and usage examples for each ACM
+-- command. You can use AWS Certificate Manager to request ACM Certificates
+-- for your AWS-based websites and applications. For general information
+-- about using ACM and for more information about using the console, see
+-- the
+-- <http://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html AWS Certificate Manager User Guide>.
+-- For more information about using the ACM API, see the
+-- <http://docs.aws.amazon.com/acm/latest/APIReference/Welcome.html AWS Certificate Manager API Reference>.
+module Network.AWS.CertificateManager
+    (
+    -- * Service Configuration
+      certificateManager
+
+    -- * Errors
+    -- $errors
+
+    -- ** InvalidDomainValidationOptionsException
+    , _InvalidDomainValidationOptionsException
+
+    -- ** RequestInProgressException
+    , _RequestInProgressException
+
+    -- ** InvalidARNException
+    , _InvalidARNException
+
+    -- ** ResourceNotFoundException
+    , _ResourceNotFoundException
+
+    -- ** InvalidStateException
+    , _InvalidStateException
+
+    -- ** LimitExceededException
+    , _LimitExceededException
+
+    -- ** ResourceInUseException
+    , _ResourceInUseException
+
+    -- * Waiters
+    -- $waiters
+
+    -- * Operations
+    -- $operations
+
+    -- ** ResendValidationEmail
+    , module Network.AWS.CertificateManager.ResendValidationEmail
+
+    -- ** GetCertificate
+    , module Network.AWS.CertificateManager.GetCertificate
+
+    -- ** RequestCertificate
+    , module Network.AWS.CertificateManager.RequestCertificate
+
+    -- ** ListCertificates
+    , module Network.AWS.CertificateManager.ListCertificates
+
+    -- ** DeleteCertificate
+    , module Network.AWS.CertificateManager.DeleteCertificate
+
+    -- ** DescribeCertificate
+    , module Network.AWS.CertificateManager.DescribeCertificate
+
+    -- * Types
+
+    -- ** CertificateStatus
+    , CertificateStatus (..)
+
+    -- ** KeyAlgorithm
+    , KeyAlgorithm (..)
+
+    -- ** RevocationReason
+    , RevocationReason (..)
+
+    -- ** CertificateDetail
+    , CertificateDetail
+    , certificateDetail
+    , cdSubject
+    , cdStatus
+    , cdSubjectAlternativeNames
+    , cdInUseBy
+    , cdCreatedAt
+    , cdCertificateARN
+    , cdSerial
+    , cdRevokedAt
+    , cdNotBefore
+    , cdRevocationReason
+    , cdDomainName
+    , cdKeyAlgorithm
+    , cdIssuedAt
+    , cdSignatureAlgorithm
+    , cdDomainValidationOptions
+    , cdIssuer
+    , cdNotAfter
+
+    -- ** CertificateSummary
+    , CertificateSummary
+    , certificateSummary
+    , csCertificateARN
+    , csDomainName
+
+    -- ** DomainValidation
+    , DomainValidation
+    , domainValidation
+    , dvValidationEmails
+    , dvValidationDomain
+    , dvDomainName
+
+    -- ** DomainValidationOption
+    , DomainValidationOption
+    , domainValidationOption
+    , dvoDomainName
+    , dvoValidationDomain
+    ) where
+
+import           Network.AWS.CertificateManager.DeleteCertificate
+import           Network.AWS.CertificateManager.DescribeCertificate
+import           Network.AWS.CertificateManager.GetCertificate
+import           Network.AWS.CertificateManager.ListCertificates
+import           Network.AWS.CertificateManager.RequestCertificate
+import           Network.AWS.CertificateManager.ResendValidationEmail
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Waiters
+
+{- $errors
+Error matchers are designed for use with the functions provided by
+<http://hackage.haskell.org/package/lens/docs/Control-Exception-Lens.html Control.Exception.Lens>.
+This allows catching (and rethrowing) service specific errors returned
+by 'CertificateManager'.
+-}
+
+{- $operations
+Some AWS operations return results that are incomplete and require subsequent
+requests in order to obtain the entire result set. The process of sending
+subsequent requests to continue where a previous request left off is called
+pagination. For example, the 'ListObjects' operation of Amazon S3 returns up to
+1000 objects at a time, and you must send subsequent requests with the
+appropriate Marker in order to retrieve the next page of results.
+
+Operations that have an 'AWSPager' instance can transparently perform subsequent
+requests, correctly setting Markers and other request facets to iterate through
+the entire result set of a truncated API operation. Operations which support
+this have an additional note in the documentation.
+
+Many operations have the ability to filter results on the server side. See the
+individual operation parameters for details.
+-}
+
+{- $waiters
+Waiters poll by repeatedly sending a request until some remote success condition
+configured by the 'Wait' specification is fulfilled. The 'Wait' specification
+determines how many attempts should be made, in addition to delay and retry strategies.
+-}
diff --git a/gen/Network/AWS/CertificateManager/DeleteCertificate.hs b/gen/Network/AWS/CertificateManager/DeleteCertificate.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/DeleteCertificate.hs
@@ -0,0 +1,116 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.DeleteCertificate
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Deletes an ACM Certificate and its associated private key. If this
+-- action succeeds, the certificate no longer appears in the list of ACM
+-- Certificates that can be displayed by calling the < ListCertificates>
+-- action or be retrieved by calling the < GetCertificate> action. The
+-- certificate will not be available for use by other AWS services.
+--
+-- You cannot delete an ACM Certificate that is being used by another AWS
+-- service. To delete a certificate that is in use, the certificate
+-- association must first be removed.
+module Network.AWS.CertificateManager.DeleteCertificate
+    (
+    -- * Creating a Request
+      deleteCertificate
+    , DeleteCertificate
+    -- * Request Lenses
+    , dcCertificateARN
+
+    -- * Destructuring the Response
+    , deleteCertificateResponse
+    , DeleteCertificateResponse
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- | /See:/ 'deleteCertificate' smart constructor.
+newtype DeleteCertificate = DeleteCertificate'
+    { _dcCertificateARN :: Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DeleteCertificate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'dcCertificateARN'
+deleteCertificate
+    :: Text -- ^ 'dcCertificateARN'
+    -> DeleteCertificate
+deleteCertificate pCertificateARN_ =
+    DeleteCertificate'
+    { _dcCertificateARN = pCertificateARN_
+    }
+
+-- | String that contains the ARN of the ACM Certificate to be deleted. This
+-- must be of the form:
+--
+-- 'arn:aws:acm:region:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+--
+-- For more information about ARNs, see
+-- <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Names (ARNs) and AWS Service Namespaces>.
+dcCertificateARN :: Lens' DeleteCertificate Text
+dcCertificateARN = lens _dcCertificateARN (\ s a -> s{_dcCertificateARN = a});
+
+instance AWSRequest DeleteCertificate where
+        type Rs DeleteCertificate = DeleteCertificateResponse
+        request = postJSON certificateManager
+        response = receiveNull DeleteCertificateResponse'
+
+instance Hashable DeleteCertificate
+
+instance ToHeaders DeleteCertificate where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.DeleteCertificate" ::
+                       ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON DeleteCertificate where
+        toJSON DeleteCertificate'{..}
+          = object
+              (catMaybes
+                 [Just ("CertificateArn" .= _dcCertificateARN)])
+
+instance ToPath DeleteCertificate where
+        toPath = const "/"
+
+instance ToQuery DeleteCertificate where
+        toQuery = const mempty
+
+-- | /See:/ 'deleteCertificateResponse' smart constructor.
+data DeleteCertificateResponse =
+    DeleteCertificateResponse'
+    deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DeleteCertificateResponse' with the minimum fields required to make a request.
+--
+deleteCertificateResponse
+    :: DeleteCertificateResponse
+deleteCertificateResponse = DeleteCertificateResponse'
diff --git a/gen/Network/AWS/CertificateManager/DescribeCertificate.hs b/gen/Network/AWS/CertificateManager/DescribeCertificate.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/DescribeCertificate.hs
@@ -0,0 +1,140 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.DescribeCertificate
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Returns a list of the fields contained in the specified ACM Certificate.
+-- For example, this action returns the certificate status, a flag that
+-- indicates whether the certificate is associated with any other AWS
+-- service, and the date at which the certificate request was created. The
+-- ACM Certificate is specified on input by its Amazon Resource Name (ARN).
+module Network.AWS.CertificateManager.DescribeCertificate
+    (
+    -- * Creating a Request
+      describeCertificate
+    , DescribeCertificate
+    -- * Request Lenses
+    , dCertificateARN
+
+    -- * Destructuring the Response
+    , describeCertificateResponse
+    , DescribeCertificateResponse
+    -- * Response Lenses
+    , dcrsCertificate
+    , dcrsResponseStatus
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- | /See:/ 'describeCertificate' smart constructor.
+newtype DescribeCertificate = DescribeCertificate'
+    { _dCertificateARN :: Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DescribeCertificate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'dCertificateARN'
+describeCertificate
+    :: Text -- ^ 'dCertificateARN'
+    -> DescribeCertificate
+describeCertificate pCertificateARN_ =
+    DescribeCertificate'
+    { _dCertificateARN = pCertificateARN_
+    }
+
+-- | String that contains an ACM Certificate ARN. The ARN must be of the
+-- form:
+--
+-- 'arn:aws:acm:region:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+--
+-- For more information about ARNs, see
+-- <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Names (ARNs) and AWS Service Namespaces>.
+dCertificateARN :: Lens' DescribeCertificate Text
+dCertificateARN = lens _dCertificateARN (\ s a -> s{_dCertificateARN = a});
+
+instance AWSRequest DescribeCertificate where
+        type Rs DescribeCertificate =
+             DescribeCertificateResponse
+        request = postJSON certificateManager
+        response
+          = receiveJSON
+              (\ s h x ->
+                 DescribeCertificateResponse' <$>
+                   (x .?> "Certificate") <*> (pure (fromEnum s)))
+
+instance Hashable DescribeCertificate
+
+instance ToHeaders DescribeCertificate where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.DescribeCertificate" ::
+                       ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON DescribeCertificate where
+        toJSON DescribeCertificate'{..}
+          = object
+              (catMaybes
+                 [Just ("CertificateArn" .= _dCertificateARN)])
+
+instance ToPath DescribeCertificate where
+        toPath = const "/"
+
+instance ToQuery DescribeCertificate where
+        toQuery = const mempty
+
+-- | /See:/ 'describeCertificateResponse' smart constructor.
+data DescribeCertificateResponse = DescribeCertificateResponse'
+    { _dcrsCertificate    :: !(Maybe CertificateDetail)
+    , _dcrsResponseStatus :: !Int
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DescribeCertificateResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'dcrsCertificate'
+--
+-- * 'dcrsResponseStatus'
+describeCertificateResponse
+    :: Int -- ^ 'dcrsResponseStatus'
+    -> DescribeCertificateResponse
+describeCertificateResponse pResponseStatus_ =
+    DescribeCertificateResponse'
+    { _dcrsCertificate = Nothing
+    , _dcrsResponseStatus = pResponseStatus_
+    }
+
+-- | Contains a < CertificateDetail> structure that lists the fields of an
+-- ACM Certificate.
+dcrsCertificate :: Lens' DescribeCertificateResponse (Maybe CertificateDetail)
+dcrsCertificate = lens _dcrsCertificate (\ s a -> s{_dcrsCertificate = a});
+
+-- | The response status code.
+dcrsResponseStatus :: Lens' DescribeCertificateResponse Int
+dcrsResponseStatus = lens _dcrsResponseStatus (\ s a -> s{_dcrsResponseStatus = a});
diff --git a/gen/Network/AWS/CertificateManager/GetCertificate.hs b/gen/Network/AWS/CertificateManager/GetCertificate.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/GetCertificate.hs
@@ -0,0 +1,152 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.GetCertificate
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Retrieves an ACM Certificate and certificate chain for the certificate
+-- specified by an ARN. The chain is an ordered list of certificates that
+-- contains the root certificate, intermediate certificates of subordinate
+-- CAs, and the ACM Certificate. The certificate and certificate chain are
+-- base64 encoded. If you want to decode the certificate chain to see the
+-- individual certificate fields, you can use OpenSSL.
+--
+-- Currently, ACM Certificates can be used only with Elastic Load Balancing
+-- and Amazon CloudFront.
+module Network.AWS.CertificateManager.GetCertificate
+    (
+    -- * Creating a Request
+      getCertificate
+    , GetCertificate
+    -- * Request Lenses
+    , gcCertificateARN
+
+    -- * Destructuring the Response
+    , getCertificateResponse
+    , GetCertificateResponse
+    -- * Response Lenses
+    , gcrsCertificate
+    , gcrsCertificateChain
+    , gcrsResponseStatus
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- | /See:/ 'getCertificate' smart constructor.
+newtype GetCertificate = GetCertificate'
+    { _gcCertificateARN :: Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'GetCertificate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'gcCertificateARN'
+getCertificate
+    :: Text -- ^ 'gcCertificateARN'
+    -> GetCertificate
+getCertificate pCertificateARN_ =
+    GetCertificate'
+    { _gcCertificateARN = pCertificateARN_
+    }
+
+-- | String that contains a certificate ARN in the following format:
+--
+-- 'arn:aws:acm:region:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+--
+-- For more information about ARNs, see
+-- <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Names (ARNs) and AWS Service Namespaces>.
+gcCertificateARN :: Lens' GetCertificate Text
+gcCertificateARN = lens _gcCertificateARN (\ s a -> s{_gcCertificateARN = a});
+
+instance AWSRequest GetCertificate where
+        type Rs GetCertificate = GetCertificateResponse
+        request = postJSON certificateManager
+        response
+          = receiveJSON
+              (\ s h x ->
+                 GetCertificateResponse' <$>
+                   (x .?> "Certificate") <*> (x .?> "CertificateChain")
+                     <*> (pure (fromEnum s)))
+
+instance Hashable GetCertificate
+
+instance ToHeaders GetCertificate where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.GetCertificate" :: ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON GetCertificate where
+        toJSON GetCertificate'{..}
+          = object
+              (catMaybes
+                 [Just ("CertificateArn" .= _gcCertificateARN)])
+
+instance ToPath GetCertificate where
+        toPath = const "/"
+
+instance ToQuery GetCertificate where
+        toQuery = const mempty
+
+-- | /See:/ 'getCertificateResponse' smart constructor.
+data GetCertificateResponse = GetCertificateResponse'
+    { _gcrsCertificate      :: !(Maybe Text)
+    , _gcrsCertificateChain :: !(Maybe Text)
+    , _gcrsResponseStatus   :: !Int
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'GetCertificateResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'gcrsCertificate'
+--
+-- * 'gcrsCertificateChain'
+--
+-- * 'gcrsResponseStatus'
+getCertificateResponse
+    :: Int -- ^ 'gcrsResponseStatus'
+    -> GetCertificateResponse
+getCertificateResponse pResponseStatus_ =
+    GetCertificateResponse'
+    { _gcrsCertificate = Nothing
+    , _gcrsCertificateChain = Nothing
+    , _gcrsResponseStatus = pResponseStatus_
+    }
+
+-- | String that contains the ACM Certificate represented by the ARN
+-- specified at input.
+gcrsCertificate :: Lens' GetCertificateResponse (Maybe Text)
+gcrsCertificate = lens _gcrsCertificate (\ s a -> s{_gcrsCertificate = a});
+
+-- | The certificate chain that contains the root certificate issued by the
+-- certificate authority (CA).
+gcrsCertificateChain :: Lens' GetCertificateResponse (Maybe Text)
+gcrsCertificateChain = lens _gcrsCertificateChain (\ s a -> s{_gcrsCertificateChain = a});
+
+-- | The response status code.
+gcrsResponseStatus :: Lens' GetCertificateResponse Int
+gcrsResponseStatus = lens _gcrsResponseStatus (\ s a -> s{_gcrsResponseStatus = a});
diff --git a/gen/Network/AWS/CertificateManager/ListCertificates.hs b/gen/Network/AWS/CertificateManager/ListCertificates.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/ListCertificates.hs
@@ -0,0 +1,185 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.ListCertificates
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Retrieves a list of the ACM Certificate ARNs, and the domain name for
+-- each ARN, owned by the calling account. You can filter the list based on
+-- the 'CertificateStatuses' parameter, and you can display up to
+-- 'MaxItems' certificates at one time. If you have more than 'MaxItems'
+-- certificates, use the 'NextToken' marker from the response object in
+-- your next call to the 'ListCertificates' action to retrieve the next set
+-- of certificate ARNs.
+module Network.AWS.CertificateManager.ListCertificates
+    (
+    -- * Creating a Request
+      listCertificates
+    , ListCertificates
+    -- * Request Lenses
+    , lcCertificateStatuses
+    , lcNextToken
+    , lcMaxItems
+
+    -- * Destructuring the Response
+    , listCertificatesResponse
+    , ListCertificatesResponse
+    -- * Response Lenses
+    , lcrsCertificateSummaryList
+    , lcrsNextToken
+    , lcrsResponseStatus
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- | /See:/ 'listCertificates' smart constructor.
+data ListCertificates = ListCertificates'
+    { _lcCertificateStatuses :: !(Maybe [CertificateStatus])
+    , _lcNextToken           :: !(Maybe Text)
+    , _lcMaxItems            :: !(Maybe Nat)
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ListCertificates' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'lcCertificateStatuses'
+--
+-- * 'lcNextToken'
+--
+-- * 'lcMaxItems'
+listCertificates
+    :: ListCertificates
+listCertificates =
+    ListCertificates'
+    { _lcCertificateStatuses = Nothing
+    , _lcNextToken = Nothing
+    , _lcMaxItems = Nothing
+    }
+
+-- | Identifies the statuses of the ACM Certificates for which you want to
+-- retrieve the ARNs. This can be one or more of the following values:
+--
+-- -   'PENDING_VALIDATION'
+-- -   'ISSUED'
+-- -   'INACTIVE'
+-- -   'EXPIRED'
+-- -   'VALIDATION_TIMED_OUT'
+-- -   'REVOKED'
+-- -   'FAILED'
+lcCertificateStatuses :: Lens' ListCertificates [CertificateStatus]
+lcCertificateStatuses = lens _lcCertificateStatuses (\ s a -> s{_lcCertificateStatuses = a}) . _Default . _Coerce;
+
+-- | String that contains an opaque marker of the next ACM Certificate ARN to
+-- be displayed. Use this parameter when paginating results, and only in a
+-- subsequent request after you\'ve received a response where the results
+-- have been truncated. Set it to an empty string the first time you call
+-- this action, and set it to the value of the 'NextToken' element you
+-- receive in the response object for subsequent calls.
+lcNextToken :: Lens' ListCertificates (Maybe Text)
+lcNextToken = lens _lcNextToken (\ s a -> s{_lcNextToken = a});
+
+-- | Specify this parameter when paginating results to indicate the maximum
+-- number of ACM Certificates that you want to display for each response.
+-- If there are additional certificates beyond the maximum you specify, use
+-- the 'NextToken' value in your next call to the 'ListCertificates'
+-- action.
+lcMaxItems :: Lens' ListCertificates (Maybe Natural)
+lcMaxItems = lens _lcMaxItems (\ s a -> s{_lcMaxItems = a}) . mapping _Nat;
+
+instance AWSRequest ListCertificates where
+        type Rs ListCertificates = ListCertificatesResponse
+        request = postJSON certificateManager
+        response
+          = receiveJSON
+              (\ s h x ->
+                 ListCertificatesResponse' <$>
+                   (x .?> "CertificateSummaryList" .!@ mempty) <*>
+                     (x .?> "NextToken")
+                     <*> (pure (fromEnum s)))
+
+instance Hashable ListCertificates
+
+instance ToHeaders ListCertificates where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.ListCertificates" ::
+                       ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON ListCertificates where
+        toJSON ListCertificates'{..}
+          = object
+              (catMaybes
+                 [("CertificateStatuses" .=) <$>
+                    _lcCertificateStatuses,
+                  ("NextToken" .=) <$> _lcNextToken,
+                  ("MaxItems" .=) <$> _lcMaxItems])
+
+instance ToPath ListCertificates where
+        toPath = const "/"
+
+instance ToQuery ListCertificates where
+        toQuery = const mempty
+
+-- | /See:/ 'listCertificatesResponse' smart constructor.
+data ListCertificatesResponse = ListCertificatesResponse'
+    { _lcrsCertificateSummaryList :: !(Maybe [CertificateSummary])
+    , _lcrsNextToken              :: !(Maybe Text)
+    , _lcrsResponseStatus         :: !Int
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ListCertificatesResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'lcrsCertificateSummaryList'
+--
+-- * 'lcrsNextToken'
+--
+-- * 'lcrsResponseStatus'
+listCertificatesResponse
+    :: Int -- ^ 'lcrsResponseStatus'
+    -> ListCertificatesResponse
+listCertificatesResponse pResponseStatus_ =
+    ListCertificatesResponse'
+    { _lcrsCertificateSummaryList = Nothing
+    , _lcrsNextToken = Nothing
+    , _lcrsResponseStatus = pResponseStatus_
+    }
+
+-- | A list of the certificate ARNs.
+lcrsCertificateSummaryList :: Lens' ListCertificatesResponse [CertificateSummary]
+lcrsCertificateSummaryList = lens _lcrsCertificateSummaryList (\ s a -> s{_lcrsCertificateSummaryList = a}) . _Default . _Coerce;
+
+-- | If the list has been truncated, this value is present and should be used
+-- for the 'NextToken' input parameter on your next call to
+-- 'ListCertificates'.
+lcrsNextToken :: Lens' ListCertificatesResponse (Maybe Text)
+lcrsNextToken = lens _lcrsNextToken (\ s a -> s{_lcrsNextToken = a});
+
+-- | The response status code.
+lcrsResponseStatus :: Lens' ListCertificatesResponse Int
+lcrsResponseStatus = lens _lcrsResponseStatus (\ s a -> s{_lcrsResponseStatus = a});
diff --git a/gen/Network/AWS/CertificateManager/RequestCertificate.hs b/gen/Network/AWS/CertificateManager/RequestCertificate.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/RequestCertificate.hs
@@ -0,0 +1,196 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.RequestCertificate
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Requests an ACM Certificate for use with other AWS services. To request
+-- an ACM Certificate, you must specify the fully qualified domain name
+-- (FQDN) for your site. You can also specify additional FQDNs if users can
+-- reach your site by using other names. For each domain name you specify,
+-- email is sent to the domain owner to request approval to issue the
+-- certificate. After receiving approval from the domain owner, the ACM
+-- Certificate is issued. For more information, see the
+-- <http://docs.aws.amazon.com/acm/latest/userguide/overview.html AWS Certificate Manager User Guide>.
+module Network.AWS.CertificateManager.RequestCertificate
+    (
+    -- * Creating a Request
+      requestCertificate
+    , RequestCertificate
+    -- * Request Lenses
+    , rcIdempotencyToken
+    , rcSubjectAlternativeNames
+    , rcDomainValidationOptions
+    , rcDomainName
+
+    -- * Destructuring the Response
+    , requestCertificateResponse
+    , RequestCertificateResponse
+    -- * Response Lenses
+    , rcrsCertificateARN
+    , rcrsResponseStatus
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- | /See:/ 'requestCertificate' smart constructor.
+data RequestCertificate = RequestCertificate'
+    { _rcIdempotencyToken        :: !(Maybe Text)
+    , _rcSubjectAlternativeNames :: !(Maybe (List1 Text))
+    , _rcDomainValidationOptions :: !(Maybe (List1 DomainValidationOption))
+    , _rcDomainName              :: !Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'RequestCertificate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'rcIdempotencyToken'
+--
+-- * 'rcSubjectAlternativeNames'
+--
+-- * 'rcDomainValidationOptions'
+--
+-- * 'rcDomainName'
+requestCertificate
+    :: Text -- ^ 'rcDomainName'
+    -> RequestCertificate
+requestCertificate pDomainName_ =
+    RequestCertificate'
+    { _rcIdempotencyToken = Nothing
+    , _rcSubjectAlternativeNames = Nothing
+    , _rcDomainValidationOptions = Nothing
+    , _rcDomainName = pDomainName_
+    }
+
+-- | Customer chosen string that can be used to distinguish between calls to
+-- 'RequestCertificate'. Idempotency tokens time out after one hour.
+-- Therefore, if you call 'RequestCertificate' multiple times with the same
+-- idempotency token within one hour, ACM recognizes that you are
+-- requesting only one certificate and will issue only one. If you change
+-- the idempotency token for each call, ACM recognizes that you are
+-- requesting multiple certificates.
+rcIdempotencyToken :: Lens' RequestCertificate (Maybe Text)
+rcIdempotencyToken = lens _rcIdempotencyToken (\ s a -> s{_rcIdempotencyToken = a});
+
+-- | Additional FQDNs to be included in the Subject Alternative Name
+-- extension of the ACM Certificate. For example, add the name
+-- www.example.net to a certificate for which the 'DomainName' field is
+-- www.example.com if users can reach your site by using either name.
+rcSubjectAlternativeNames :: Lens' RequestCertificate (Maybe (NonEmpty Text))
+rcSubjectAlternativeNames = lens _rcSubjectAlternativeNames (\ s a -> s{_rcSubjectAlternativeNames = a}) . mapping _List1;
+
+-- | The base validation domain that will act as the suffix of the email
+-- addresses that are used to send the emails. This must be the same as the
+-- 'Domain' value or a superdomain of the 'Domain' value. For example, if
+-- you requested a certificate for 'test.example.com' and specify
+-- __DomainValidationOptions__ of 'example.com', ACM sends email to the
+-- domain registrant, technical contact, and administrative contact in
+-- WHOIS and the following five addresses:
+--
+-- -   admin\'example.com
+-- -   administrator\'example.com
+-- -   hostmaster\'example.com
+-- -   postmaster\'example.com
+-- -   webmaster\'example.com
+rcDomainValidationOptions :: Lens' RequestCertificate (Maybe (NonEmpty DomainValidationOption))
+rcDomainValidationOptions = lens _rcDomainValidationOptions (\ s a -> s{_rcDomainValidationOptions = a}) . mapping _List1;
+
+-- | Fully qualified domain name (FQDN), such as www.example.com, of the site
+-- you want to secure with an ACM Certificate. Use an asterisk (*) to
+-- create a wildcard certificate that protects several sites in the same
+-- domain. For example, *.example.com protects www.example.com,
+-- site.example.com, and images.example.com.
+rcDomainName :: Lens' RequestCertificate Text
+rcDomainName = lens _rcDomainName (\ s a -> s{_rcDomainName = a});
+
+instance AWSRequest RequestCertificate where
+        type Rs RequestCertificate =
+             RequestCertificateResponse
+        request = postJSON certificateManager
+        response
+          = receiveJSON
+              (\ s h x ->
+                 RequestCertificateResponse' <$>
+                   (x .?> "CertificateArn") <*> (pure (fromEnum s)))
+
+instance Hashable RequestCertificate
+
+instance ToHeaders RequestCertificate where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.RequestCertificate" ::
+                       ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON RequestCertificate where
+        toJSON RequestCertificate'{..}
+          = object
+              (catMaybes
+                 [("IdempotencyToken" .=) <$> _rcIdempotencyToken,
+                  ("SubjectAlternativeNames" .=) <$>
+                    _rcSubjectAlternativeNames,
+                  ("DomainValidationOptions" .=) <$>
+                    _rcDomainValidationOptions,
+                  Just ("DomainName" .= _rcDomainName)])
+
+instance ToPath RequestCertificate where
+        toPath = const "/"
+
+instance ToQuery RequestCertificate where
+        toQuery = const mempty
+
+-- | /See:/ 'requestCertificateResponse' smart constructor.
+data RequestCertificateResponse = RequestCertificateResponse'
+    { _rcrsCertificateARN :: !(Maybe Text)
+    , _rcrsResponseStatus :: !Int
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'RequestCertificateResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'rcrsCertificateARN'
+--
+-- * 'rcrsResponseStatus'
+requestCertificateResponse
+    :: Int -- ^ 'rcrsResponseStatus'
+    -> RequestCertificateResponse
+requestCertificateResponse pResponseStatus_ =
+    RequestCertificateResponse'
+    { _rcrsCertificateARN = Nothing
+    , _rcrsResponseStatus = pResponseStatus_
+    }
+
+-- | String that contains the ARN of the issued certificate. This must be of
+-- the form:
+--
+-- 'arn:aws:acm:us-east-1:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+rcrsCertificateARN :: Lens' RequestCertificateResponse (Maybe Text)
+rcrsCertificateARN = lens _rcrsCertificateARN (\ s a -> s{_rcrsCertificateARN = a});
+
+-- | The response status code.
+rcrsResponseStatus :: Lens' RequestCertificateResponse Int
+rcrsResponseStatus = lens _rcrsResponseStatus (\ s a -> s{_rcrsResponseStatus = a});
diff --git a/gen/Network/AWS/CertificateManager/ResendValidationEmail.hs b/gen/Network/AWS/CertificateManager/ResendValidationEmail.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/ResendValidationEmail.hs
@@ -0,0 +1,155 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.ResendValidationEmail
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Resends the email that requests domain ownership validation. The domain
+-- owner or an authorized representative must approve the ACM Certificate
+-- before it can be issued. The certificate can be approved by clicking a
+-- link in the mail to navigate to the Amazon certificate approval website
+-- and then clicking __I Approve__. However, the validation email can be
+-- blocked by spam filters. Therefore, if you do not receive the original
+-- mail, you can request that the mail be resent within 72 hours of
+-- requesting the ACM Certificate. If more than 72 hours have elapsed since
+-- your original request or since your last attempt to resend validation
+-- mail, you must request a new certificate.
+module Network.AWS.CertificateManager.ResendValidationEmail
+    (
+    -- * Creating a Request
+      resendValidationEmail
+    , ResendValidationEmail
+    -- * Request Lenses
+    , rveCertificateARN
+    , rveDomain
+    , rveValidationDomain
+
+    -- * Destructuring the Response
+    , resendValidationEmailResponse
+    , ResendValidationEmailResponse
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- | /See:/ 'resendValidationEmail' smart constructor.
+data ResendValidationEmail = ResendValidationEmail'
+    { _rveCertificateARN   :: !Text
+    , _rveDomain           :: !Text
+    , _rveValidationDomain :: !Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ResendValidationEmail' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'rveCertificateARN'
+--
+-- * 'rveDomain'
+--
+-- * 'rveValidationDomain'
+resendValidationEmail
+    :: Text -- ^ 'rveCertificateARN'
+    -> Text -- ^ 'rveDomain'
+    -> Text -- ^ 'rveValidationDomain'
+    -> ResendValidationEmail
+resendValidationEmail pCertificateARN_ pDomain_ pValidationDomain_ =
+    ResendValidationEmail'
+    { _rveCertificateARN = pCertificateARN_
+    , _rveDomain = pDomain_
+    , _rveValidationDomain = pValidationDomain_
+    }
+
+-- | String that contains the ARN of the requested certificate. The
+-- certificate ARN is generated and returned by < RequestCertificate> as
+-- soon as the request is made. By default, using this parameter causes
+-- email to be sent to all top-level domains you specified in the
+-- certificate request.
+--
+-- The ARN must be of the form:
+--
+-- 'arn:aws:acm:us-east-1:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+rveCertificateARN :: Lens' ResendValidationEmail Text
+rveCertificateARN = lens _rveCertificateARN (\ s a -> s{_rveCertificateARN = a});
+
+-- | The Fully Qualified Domain Name (FQDN) of the certificate that needs to
+-- be validated.
+rveDomain :: Lens' ResendValidationEmail Text
+rveDomain = lens _rveDomain (\ s a -> s{_rveDomain = a});
+
+-- | The base validation domain that will act as the suffix of the email
+-- addresses that are used to send the emails. This must be the same as the
+-- 'Domain' value or a superdomain of the 'Domain' value. For example, if
+-- you requested a certificate for 'site.subdomain.example.com' and specify
+-- a __ValidationDomain__ of 'subdomain.example.com', ACM sends email to
+-- the domain registrant, technical contact, and administrative contact in
+-- WHOIS and the following five addresses:
+--
+-- -   admin\'subdomain.example.com
+-- -   administrator\'subdomain.example.com
+-- -   hostmaster\'subdomain.example.com
+-- -   postmaster\'subdomain.example.com
+-- -   webmaster\'subdomain.example.com
+rveValidationDomain :: Lens' ResendValidationEmail Text
+rveValidationDomain = lens _rveValidationDomain (\ s a -> s{_rveValidationDomain = a});
+
+instance AWSRequest ResendValidationEmail where
+        type Rs ResendValidationEmail =
+             ResendValidationEmailResponse
+        request = postJSON certificateManager
+        response = receiveNull ResendValidationEmailResponse'
+
+instance Hashable ResendValidationEmail
+
+instance ToHeaders ResendValidationEmail where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.ResendValidationEmail" ::
+                       ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON ResendValidationEmail where
+        toJSON ResendValidationEmail'{..}
+          = object
+              (catMaybes
+                 [Just ("CertificateArn" .= _rveCertificateARN),
+                  Just ("Domain" .= _rveDomain),
+                  Just ("ValidationDomain" .= _rveValidationDomain)])
+
+instance ToPath ResendValidationEmail where
+        toPath = const "/"
+
+instance ToQuery ResendValidationEmail where
+        toQuery = const mempty
+
+-- | /See:/ 'resendValidationEmailResponse' smart constructor.
+data ResendValidationEmailResponse =
+    ResendValidationEmailResponse'
+    deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ResendValidationEmailResponse' with the minimum fields required to make a request.
+--
+resendValidationEmailResponse
+    :: ResendValidationEmailResponse
+resendValidationEmailResponse = ResendValidationEmailResponse'
diff --git a/gen/Network/AWS/CertificateManager/Types.hs b/gen/Network/AWS/CertificateManager/Types.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/Types.hs
@@ -0,0 +1,159 @@
+{-# LANGUAGE OverloadedStrings #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.Types
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Network.AWS.CertificateManager.Types
+    (
+    -- * Service Configuration
+      certificateManager
+
+    -- * Errors
+    , _InvalidDomainValidationOptionsException
+    , _RequestInProgressException
+    , _InvalidARNException
+    , _ResourceNotFoundException
+    , _InvalidStateException
+    , _LimitExceededException
+    , _ResourceInUseException
+
+    -- * CertificateStatus
+    , CertificateStatus (..)
+
+    -- * KeyAlgorithm
+    , KeyAlgorithm (..)
+
+    -- * RevocationReason
+    , RevocationReason (..)
+
+    -- * CertificateDetail
+    , CertificateDetail
+    , certificateDetail
+    , cdSubject
+    , cdStatus
+    , cdSubjectAlternativeNames
+    , cdInUseBy
+    , cdCreatedAt
+    , cdCertificateARN
+    , cdSerial
+    , cdRevokedAt
+    , cdNotBefore
+    , cdRevocationReason
+    , cdDomainName
+    , cdKeyAlgorithm
+    , cdIssuedAt
+    , cdSignatureAlgorithm
+    , cdDomainValidationOptions
+    , cdIssuer
+    , cdNotAfter
+
+    -- * CertificateSummary
+    , CertificateSummary
+    , certificateSummary
+    , csCertificateARN
+    , csDomainName
+
+    -- * DomainValidation
+    , DomainValidation
+    , domainValidation
+    , dvValidationEmails
+    , dvValidationDomain
+    , dvDomainName
+
+    -- * DomainValidationOption
+    , DomainValidationOption
+    , domainValidationOption
+    , dvoDomainName
+    , dvoValidationDomain
+    ) where
+
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.CertificateManager.Types.Sum
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Sign.V4
+
+-- | API version '2015-12-08' of the Amazon Certificate Manager SDK configuration.
+certificateManager :: Service
+certificateManager =
+    Service
+    { _svcAbbrev = "CertificateManager"
+    , _svcSigner = v4
+    , _svcPrefix = "acm"
+    , _svcVersion = "2015-12-08"
+    , _svcEndpoint = defaultEndpoint certificateManager
+    , _svcTimeout = Just 70
+    , _svcCheck = statusSuccess
+    , _svcError = parseJSONError
+    , _svcRetry = retry
+    }
+  where
+    retry =
+        Exponential
+        { _retryBase = 5.0e-2
+        , _retryGrowth = 2
+        , _retryAttempts = 5
+        , _retryCheck = check
+        }
+    check e
+      | has (hasStatus 429) e = Just "too_many_requests"
+      | has (hasCode "ThrottlingException" . hasStatus 400) e =
+          Just "throttling_exception"
+      | has (hasCode "Throttling" . hasStatus 400) e = Just "throttling"
+      | has (hasStatus 503) e = Just "service_unavailable"
+      | has (hasStatus 500) e = Just "general_server_error"
+      | has (hasStatus 509) e = Just "limit_exceeded"
+      | otherwise = Nothing
+
+-- | One or more values in the < DomainValidationOption> structure is
+-- incorrect.
+_InvalidDomainValidationOptionsException :: AsError a => Getting (First ServiceError) a ServiceError
+_InvalidDomainValidationOptionsException =
+    _ServiceError . hasCode "InvalidDomainValidationOptionsException"
+
+-- | The certificate request is in process and the certificate in your
+-- account has not yet been issued.
+_RequestInProgressException :: AsError a => Getting (First ServiceError) a ServiceError
+_RequestInProgressException =
+    _ServiceError . hasCode "RequestInProgressException"
+
+-- | The requested Amazon Resource Name (ARN) does not refer to an existing
+-- resource.
+_InvalidARNException :: AsError a => Getting (First ServiceError) a ServiceError
+_InvalidARNException = _ServiceError . hasCode "InvalidArnException"
+
+-- | The specified certificate cannot be found in the caller\'s account, or
+-- the caller\'s account cannot be found.
+_ResourceNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
+_ResourceNotFoundException =
+    _ServiceError . hasCode "ResourceNotFoundException"
+
+-- | Processing has reached an invalid state. For example, this exception can
+-- occur if the specified domain is not using email validation, or the
+-- current certificate status does not permit the requested operation. See
+-- the exception message returned by ACM to determine which state is not
+-- valid.
+_InvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError
+_InvalidStateException = _ServiceError . hasCode "InvalidStateException"
+
+-- | An ACM limit has been exceeded. For example, you may have input more
+-- domains than are allowed or you\'ve requested too many certificates for
+-- your account. See the exception message returned by ACM to determine
+-- which limit you have violated. For more information about ACM limits,
+-- see the
+-- <http://docs.aws.amazon.com/acm/latest/userguide/acm-limits.html Limits>
+-- topic.
+_LimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError
+_LimitExceededException = _ServiceError . hasCode "LimitExceededException"
+
+-- | The certificate is in use by another AWS service in the caller\'s
+-- account. Remove the association and try again.
+_ResourceInUseException :: AsError a => Getting (First ServiceError) a ServiceError
+_ResourceInUseException = _ServiceError . hasCode "ResourceInUseException"
diff --git a/gen/Network/AWS/CertificateManager/Types/Product.hs b/gen/Network/AWS/CertificateManager/Types/Product.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/Types/Product.hs
@@ -0,0 +1,397 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.Types.Product
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Network.AWS.CertificateManager.Types.Product where
+
+import           Network.AWS.CertificateManager.Types.Sum
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+
+-- | This structure is returned in the response object of the
+-- < DescribeCertificate> action.
+--
+-- /See:/ 'certificateDetail' smart constructor.
+data CertificateDetail = CertificateDetail'
+    { _cdSubject                 :: !(Maybe Text)
+    , _cdStatus                  :: !(Maybe CertificateStatus)
+    , _cdSubjectAlternativeNames :: !(Maybe (List1 Text))
+    , _cdInUseBy                 :: !(Maybe [Text])
+    , _cdCreatedAt               :: !(Maybe POSIX)
+    , _cdCertificateARN          :: !(Maybe Text)
+    , _cdSerial                  :: !(Maybe Text)
+    , _cdRevokedAt               :: !(Maybe POSIX)
+    , _cdNotBefore               :: !(Maybe POSIX)
+    , _cdRevocationReason        :: !(Maybe RevocationReason)
+    , _cdDomainName              :: !(Maybe Text)
+    , _cdKeyAlgorithm            :: !(Maybe KeyAlgorithm)
+    , _cdIssuedAt                :: !(Maybe POSIX)
+    , _cdSignatureAlgorithm      :: !(Maybe Text)
+    , _cdDomainValidationOptions :: !(Maybe (List1 DomainValidation))
+    , _cdIssuer                  :: !(Maybe Text)
+    , _cdNotAfter                :: !(Maybe POSIX)
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'CertificateDetail' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'cdSubject'
+--
+-- * 'cdStatus'
+--
+-- * 'cdSubjectAlternativeNames'
+--
+-- * 'cdInUseBy'
+--
+-- * 'cdCreatedAt'
+--
+-- * 'cdCertificateARN'
+--
+-- * 'cdSerial'
+--
+-- * 'cdRevokedAt'
+--
+-- * 'cdNotBefore'
+--
+-- * 'cdRevocationReason'
+--
+-- * 'cdDomainName'
+--
+-- * 'cdKeyAlgorithm'
+--
+-- * 'cdIssuedAt'
+--
+-- * 'cdSignatureAlgorithm'
+--
+-- * 'cdDomainValidationOptions'
+--
+-- * 'cdIssuer'
+--
+-- * 'cdNotAfter'
+certificateDetail
+    :: CertificateDetail
+certificateDetail =
+    CertificateDetail'
+    { _cdSubject = Nothing
+    , _cdStatus = Nothing
+    , _cdSubjectAlternativeNames = Nothing
+    , _cdInUseBy = Nothing
+    , _cdCreatedAt = Nothing
+    , _cdCertificateARN = Nothing
+    , _cdSerial = Nothing
+    , _cdRevokedAt = Nothing
+    , _cdNotBefore = Nothing
+    , _cdRevocationReason = Nothing
+    , _cdDomainName = Nothing
+    , _cdKeyAlgorithm = Nothing
+    , _cdIssuedAt = Nothing
+    , _cdSignatureAlgorithm = Nothing
+    , _cdDomainValidationOptions = Nothing
+    , _cdIssuer = Nothing
+    , _cdNotAfter = Nothing
+    }
+
+-- | The X.500 distinguished name of the entity associated with the public
+-- key contained in the certificate.
+cdSubject :: Lens' CertificateDetail (Maybe Text)
+cdSubject = lens _cdSubject (\ s a -> s{_cdSubject = a});
+
+-- | A 'CertificateStatus' enumeration value that can contain one of the
+-- following:
+--
+-- -   PENDING_VALIDATION
+-- -   ISSUED
+-- -   INACTIVE
+-- -   EXPIRED
+-- -   REVOKED
+-- -   FAILED
+-- -   VALIDATION_TIMED_OUT
+cdStatus :: Lens' CertificateDetail (Maybe CertificateStatus)
+cdStatus = lens _cdStatus (\ s a -> s{_cdStatus = a});
+
+-- | One or more domain names (subject alternative names) included in the
+-- certificate request. After the certificate is issued, this list includes
+-- the domain names bound to the public key contained in the certificate.
+-- The subject alternative names include the canonical domain name (CN) of
+-- the certificate and additional domain names that can be used to connect
+-- to the website.
+cdSubjectAlternativeNames :: Lens' CertificateDetail (Maybe (NonEmpty Text))
+cdSubjectAlternativeNames = lens _cdSubjectAlternativeNames (\ s a -> s{_cdSubjectAlternativeNames = a}) . mapping _List1;
+
+-- | List that identifies ARNs that are using the certificate. A single ACM
+-- Certificate can be used by multiple AWS resources.
+cdInUseBy :: Lens' CertificateDetail [Text]
+cdInUseBy = lens _cdInUseBy (\ s a -> s{_cdInUseBy = a}) . _Default . _Coerce;
+
+-- | Time at which the certificate was requested.
+cdCreatedAt :: Lens' CertificateDetail (Maybe UTCTime)
+cdCreatedAt = lens _cdCreatedAt (\ s a -> s{_cdCreatedAt = a}) . mapping _Time;
+
+-- | Amazon Resource Name (ARN) of the certificate. This is of the form:
+--
+-- 'arn:aws:acm:region:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+--
+-- For more information about ARNs, see
+-- <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Names (ARNs) and AWS Service Namespaces>.
+cdCertificateARN :: Lens' CertificateDetail (Maybe Text)
+cdCertificateARN = lens _cdCertificateARN (\ s a -> s{_cdCertificateARN = a});
+
+-- | String that contains the serial number of the certificate.
+cdSerial :: Lens' CertificateDetail (Maybe Text)
+cdSerial = lens _cdSerial (\ s a -> s{_cdSerial = a});
+
+-- | The time, if any, at which the certificate was revoked. This value
+-- exists only if the certificate has been revoked.
+cdRevokedAt :: Lens' CertificateDetail (Maybe UTCTime)
+cdRevokedAt = lens _cdRevokedAt (\ s a -> s{_cdRevokedAt = a}) . mapping _Time;
+
+-- | Time before which the certificate is not valid.
+cdNotBefore :: Lens' CertificateDetail (Maybe UTCTime)
+cdNotBefore = lens _cdNotBefore (\ s a -> s{_cdNotBefore = a}) . mapping _Time;
+
+-- | A 'RevocationReason' enumeration value that indicates why the
+-- certificate was revoked. This value exists only if the certificate has
+-- been revoked. This can be one of the following vales:
+--
+-- -   UNSPECIFIED
+-- -   KEY_COMPROMISE
+-- -   CA_COMPROMISE
+-- -   AFFILIATION_CHANGED
+-- -   SUPERCEDED
+-- -   CESSATION_OF_OPERATION
+-- -   CERTIFICATE_HOLD
+-- -   REMOVE_FROM_CRL
+-- -   PRIVILEGE_WITHDRAWN
+-- -   A_A_COMPROMISE
+cdRevocationReason :: Lens' CertificateDetail (Maybe RevocationReason)
+cdRevocationReason = lens _cdRevocationReason (\ s a -> s{_cdRevocationReason = a});
+
+-- | Fully qualified domain name (FQDN), such as www.example.com or
+-- example.com, for the certificate.
+cdDomainName :: Lens' CertificateDetail (Maybe Text)
+cdDomainName = lens _cdDomainName (\ s a -> s{_cdDomainName = a});
+
+-- | Asymmetric algorithm used to generate the public and private key pair.
+-- Currently the only supported value is 'RSA_2048'.
+cdKeyAlgorithm :: Lens' CertificateDetail (Maybe KeyAlgorithm)
+cdKeyAlgorithm = lens _cdKeyAlgorithm (\ s a -> s{_cdKeyAlgorithm = a});
+
+-- | Time at which the certificate was issued.
+cdIssuedAt :: Lens' CertificateDetail (Maybe UTCTime)
+cdIssuedAt = lens _cdIssuedAt (\ s a -> s{_cdIssuedAt = a}) . mapping _Time;
+
+-- | Algorithm used to generate a signature. Currently the only supported
+-- value is 'SHA256WITHRSA'.
+cdSignatureAlgorithm :: Lens' CertificateDetail (Maybe Text)
+cdSignatureAlgorithm = lens _cdSignatureAlgorithm (\ s a -> s{_cdSignatureAlgorithm = a});
+
+-- | References a < DomainValidation> structure that contains the domain name
+-- in the certificate and the email address that can be used for
+-- validation.
+cdDomainValidationOptions :: Lens' CertificateDetail (Maybe (NonEmpty DomainValidation))
+cdDomainValidationOptions = lens _cdDomainValidationOptions (\ s a -> s{_cdDomainValidationOptions = a}) . mapping _List1;
+
+-- | The X.500 distinguished name of the CA that issued and signed the
+-- certificate.
+cdIssuer :: Lens' CertificateDetail (Maybe Text)
+cdIssuer = lens _cdIssuer (\ s a -> s{_cdIssuer = a});
+
+-- | Time after which the certificate is not valid.
+cdNotAfter :: Lens' CertificateDetail (Maybe UTCTime)
+cdNotAfter = lens _cdNotAfter (\ s a -> s{_cdNotAfter = a}) . mapping _Time;
+
+instance FromJSON CertificateDetail where
+        parseJSON
+          = withObject "CertificateDetail"
+              (\ x ->
+                 CertificateDetail' <$>
+                   (x .:? "Subject") <*> (x .:? "Status") <*>
+                     (x .:? "SubjectAlternativeNames")
+                     <*> (x .:? "InUseBy" .!= mempty)
+                     <*> (x .:? "CreatedAt")
+                     <*> (x .:? "CertificateArn")
+                     <*> (x .:? "Serial")
+                     <*> (x .:? "RevokedAt")
+                     <*> (x .:? "NotBefore")
+                     <*> (x .:? "RevocationReason")
+                     <*> (x .:? "DomainName")
+                     <*> (x .:? "KeyAlgorithm")
+                     <*> (x .:? "IssuedAt")
+                     <*> (x .:? "SignatureAlgorithm")
+                     <*> (x .:? "DomainValidationOptions")
+                     <*> (x .:? "Issuer")
+                     <*> (x .:? "NotAfter"))
+
+instance Hashable CertificateDetail
+
+-- | This structure is returned in the response object of < ListCertificates>
+-- action.
+--
+-- /See:/ 'certificateSummary' smart constructor.
+data CertificateSummary = CertificateSummary'
+    { _csCertificateARN :: !(Maybe Text)
+    , _csDomainName     :: !(Maybe Text)
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'CertificateSummary' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'csCertificateARN'
+--
+-- * 'csDomainName'
+certificateSummary
+    :: CertificateSummary
+certificateSummary =
+    CertificateSummary'
+    { _csCertificateARN = Nothing
+    , _csDomainName = Nothing
+    }
+
+-- | Amazon Resource Name (ARN) of the certificate. This is of the form:
+--
+-- 'arn:aws:acm:region:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+--
+-- For more information about ARNs, see
+-- <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Names (ARNs) and AWS Service Namespaces>.
+csCertificateARN :: Lens' CertificateSummary (Maybe Text)
+csCertificateARN = lens _csCertificateARN (\ s a -> s{_csCertificateARN = a});
+
+-- | Fully qualified domain name (FQDN), such as www.example.com or
+-- example.com, for the certificate.
+csDomainName :: Lens' CertificateSummary (Maybe Text)
+csDomainName = lens _csDomainName (\ s a -> s{_csDomainName = a});
+
+instance FromJSON CertificateSummary where
+        parseJSON
+          = withObject "CertificateSummary"
+              (\ x ->
+                 CertificateSummary' <$>
+                   (x .:? "CertificateArn") <*> (x .:? "DomainName"))
+
+instance Hashable CertificateSummary
+
+-- | Structure that contains the domain name, the base validation domain to
+-- which validation email is sent, and the email addresses used to validate
+-- the domain identity.
+--
+-- /See:/ 'domainValidation' smart constructor.
+data DomainValidation = DomainValidation'
+    { _dvValidationEmails :: !(Maybe [Text])
+    , _dvValidationDomain :: !(Maybe Text)
+    , _dvDomainName       :: !Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DomainValidation' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'dvValidationEmails'
+--
+-- * 'dvValidationDomain'
+--
+-- * 'dvDomainName'
+domainValidation
+    :: Text -- ^ 'dvDomainName'
+    -> DomainValidation
+domainValidation pDomainName_ =
+    DomainValidation'
+    { _dvValidationEmails = Nothing
+    , _dvValidationDomain = Nothing
+    , _dvDomainName = pDomainName_
+    }
+
+-- | A list of contact address for the domain registrant.
+dvValidationEmails :: Lens' DomainValidation [Text]
+dvValidationEmails = lens _dvValidationEmails (\ s a -> s{_dvValidationEmails = a}) . _Default . _Coerce;
+
+-- | The base validation domain that acts as the suffix of the email
+-- addresses that are used to send the emails.
+dvValidationDomain :: Lens' DomainValidation (Maybe Text)
+dvValidationDomain = lens _dvValidationDomain (\ s a -> s{_dvValidationDomain = a});
+
+-- | Fully Qualified Domain Name (FQDN) of the form
+-- 'www.example.com or ''example.com'
+dvDomainName :: Lens' DomainValidation Text
+dvDomainName = lens _dvDomainName (\ s a -> s{_dvDomainName = a});
+
+instance FromJSON DomainValidation where
+        parseJSON
+          = withObject "DomainValidation"
+              (\ x ->
+                 DomainValidation' <$>
+                   (x .:? "ValidationEmails" .!= mempty) <*>
+                     (x .:? "ValidationDomain")
+                     <*> (x .: "DomainName"))
+
+instance Hashable DomainValidation
+
+-- | This structure is used in the request object of the
+-- < RequestCertificate> action.
+--
+-- /See:/ 'domainValidationOption' smart constructor.
+data DomainValidationOption = DomainValidationOption'
+    { _dvoDomainName       :: !Text
+    , _dvoValidationDomain :: !Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DomainValidationOption' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'dvoDomainName'
+--
+-- * 'dvoValidationDomain'
+domainValidationOption
+    :: Text -- ^ 'dvoDomainName'
+    -> Text -- ^ 'dvoValidationDomain'
+    -> DomainValidationOption
+domainValidationOption pDomainName_ pValidationDomain_ =
+    DomainValidationOption'
+    { _dvoDomainName = pDomainName_
+    , _dvoValidationDomain = pValidationDomain_
+    }
+
+-- | Fully Qualified Domain Name (FQDN) of the certificate being requested.
+dvoDomainName :: Lens' DomainValidationOption Text
+dvoDomainName = lens _dvoDomainName (\ s a -> s{_dvoDomainName = a});
+
+-- | The domain to which validation email is sent. This is the base
+-- validation domain that will act as the suffix of the email addresses.
+-- This must be the same as the 'DomainName' value or a superdomain of the
+-- 'DomainName' value. For example, if you requested a certificate for
+-- 'site.subdomain.example.com' and specify a __ValidationDomain__ of
+-- 'subdomain.example.com', ACM sends email to the domain registrant,
+-- technical contact, and administrative contact in WHOIS for the base
+-- domain and the and the following five addresses:
+--
+-- -   admin\'subdomain.example.com
+-- -   administrator\'subdomain.example.com
+-- -   hostmaster\'subdomain.example.com
+-- -   postmaster\'subdomain.example.com
+-- -   webmaster\'subdomain.example.com
+dvoValidationDomain :: Lens' DomainValidationOption Text
+dvoValidationDomain = lens _dvoValidationDomain (\ s a -> s{_dvoValidationDomain = a});
+
+instance Hashable DomainValidationOption
+
+instance ToJSON DomainValidationOption where
+        toJSON DomainValidationOption'{..}
+          = object
+              (catMaybes
+                 [Just ("DomainName" .= _dvoDomainName),
+                  Just ("ValidationDomain" .= _dvoValidationDomain)])
diff --git a/gen/Network/AWS/CertificateManager/Types/Sum.hs b/gen/Network/AWS/CertificateManager/Types/Sum.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/Types/Sum.hs
@@ -0,0 +1,137 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE LambdaCase         #-}
+{-# LANGUAGE OverloadedStrings  #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.Types.Sum
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Network.AWS.CertificateManager.Types.Sum where
+
+import           Network.AWS.Prelude
+
+data CertificateStatus
+    = Expired
+    | Failed
+    | Inactive
+    | Issued
+    | PendingValidation
+    | Revoked
+    | ValidationTimedOut
+    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)
+
+instance FromText CertificateStatus where
+    parser = takeLowerText >>= \case
+        "expired" -> pure Expired
+        "failed" -> pure Failed
+        "inactive" -> pure Inactive
+        "issued" -> pure Issued
+        "pending_validation" -> pure PendingValidation
+        "revoked" -> pure Revoked
+        "validation_timed_out" -> pure ValidationTimedOut
+        e -> fromTextError $ "Failure parsing CertificateStatus from value: '" <> e
+           <> "'. Accepted values: EXPIRED, FAILED, INACTIVE, ISSUED, PENDING_VALIDATION, REVOKED, VALIDATION_TIMED_OUT"
+
+instance ToText CertificateStatus where
+    toText = \case
+        Expired -> "EXPIRED"
+        Failed -> "FAILED"
+        Inactive -> "INACTIVE"
+        Issued -> "ISSUED"
+        PendingValidation -> "PENDING_VALIDATION"
+        Revoked -> "REVOKED"
+        ValidationTimedOut -> "VALIDATION_TIMED_OUT"
+
+instance Hashable     CertificateStatus
+instance ToByteString CertificateStatus
+instance ToQuery      CertificateStatus
+instance ToHeader     CertificateStatus
+
+instance ToJSON CertificateStatus where
+    toJSON = toJSONText
+
+instance FromJSON CertificateStatus where
+    parseJSON = parseJSONText "CertificateStatus"
+
+data KeyAlgorithm
+    = EcPRIME256V1
+    | Rsa2048
+    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)
+
+instance FromText KeyAlgorithm where
+    parser = takeLowerText >>= \case
+        "ec_prime256v1" -> pure EcPRIME256V1
+        "rsa_2048" -> pure Rsa2048
+        e -> fromTextError $ "Failure parsing KeyAlgorithm from value: '" <> e
+           <> "'. Accepted values: EC_prime256v1, RSA_2048"
+
+instance ToText KeyAlgorithm where
+    toText = \case
+        EcPRIME256V1 -> "EC_prime256v1"
+        Rsa2048 -> "RSA_2048"
+
+instance Hashable     KeyAlgorithm
+instance ToByteString KeyAlgorithm
+instance ToQuery      KeyAlgorithm
+instance ToHeader     KeyAlgorithm
+
+instance FromJSON KeyAlgorithm where
+    parseJSON = parseJSONText "KeyAlgorithm"
+
+data RevocationReason
+    = AACompromise
+    | AffiliationChanged
+    | CaCompromise
+    | CertificateHold
+    | CessationOfOperation
+    | KeyCompromise
+    | PrivilegeWithdrawn
+    | RemoveFromCrl
+    | Superceded
+    | Unspecified
+    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)
+
+instance FromText RevocationReason where
+    parser = takeLowerText >>= \case
+        "a_a_compromise" -> pure AACompromise
+        "affiliation_changed" -> pure AffiliationChanged
+        "ca_compromise" -> pure CaCompromise
+        "certificate_hold" -> pure CertificateHold
+        "cessation_of_operation" -> pure CessationOfOperation
+        "key_compromise" -> pure KeyCompromise
+        "privilege_withdrawn" -> pure PrivilegeWithdrawn
+        "remove_from_crl" -> pure RemoveFromCrl
+        "superceded" -> pure Superceded
+        "unspecified" -> pure Unspecified
+        e -> fromTextError $ "Failure parsing RevocationReason from value: '" <> e
+           <> "'. Accepted values: A_A_COMPROMISE, AFFILIATION_CHANGED, CA_COMPROMISE, CERTIFICATE_HOLD, CESSATION_OF_OPERATION, KEY_COMPROMISE, PRIVILEGE_WITHDRAWN, REMOVE_FROM_CRL, SUPERCEDED, UNSPECIFIED"
+
+instance ToText RevocationReason where
+    toText = \case
+        AACompromise -> "A_A_COMPROMISE"
+        AffiliationChanged -> "AFFILIATION_CHANGED"
+        CaCompromise -> "CA_COMPROMISE"
+        CertificateHold -> "CERTIFICATE_HOLD"
+        CessationOfOperation -> "CESSATION_OF_OPERATION"
+        KeyCompromise -> "KEY_COMPROMISE"
+        PrivilegeWithdrawn -> "PRIVILEGE_WITHDRAWN"
+        RemoveFromCrl -> "REMOVE_FROM_CRL"
+        Superceded -> "SUPERCEDED"
+        Unspecified -> "UNSPECIFIED"
+
+instance Hashable     RevocationReason
+instance ToByteString RevocationReason
+instance ToQuery      RevocationReason
+instance ToHeader     RevocationReason
+
+instance FromJSON RevocationReason where
+    parseJSON = parseJSONText "RevocationReason"
diff --git a/gen/Network/AWS/CertificateManager/Waiters.hs b/gen/Network/AWS/CertificateManager/Waiters.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/Waiters.hs
@@ -0,0 +1,21 @@
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE TypeFamilies      #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.Waiters
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Network.AWS.CertificateManager.Waiters where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Waiter
diff --git a/test/Main.hs b/test/Main.hs
new file mode 100644
--- /dev/null
+++ b/test/Main.hs
@@ -0,0 +1,21 @@
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- |
+-- Module      : Main
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Main (main) where
+
+import Test.Tasty
+import Test.AWS.CertificateManager
+import Test.AWS.CertificateManager.Internal
+
+main :: IO ()
+main = defaultMain $ testGroup "CertificateManager"
+    [ testGroup "tests"    tests
+    , testGroup "fixtures" fixtures
+    ]
diff --git a/test/Test/AWS/CertificateManager.hs b/test/Test/AWS/CertificateManager.hs
new file mode 100644
--- /dev/null
+++ b/test/Test/AWS/CertificateManager.hs
@@ -0,0 +1,23 @@
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE TemplateHaskell   #-}
+
+-- |
+-- Module      : Test.AWS.CertificateManager
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : experimental
+-- Portability : non-portable (GHC extensions)
+--
+module Test.AWS.CertificateManager
+    ( tests
+    , fixtures
+    ) where
+
+import           Test.AWS.Prelude
+
+tests :: [TestTree]
+tests = []
+
+fixtures :: [TestTree]
+fixtures = []
diff --git a/test/Test/AWS/CertificateManager/Internal.hs b/test/Test/AWS/CertificateManager/Internal.hs
new file mode 100644
--- /dev/null
+++ b/test/Test/AWS/CertificateManager/Internal.hs
@@ -0,0 +1,15 @@
+{-# LANGUAGE OverloadedStrings #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- |
+-- Module      : Test.AWS.CertificateManager.Internal
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : experimental
+-- Portability : non-portable (GHC extensions)
+--
+
+module Test.AWS.CertificateManager.Internal where
+
+import           Test.AWS.Prelude
diff --git a/test/Test/AWS/Gen/CertificateManager.hs b/test/Test/AWS/Gen/CertificateManager.hs
new file mode 100644
--- /dev/null
+++ b/test/Test/AWS/Gen/CertificateManager.hs
@@ -0,0 +1,147 @@
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-orphans        #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Test.AWS.Gen.CertificateManager
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Test.AWS.Gen.CertificateManager where
+
+import Data.Proxy
+import Test.AWS.Fixture
+import Test.AWS.Prelude
+import Test.Tasty
+import Network.AWS.CertificateManager
+import Test.AWS.CertificateManager.Internal
+
+-- Auto-generated: the actual test selection needs to be manually placed into
+-- the top-level so that real test data can be incrementally added.
+--
+-- This commented snippet is what the entire set should look like:
+
+-- fixtures :: TestTree
+-- fixtures =
+--     [ testGroup "request"
+--         [ testResendValidationEmail $
+--             resendValidationEmail
+--
+--         , testGetCertificate $
+--             getCertificate
+--
+--         , testRequestCertificate $
+--             requestCertificate
+--
+--         , testListCertificates $
+--             listCertificates
+--
+--         , testDeleteCertificate $
+--             deleteCertificate
+--
+--         , testDescribeCertificate $
+--             describeCertificate
+--
+--           ]
+
+--     , testGroup "response"
+--         [ testResendValidationEmailResponse $
+--             resendValidationEmailResponse
+--
+--         , testGetCertificateResponse $
+--             getCertificateResponse
+--
+--         , testRequestCertificateResponse $
+--             requestCertificateResponse
+--
+--         , testListCertificatesResponse $
+--             listCertificatesResponse
+--
+--         , testDeleteCertificateResponse $
+--             deleteCertificateResponse
+--
+--         , testDescribeCertificateResponse $
+--             describeCertificateResponse
+--
+--           ]
+--     ]
+
+-- Requests
+
+testResendValidationEmail :: ResendValidationEmail -> TestTree
+testResendValidationEmail = req
+    "ResendValidationEmail"
+    "fixture/ResendValidationEmail.yaml"
+
+testGetCertificate :: GetCertificate -> TestTree
+testGetCertificate = req
+    "GetCertificate"
+    "fixture/GetCertificate.yaml"
+
+testRequestCertificate :: RequestCertificate -> TestTree
+testRequestCertificate = req
+    "RequestCertificate"
+    "fixture/RequestCertificate.yaml"
+
+testListCertificates :: ListCertificates -> TestTree
+testListCertificates = req
+    "ListCertificates"
+    "fixture/ListCertificates.yaml"
+
+testDeleteCertificate :: DeleteCertificate -> TestTree
+testDeleteCertificate = req
+    "DeleteCertificate"
+    "fixture/DeleteCertificate.yaml"
+
+testDescribeCertificate :: DescribeCertificate -> TestTree
+testDescribeCertificate = req
+    "DescribeCertificate"
+    "fixture/DescribeCertificate.yaml"
+
+-- Responses
+
+testResendValidationEmailResponse :: ResendValidationEmailResponse -> TestTree
+testResendValidationEmailResponse = res
+    "ResendValidationEmailResponse"
+    "fixture/ResendValidationEmailResponse.proto"
+    certificateManager
+    (Proxy :: Proxy ResendValidationEmail)
+
+testGetCertificateResponse :: GetCertificateResponse -> TestTree
+testGetCertificateResponse = res
+    "GetCertificateResponse"
+    "fixture/GetCertificateResponse.proto"
+    certificateManager
+    (Proxy :: Proxy GetCertificate)
+
+testRequestCertificateResponse :: RequestCertificateResponse -> TestTree
+testRequestCertificateResponse = res
+    "RequestCertificateResponse"
+    "fixture/RequestCertificateResponse.proto"
+    certificateManager
+    (Proxy :: Proxy RequestCertificate)
+
+testListCertificatesResponse :: ListCertificatesResponse -> TestTree
+testListCertificatesResponse = res
+    "ListCertificatesResponse"
+    "fixture/ListCertificatesResponse.proto"
+    certificateManager
+    (Proxy :: Proxy ListCertificates)
+
+testDeleteCertificateResponse :: DeleteCertificateResponse -> TestTree
+testDeleteCertificateResponse = res
+    "DeleteCertificateResponse"
+    "fixture/DeleteCertificateResponse.proto"
+    certificateManager
+    (Proxy :: Proxy DeleteCertificate)
+
+testDescribeCertificateResponse :: DescribeCertificateResponse -> TestTree
+testDescribeCertificateResponse = res
+    "DescribeCertificateResponse"
+    "fixture/DescribeCertificateResponse.proto"
+    certificateManager
+    (Proxy :: Proxy DescribeCertificate)
