diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 
 ## Version
 
-`1.3.6`
+`1.3.7`
 
 
 ## Description
diff --git a/amazonka-cloudtrail.cabal b/amazonka-cloudtrail.cabal
--- a/amazonka-cloudtrail.cabal
+++ b/amazonka-cloudtrail.cabal
@@ -1,5 +1,5 @@
 name:                  amazonka-cloudtrail
-version:               1.3.6
+version:               1.3.7
 synopsis:              Amazon CloudTrail SDK.
 homepage:              https://github.com/brendanhay/amazonka
 bug-reports:           https://github.com/brendanhay/amazonka/issues
@@ -83,7 +83,7 @@
         , Network.AWS.CloudTrail.Types.Sum
 
     build-depends:
-          amazonka-core == 1.3.6.*
+          amazonka-core == 1.3.7.*
         , base          >= 4.7     && < 5
 
 test-suite amazonka-cloudtrail-test
@@ -103,12 +103,11 @@
         , Test.AWS.CloudTrail.Internal
 
     build-depends:
-          amazonka-core == 1.3.6.*
-        , amazonka-test == 1.3.6.*
-        , amazonka-cloudtrail == 1.3.6.*
+          amazonka-core == 1.3.7.*
+        , amazonka-test == 1.3.7.*
+        , amazonka-cloudtrail == 1.3.7.*
         , base
         , bytestring
-        , lens
         , tasty
         , tasty-hunit
         , text
diff --git a/gen/Network/AWS/CloudTrail.hs b/gen/Network/AWS/CloudTrail.hs
--- a/gen/Network/AWS/CloudTrail.hs
+++ b/gen/Network/AWS/CloudTrail.hs
@@ -131,9 +131,15 @@
     -- ** ResourceNotFoundException
     , _ResourceNotFoundException
 
+    -- ** InvalidParameterCombinationException
+    , _InvalidParameterCombinationException
+
     -- ** InvalidKMSKeyIdException
     , _InvalidKMSKeyIdException
 
+    -- ** InvalidHomeRegionException
+    , _InvalidHomeRegionException
+
     -- * Waiters
     -- $waiters
 
@@ -232,10 +238,12 @@
     , tSNSTopicName
     , tCloudWatchLogsLogGroupARN
     , tKMSKeyId
+    , tHomeRegion
     , tName
     , tIncludeGlobalServiceEvents
     , tCloudWatchLogsRoleARN
     , tS3BucketName
+    , tIsMultiRegionTrail
     ) where
 
 import           Network.AWS.CloudTrail.AddTags
diff --git a/gen/Network/AWS/CloudTrail/AddTags.hs b/gen/Network/AWS/CloudTrail/AddTags.hs
--- a/gen/Network/AWS/CloudTrail/AddTags.hs
+++ b/gen/Network/AWS/CloudTrail/AddTags.hs
@@ -22,7 +22,8 @@
 -- unique per trail. Overwrites an existing tag\'s value when a new value
 -- is specified for an existing tag key. If you specify a key without a
 -- value, the tag will be created with the specified key and a value of
--- null.
+-- null. You can tag a trail that applies to all regions only from the
+-- region in which the trail was created (that is, from its home region).
 --
 -- /See:/ <http://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AddTags.html AWS API Reference> for AddTags.
 module Network.AWS.CloudTrail.AddTags
@@ -43,6 +44,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
diff --git a/gen/Network/AWS/CloudTrail/CreateTrail.hs b/gen/Network/AWS/CloudTrail/CreateTrail.hs
--- a/gen/Network/AWS/CloudTrail/CreateTrail.hs
+++ b/gen/Network/AWS/CloudTrail/CreateTrail.hs
@@ -19,7 +19,8 @@
 -- Portability : non-portable (GHC extensions)
 --
 -- Creates a trail that specifies the settings for delivery of log data to
--- an Amazon S3 bucket.
+-- an Amazon S3 bucket. A maximum of five trails can exist in a region,
+-- irrespective of the region in which they were created.
 --
 -- /See:/ <http://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateTrail.html AWS API Reference> for CreateTrail.
 module Network.AWS.CloudTrail.CreateTrail
@@ -35,6 +36,7 @@
     , ctKMSKeyId
     , ctIncludeGlobalServiceEvents
     , ctCloudWatchLogsRoleARN
+    , ctIsMultiRegionTrail
     , ctName
     , ctS3BucketName
 
@@ -52,11 +54,13 @@
     , ctrsIncludeGlobalServiceEvents
     , ctrsCloudWatchLogsRoleARN
     , ctrsS3BucketName
+    , ctrsIsMultiRegionTrail
     , ctrsResponseStatus
     ) where
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
@@ -72,6 +76,7 @@
     , _ctKMSKeyId                   :: !(Maybe Text)
     , _ctIncludeGlobalServiceEvents :: !(Maybe Bool)
     , _ctCloudWatchLogsRoleARN      :: !(Maybe Text)
+    , _ctIsMultiRegionTrail         :: !(Maybe Bool)
     , _ctName                       :: !Text
     , _ctS3BucketName               :: !Text
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
@@ -94,6 +99,8 @@
 --
 -- * 'ctCloudWatchLogsRoleARN'
 --
+-- * 'ctIsMultiRegionTrail'
+--
 -- * 'ctName'
 --
 -- * 'ctS3BucketName'
@@ -110,6 +117,7 @@
     , _ctKMSKeyId = Nothing
     , _ctIncludeGlobalServiceEvents = Nothing
     , _ctCloudWatchLogsRoleARN = Nothing
+    , _ctIsMultiRegionTrail = Nothing
     , _ctName = pName_
     , _ctS3BucketName = pS3BucketName_
     }
@@ -172,6 +180,11 @@
 ctCloudWatchLogsRoleARN :: Lens' CreateTrail (Maybe Text)
 ctCloudWatchLogsRoleARN = lens _ctCloudWatchLogsRoleARN (\ s a -> s{_ctCloudWatchLogsRoleARN = a});
 
+-- | Specifies whether the trail is created in the current region or in all
+-- regions. The default is false.
+ctIsMultiRegionTrail :: Lens' CreateTrail (Maybe Bool)
+ctIsMultiRegionTrail = lens _ctIsMultiRegionTrail (\ s a -> s{_ctIsMultiRegionTrail = a});
+
 -- | Specifies the name of the trail. The name must meet the following
 -- requirements:
 --
@@ -208,6 +221,7 @@
                      <*> (x .?> "IncludeGlobalServiceEvents")
                      <*> (x .?> "CloudWatchLogsRoleArn")
                      <*> (x .?> "S3BucketName")
+                     <*> (x .?> "IsMultiRegionTrail")
                      <*> (pure (fromEnum s)))
 
 instance ToHeaders CreateTrail where
@@ -235,6 +249,7 @@
                     _ctIncludeGlobalServiceEvents,
                   ("CloudWatchLogsRoleArn" .=) <$>
                     _ctCloudWatchLogsRoleARN,
+                  ("IsMultiRegionTrail" .=) <$> _ctIsMultiRegionTrail,
                   Just ("Name" .= _ctName),
                   Just ("S3BucketName" .= _ctS3BucketName)])
 
@@ -259,6 +274,7 @@
     , _ctrsIncludeGlobalServiceEvents :: !(Maybe Bool)
     , _ctrsCloudWatchLogsRoleARN      :: !(Maybe Text)
     , _ctrsS3BucketName               :: !(Maybe Text)
+    , _ctrsIsMultiRegionTrail         :: !(Maybe Bool)
     , _ctrsResponseStatus             :: !Int
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
 
@@ -286,6 +302,8 @@
 --
 -- * 'ctrsS3BucketName'
 --
+-- * 'ctrsIsMultiRegionTrail'
+--
 -- * 'ctrsResponseStatus'
 createTrailResponse
     :: Int -- ^ 'ctrsResponseStatus'
@@ -302,6 +320,7 @@
     , _ctrsIncludeGlobalServiceEvents = Nothing
     , _ctrsCloudWatchLogsRoleARN = Nothing
     , _ctrsS3BucketName = Nothing
+    , _ctrsIsMultiRegionTrail = Nothing
     , _ctrsResponseStatus = pResponseStatus_
     }
 
@@ -355,6 +374,10 @@
 -- files.
 ctrsS3BucketName :: Lens' CreateTrailResponse (Maybe Text)
 ctrsS3BucketName = lens _ctrsS3BucketName (\ s a -> s{_ctrsS3BucketName = a});
+
+-- | Specifies whether the trail exists in one region or in all regions.
+ctrsIsMultiRegionTrail :: Lens' CreateTrailResponse (Maybe Bool)
+ctrsIsMultiRegionTrail = lens _ctrsIsMultiRegionTrail (\ s a -> s{_ctrsIsMultiRegionTrail = a});
 
 -- | The response status code.
 ctrsResponseStatus :: Lens' CreateTrailResponse Int
diff --git a/gen/Network/AWS/CloudTrail/DeleteTrail.hs b/gen/Network/AWS/CloudTrail/DeleteTrail.hs
--- a/gen/Network/AWS/CloudTrail/DeleteTrail.hs
+++ b/gen/Network/AWS/CloudTrail/DeleteTrail.hs
@@ -19,7 +19,9 @@
 -- Portability : non-portable (GHC extensions)
 --
 -- Deletes a trail. This operation must be called from the region in which
--- the trail was created.
+-- the trail was created. 'DeleteTrail' cannot be called on the shadow
+-- trails (replicated trails in other regions) of a trail that is enabled
+-- in all regions.
 --
 -- /See:/ <http://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteTrail.html AWS API Reference> for DeleteTrail.
 module Network.AWS.CloudTrail.DeleteTrail
@@ -39,6 +41,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
diff --git a/gen/Network/AWS/CloudTrail/DescribeTrails.hs b/gen/Network/AWS/CloudTrail/DescribeTrails.hs
--- a/gen/Network/AWS/CloudTrail/DescribeTrails.hs
+++ b/gen/Network/AWS/CloudTrail/DescribeTrails.hs
@@ -28,6 +28,7 @@
       describeTrails
     , DescribeTrails
     -- * Request Lenses
+    , dtIncludeShadowTrails
     , dtTrailNameList
 
     -- * Destructuring the Response
@@ -40,6 +41,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
@@ -47,27 +49,48 @@
 -- | Returns information about the trail.
 --
 -- /See:/ 'describeTrails' smart constructor.
-newtype DescribeTrails = DescribeTrails'
-    { _dtTrailNameList :: Maybe [Text]
+data DescribeTrails = DescribeTrails'
+    { _dtIncludeShadowTrails :: !(Maybe Bool)
+    , _dtTrailNameList       :: !(Maybe [Text])
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
 
 -- | Creates a value of 'DescribeTrails' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
+-- * 'dtIncludeShadowTrails'
+--
 -- * 'dtTrailNameList'
 describeTrails
     :: DescribeTrails
 describeTrails =
     DescribeTrails'
-    { _dtTrailNameList = Nothing
+    { _dtIncludeShadowTrails = Nothing
+    , _dtTrailNameList = Nothing
     }
 
+-- | Specifies whether to include shadow trails in the response. A shadow
+-- trail is the replication in a region of a trail that was created in a
+-- different region. The default is true.
+dtIncludeShadowTrails :: Lens' DescribeTrails (Maybe Bool)
+dtIncludeShadowTrails = lens _dtIncludeShadowTrails (\ s a -> s{_dtIncludeShadowTrails = a});
+
 -- | Specifies a list of trail names, trail ARNs, or both, of the trails to
 -- describe. The format of a trail ARN is
 -- 'arn:aws:cloudtrail:us-east-1:123456789012:trail\/MyTrail'. If an empty
 -- list is specified, information for the trail in the current region is
 -- returned.
+--
+-- -   If an empty list is specified and 'IncludeShadowTrails' is false,
+--     then information for all trails in the current region is returned.
+-- -   If an empty list is specified and IncludeShadowTrails is null or
+--     true, then information for all trails in the current region and any
+--     associated shadow trails in other regions is returned.
+--
+-- If one or more trail names are specified, information is returned only
+-- if the names match the names of trails belonging only to the current
+-- region. To return information about a trail in another region, you must
+-- specify its trail ARN.
 dtTrailNameList :: Lens' DescribeTrails [Text]
 dtTrailNameList = lens _dtTrailNameList (\ s a -> s{_dtTrailNameList = a}) . _Default . _Coerce;
 
@@ -95,7 +118,9 @@
         toJSON DescribeTrails'{..}
           = object
               (catMaybes
-                 [("trailNameList" .=) <$> _dtTrailNameList])
+                 [("includeShadowTrails" .=) <$>
+                    _dtIncludeShadowTrails,
+                  ("trailNameList" .=) <$> _dtTrailNameList])
 
 instance ToPath DescribeTrails where
         toPath = const "/"
diff --git a/gen/Network/AWS/CloudTrail/GetTrailStatus.hs b/gen/Network/AWS/CloudTrail/GetTrailStatus.hs
--- a/gen/Network/AWS/CloudTrail/GetTrailStatus.hs
+++ b/gen/Network/AWS/CloudTrail/GetTrailStatus.hs
@@ -59,6 +59,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
@@ -84,8 +85,9 @@
     }
 
 -- | Specifies the name or the CloudTrail ARN of the trail for which you are
--- requesting status. The format of a trail ARN is
--- 'arn:aws:cloudtrail:us-east-1:123456789012:trail\/MyTrail'.
+-- requesting status. To get the status of a shadow trail (a replication of
+-- the trail in another region), you must specify its ARN. The format of a
+-- trail ARN is 'arn:aws:cloudtrail:us-east-1:123456789012:trail\/MyTrail'.
 gtsName :: Lens' GetTrailStatus Text
 gtsName = lens _gtsName (\ s a -> s{_gtsName = a});
 
diff --git a/gen/Network/AWS/CloudTrail/ListPublicKeys.hs b/gen/Network/AWS/CloudTrail/ListPublicKeys.hs
--- a/gen/Network/AWS/CloudTrail/ListPublicKeys.hs
+++ b/gen/Network/AWS/CloudTrail/ListPublicKeys.hs
@@ -50,6 +50,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
diff --git a/gen/Network/AWS/CloudTrail/ListTags.hs b/gen/Network/AWS/CloudTrail/ListTags.hs
--- a/gen/Network/AWS/CloudTrail/ListTags.hs
+++ b/gen/Network/AWS/CloudTrail/ListTags.hs
@@ -18,6 +18,8 @@
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
+-- Lists the tags for the specified trail or trails in the current region.
+--
 -- Lists the tags for the trail in the current region.
 --
 -- /See:/ <http://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListTags.html AWS API Reference> for ListTags.
@@ -41,6 +43,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
diff --git a/gen/Network/AWS/CloudTrail/LookupEvents.hs b/gen/Network/AWS/CloudTrail/LookupEvents.hs
--- a/gen/Network/AWS/CloudTrail/LookupEvents.hs
+++ b/gen/Network/AWS/CloudTrail/LookupEvents.hs
@@ -60,6 +60,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
diff --git a/gen/Network/AWS/CloudTrail/RemoveTags.hs b/gen/Network/AWS/CloudTrail/RemoveTags.hs
--- a/gen/Network/AWS/CloudTrail/RemoveTags.hs
+++ b/gen/Network/AWS/CloudTrail/RemoveTags.hs
@@ -39,6 +39,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
diff --git a/gen/Network/AWS/CloudTrail/StartLogging.hs b/gen/Network/AWS/CloudTrail/StartLogging.hs
--- a/gen/Network/AWS/CloudTrail/StartLogging.hs
+++ b/gen/Network/AWS/CloudTrail/StartLogging.hs
@@ -19,6 +19,10 @@
 -- Portability : non-portable (GHC extensions)
 --
 -- Starts the recording of AWS API calls and log file delivery for a trail.
+-- For a trail that is enabled in all regions, this operation must be
+-- called from the region in which the trail was created. This operation
+-- cannot be called on the shadow trails (replicated trails in other
+-- regions) of a trail that is enabled in all regions.
 --
 -- /See:/ <http://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartLogging.html AWS API Reference> for StartLogging.
 module Network.AWS.CloudTrail.StartLogging
@@ -38,6 +42,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
diff --git a/gen/Network/AWS/CloudTrail/StopLogging.hs b/gen/Network/AWS/CloudTrail/StopLogging.hs
--- a/gen/Network/AWS/CloudTrail/StopLogging.hs
+++ b/gen/Network/AWS/CloudTrail/StopLogging.hs
@@ -21,7 +21,11 @@
 -- Suspends the recording of AWS API calls and log file delivery for the
 -- specified trail. Under most circumstances, there is no need to use this
 -- action. You can update a trail without stopping it first. This action is
--- the only way to stop recording.
+-- the only way to stop recording. For a trail enabled in all regions, this
+-- operation must be called from the region in which the trail was created,
+-- or an 'InvalidHomeRegionException' will occur. This operation cannot be
+-- called on the shadow trails (replicated trails in other regions) of a
+-- trail enabled in all regions.
 --
 -- /See:/ <http://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html AWS API Reference> for StopLogging.
 module Network.AWS.CloudTrail.StopLogging
@@ -41,6 +45,7 @@
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
diff --git a/gen/Network/AWS/CloudTrail/Types.hs b/gen/Network/AWS/CloudTrail/Types.hs
--- a/gen/Network/AWS/CloudTrail/Types.hs
+++ b/gen/Network/AWS/CloudTrail/Types.hs
@@ -45,7 +45,9 @@
     , _TrailAlreadyExistsException
     , _InvalidS3PrefixException
     , _ResourceNotFoundException
+    , _InvalidParameterCombinationException
     , _InvalidKMSKeyIdException
+    , _InvalidHomeRegionException
 
     -- * LookupAttributeKey
     , LookupAttributeKey (..)
@@ -101,14 +103,17 @@
     , tSNSTopicName
     , tCloudWatchLogsLogGroupARN
     , tKMSKeyId
+    , tHomeRegion
     , tName
     , tIncludeGlobalServiceEvents
     , tCloudWatchLogsRoleARN
     , tS3BucketName
+    , tIsMultiRegionTrail
     ) where
 
 import           Network.AWS.CloudTrail.Types.Product
 import           Network.AWS.CloudTrail.Types.Sum
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Sign.V4
 
@@ -148,65 +153,62 @@
 -- values.
 _InvalidTimeRangeException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidTimeRangeException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidTimeRange"
+    _ServiceError . hasCode "InvalidTimeRangeException"
 
 -- | This exception is thrown when the policy on the S3 bucket is not
 -- sufficient.
 _InsufficientS3BucketPolicyException :: AsError a => Getting (First ServiceError) a ServiceError
 _InsufficientS3BucketPolicyException =
-    _ServiceError . hasStatus 403 . hasCode "InsufficientS3BucketPolicy"
+    _ServiceError . hasCode "InsufficientS3BucketPolicyException"
 
 -- | This exception is thrown when the maximum number of trails is reached.
 _MaximumNumberOfTrailsExceededException :: AsError a => Getting (First ServiceError) a ServiceError
 _MaximumNumberOfTrailsExceededException =
-    _ServiceError . hasStatus 403 . hasCode "MaximumNumberOfTrailsExceeded"
+    _ServiceError . hasCode "MaximumNumberOfTrailsExceededException"
 
 -- | This exception is thrown when the requested operation is not supported.
--- For example, this exception will occur if an attempt is made to tag a
--- trail and tagging is not supported in the current region.
 _UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError
 _UnsupportedOperationException =
-    _ServiceError . hasStatus 400 . hasCode "UnsupportedOperation"
+    _ServiceError . hasCode "UnsupportedOperationException"
 
 -- | This exception is thrown when the KMS key is disabled.
 _KMSKeyDisabledException :: AsError a => Getting (First ServiceError) a ServiceError
-_KMSKeyDisabledException =
-    _ServiceError . hasStatus 400 . hasCode "KmsKeyDisabled"
+_KMSKeyDisabledException = _ServiceError . hasCode "KmsKeyDisabledException"
 
 -- | This exception is thrown when the policy on the S3 bucket or KMS key is
 -- not sufficient.
 _InsufficientEncryptionPolicyException :: AsError a => Getting (First ServiceError) a ServiceError
 _InsufficientEncryptionPolicyException =
-    _ServiceError . hasStatus 400 . hasCode "InsufficientEncryptionPolicy"
+    _ServiceError . hasCode "InsufficientEncryptionPolicyException"
 
 -- | This exception is thrown when the policy on the SNS topic is not
 -- sufficient.
 _InsufficientSNSTopicPolicyException :: AsError a => Getting (First ServiceError) a ServiceError
 _InsufficientSNSTopicPolicyException =
-    _ServiceError . hasStatus 403 . hasCode "InsufficientSnsTopicPolicy"
+    _ServiceError . hasCode "InsufficientSnsTopicPolicyException"
 
 -- | This exception is thrown when the provided role is not valid.
 _InvalidCloudWatchLogsRoleARNException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidCloudWatchLogsRoleARNException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidCloudWatchLogsRoleArn"
+    _ServiceError . hasCode "InvalidCloudWatchLogsRoleArnException"
 
 -- | The number of tags per trail has exceeded the permitted amount.
 -- Currently, the limit is 10.
 _TagsLimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError
 _TagsLimitExceededException =
-    _ServiceError . hasStatus 400 . hasCode "TagsLimitExceeded"
+    _ServiceError . hasCode "TagsLimitExceededException"
 
 -- | This exception is thrown when an operation is called with an invalid
 -- trail ARN. The format of a trail ARN is
 -- 'arn:aws:cloudtrail:us-east-1:123456789012:trail\/MyTrail'.
 _CloudTrailARNInvalidException :: AsError a => Getting (First ServiceError) a ServiceError
 _CloudTrailARNInvalidException =
-    _ServiceError . hasStatus 400 . hasCode "CloudTrailARNInvalid"
+    _ServiceError . hasCode "CloudTrailARNInvalidException"
 
 -- | Occurs when an invalid lookup attribute is specified.
 _InvalidLookupAttributesException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidLookupAttributesException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidLookupAttributes"
+    _ServiceError . hasCode "InvalidLookupAttributesException"
 
 -- | This exception is thrown when the provided trail name is not valid.
 -- Trail names must meet the following requirements:
@@ -220,100 +222,108 @@
 -- -   Not be in IP address format (for example, 192.168.5.4)
 _InvalidTrailNameException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidTrailNameException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidTrailName"
+    _ServiceError . hasCode "InvalidTrailNameException"
 
 -- | This exception is thrown when the provided SNS topic name is not valid.
 _InvalidSNSTopicNameException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidSNSTopicNameException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidSnsTopicName"
+    _ServiceError . hasCode "InvalidSnsTopicNameException"
 
 -- | This exception is thrown when the specified resource type is not
 -- supported by CloudTrail.
 _ResourceTypeNotSupportedException :: AsError a => Getting (First ServiceError) a ServiceError
 _ResourceTypeNotSupportedException =
-    _ServiceError . hasStatus 400 . hasCode "ResourceTypeNotSupported"
+    _ServiceError . hasCode "ResourceTypeNotSupportedException"
 
 -- | Cannot set a CloudWatch Logs delivery for this region.
 _CloudWatchLogsDeliveryUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError
 _CloudWatchLogsDeliveryUnavailableException =
-    _ServiceError . hasStatus 400 . hasCode "CloudWatchLogsDeliveryUnavailable"
+    _ServiceError . hasCode "CloudWatchLogsDeliveryUnavailableException"
 
 -- | This exception is thrown when the KMS key does not exist, or when the S3
 -- bucket and the KMS key are not in the same region.
 _KMSKeyNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
-_KMSKeyNotFoundException =
-    _ServiceError . hasStatus 400 . hasCode "KmsKeyNotFound"
+_KMSKeyNotFoundException = _ServiceError . hasCode "KmsKeyNotFoundException"
 
 -- | This exception is thrown when the trail with the given name is not
 -- found.
 _TrailNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
-_TrailNotFoundException =
-    _ServiceError . hasStatus 404 . hasCode "TrailNotFound"
+_TrailNotFoundException = _ServiceError . hasCode "TrailNotFoundException"
 
 -- | This exception is deprecated.
 _TrailNotProvidedException :: AsError a => Getting (First ServiceError) a ServiceError
 _TrailNotProvidedException =
-    _ServiceError . hasStatus 404 . hasCode "TrailNotProvided"
+    _ServiceError . hasCode "TrailNotProvidedException"
 
 -- | This exception is thrown when the provided S3 bucket name is not valid.
 _InvalidS3BucketNameException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidS3BucketNameException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidS3BucketName"
+    _ServiceError . hasCode "InvalidS3BucketNameException"
 
 -- | This exception is thrown when the provided CloudWatch log group is not
 -- valid.
 _InvalidCloudWatchLogsLogGroupARNException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidCloudWatchLogsLogGroupARNException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidCloudWatchLogsLogGroupArn"
+    _ServiceError . hasCode "InvalidCloudWatchLogsLogGroupArnException"
 
 -- | This exception is thrown when the specified S3 bucket does not exist.
 _S3BucketDoesNotExistException :: AsError a => Getting (First ServiceError) a ServiceError
 _S3BucketDoesNotExistException =
-    _ServiceError . hasStatus 404 . hasCode "S3BucketDoesNotExist"
+    _ServiceError . hasCode "S3BucketDoesNotExistException"
 
 -- | Invalid token or token that was previously used in a request with
 -- different parameters. This exception is thrown if the token is invalid.
 _InvalidNextTokenException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidNextTokenException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidNextToken"
+    _ServiceError . hasCode "InvalidNextTokenException"
 
 -- | This exception is thrown when the key or value specified for the tag
 -- does not match the regular expression
 -- '^([\\\\p{L}\\\\p{Z}\\\\p{N}_.:\/=+\\\\-\']*)$'.
 _InvalidTagParameterException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidTagParameterException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidTagParameter"
+    _ServiceError . hasCode "InvalidTagParameterException"
 
 -- | This exception is thrown when the requested operation is not permitted.
 _OperationNotPermittedException :: AsError a => Getting (First ServiceError) a ServiceError
 _OperationNotPermittedException =
-    _ServiceError . hasStatus 400 . hasCode "OperationNotPermitted"
+    _ServiceError . hasCode "OperationNotPermittedException"
 
 -- | Reserved for future use.
 _InvalidTokenException :: AsError a => Getting (First ServiceError) a ServiceError
-_InvalidTokenException = _ServiceError . hasStatus 400 . hasCode "InvalidToken"
+_InvalidTokenException = _ServiceError . hasCode "InvalidTokenException"
 
 -- | This exception is thrown if the limit specified is invalid.
 _InvalidMaxResultsException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidMaxResultsException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidMaxResults"
+    _ServiceError . hasCode "InvalidMaxResultsException"
 
 -- | This exception is thrown when the specified trail already exists.
 _TrailAlreadyExistsException :: AsError a => Getting (First ServiceError) a ServiceError
 _TrailAlreadyExistsException =
-    _ServiceError . hasStatus 400 . hasCode "TrailAlreadyExists"
+    _ServiceError . hasCode "TrailAlreadyExistsException"
 
 -- | This exception is thrown when the provided S3 prefix is not valid.
 _InvalidS3PrefixException :: AsError a => Getting (First ServiceError) a ServiceError
-_InvalidS3PrefixException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidS3Prefix"
+_InvalidS3PrefixException = _ServiceError . hasCode "InvalidS3PrefixException"
 
 -- | This exception is thrown when the specified resource is not found.
 _ResourceNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
 _ResourceNotFoundException =
-    _ServiceError . hasStatus 400 . hasCode "ResourceNotFound"
+    _ServiceError . hasCode "ResourceNotFoundException"
 
+-- | This exception is thrown when the combination of parameters provided is
+-- not valid.
+_InvalidParameterCombinationException :: AsError a => Getting (First ServiceError) a ServiceError
+_InvalidParameterCombinationException =
+    _ServiceError . hasCode "InvalidParameterCombinationException"
+
 -- | This exception is thrown when the KMS key ARN is invalid.
 _InvalidKMSKeyIdException :: AsError a => Getting (First ServiceError) a ServiceError
-_InvalidKMSKeyIdException =
-    _ServiceError . hasStatus 400 . hasCode "InvalidKmsKeyId"
+_InvalidKMSKeyIdException = _ServiceError . hasCode "InvalidKmsKeyIdException"
+
+-- | This exception is thrown when an operation is called on a trail from a
+-- region other than the region in which the trail was created.
+_InvalidHomeRegionException :: AsError a => Getting (First ServiceError) a ServiceError
+_InvalidHomeRegionException =
+    _ServiceError . hasCode "InvalidHomeRegionException"
diff --git a/gen/Network/AWS/CloudTrail/Types/Product.hs b/gen/Network/AWS/CloudTrail/Types/Product.hs
--- a/gen/Network/AWS/CloudTrail/Types/Product.hs
+++ b/gen/Network/AWS/CloudTrail/Types/Product.hs
@@ -18,6 +18,7 @@
 module Network.AWS.CloudTrail.Types.Product where
 
 import           Network.AWS.CloudTrail.Types.Sum
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 
 -- | Contains information about an event that was returned by a lookup
@@ -341,10 +342,12 @@
     , _tSNSTopicName               :: !(Maybe Text)
     , _tCloudWatchLogsLogGroupARN  :: !(Maybe Text)
     , _tKMSKeyId                   :: !(Maybe Text)
+    , _tHomeRegion                 :: !(Maybe Text)
     , _tName                       :: !(Maybe Text)
     , _tIncludeGlobalServiceEvents :: !(Maybe Bool)
     , _tCloudWatchLogsRoleARN      :: !(Maybe Text)
     , _tS3BucketName               :: !(Maybe Text)
+    , _tIsMultiRegionTrail         :: !(Maybe Bool)
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
 
 -- | Creates a value of 'Trail' with the minimum fields required to make a request.
@@ -363,6 +366,8 @@
 --
 -- * 'tKMSKeyId'
 --
+-- * 'tHomeRegion'
+--
 -- * 'tName'
 --
 -- * 'tIncludeGlobalServiceEvents'
@@ -370,6 +375,8 @@
 -- * 'tCloudWatchLogsRoleARN'
 --
 -- * 'tS3BucketName'
+--
+-- * 'tIsMultiRegionTrail'
 trail
     :: Trail
 trail =
@@ -380,10 +387,12 @@
     , _tSNSTopicName = Nothing
     , _tCloudWatchLogsLogGroupARN = Nothing
     , _tKMSKeyId = Nothing
+    , _tHomeRegion = Nothing
     , _tName = Nothing
     , _tIncludeGlobalServiceEvents = Nothing
     , _tCloudWatchLogsRoleARN = Nothing
     , _tS3BucketName = Nothing
+    , _tIsMultiRegionTrail = Nothing
     }
 
 -- | Specifies whether log file validation is enabled.
@@ -421,6 +430,10 @@
 tKMSKeyId :: Lens' Trail (Maybe Text)
 tKMSKeyId = lens _tKMSKeyId (\ s a -> s{_tKMSKeyId = a});
 
+-- | The region in which the trail was created.
+tHomeRegion :: Lens' Trail (Maybe Text)
+tHomeRegion = lens _tHomeRegion (\ s a -> s{_tHomeRegion = a});
+
 -- | Name of the trail set by calling CreateTrail. The maximum length is 128
 -- characters.
 tName :: Lens' Trail (Maybe Text)
@@ -442,6 +455,11 @@
 tS3BucketName :: Lens' Trail (Maybe Text)
 tS3BucketName = lens _tS3BucketName (\ s a -> s{_tS3BucketName = a});
 
+-- | Specifies whether the trail belongs only to one region or exists in all
+-- regions.
+tIsMultiRegionTrail :: Lens' Trail (Maybe Bool)
+tIsMultiRegionTrail = lens _tIsMultiRegionTrail (\ s a -> s{_tIsMultiRegionTrail = a});
+
 instance FromJSON Trail where
         parseJSON
           = withObject "Trail"
@@ -453,7 +471,9 @@
                      <*> (x .:? "SnsTopicName")
                      <*> (x .:? "CloudWatchLogsLogGroupArn")
                      <*> (x .:? "KmsKeyId")
+                     <*> (x .:? "HomeRegion")
                      <*> (x .:? "Name")
                      <*> (x .:? "IncludeGlobalServiceEvents")
                      <*> (x .:? "CloudWatchLogsRoleArn")
-                     <*> (x .:? "S3BucketName"))
+                     <*> (x .:? "S3BucketName")
+                     <*> (x .:? "IsMultiRegionTrail"))
diff --git a/gen/Network/AWS/CloudTrail/Types/Sum.hs b/gen/Network/AWS/CloudTrail/Types/Sum.hs
--- a/gen/Network/AWS/CloudTrail/Types/Sum.hs
+++ b/gen/Network/AWS/CloudTrail/Types/Sum.hs
@@ -25,7 +25,7 @@
     | ResourceName
     | ResourceType
     | Username
-    deriving (Eq,Ord,Read,Show,Enum,Data,Typeable,Generic)
+    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)
 
 instance FromText LookupAttributeKey where
     parser = takeLowerText >>= \case
diff --git a/gen/Network/AWS/CloudTrail/UpdateTrail.hs b/gen/Network/AWS/CloudTrail/UpdateTrail.hs
--- a/gen/Network/AWS/CloudTrail/UpdateTrail.hs
+++ b/gen/Network/AWS/CloudTrail/UpdateTrail.hs
@@ -22,7 +22,9 @@
 -- trail do not require stopping the CloudTrail service. Use this action to
 -- designate an existing bucket for log delivery. If the existing bucket
 -- has previously been a target for CloudTrail log files, an IAM policy
--- exists for the bucket.
+-- exists for the bucket. 'UpdateTrail' must be called from the region in
+-- which the trail was created; otherwise, an 'InvalidHomeRegionException'
+-- is thrown.
 --
 -- /See:/ <http://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateTrail.html AWS API Reference> for UpdateTrail.
 module Network.AWS.CloudTrail.UpdateTrail
@@ -39,6 +41,7 @@
     , utIncludeGlobalServiceEvents
     , utCloudWatchLogsRoleARN
     , utS3BucketName
+    , utIsMultiRegionTrail
     , utName
 
     -- * Destructuring the Response
@@ -55,11 +58,13 @@
     , utrsIncludeGlobalServiceEvents
     , utrsCloudWatchLogsRoleARN
     , utrsS3BucketName
+    , utrsIsMultiRegionTrail
     , utrsResponseStatus
     ) where
 
 import           Network.AWS.CloudTrail.Types
 import           Network.AWS.CloudTrail.Types.Product
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Request
 import           Network.AWS.Response
@@ -76,6 +81,7 @@
     , _utIncludeGlobalServiceEvents :: !(Maybe Bool)
     , _utCloudWatchLogsRoleARN      :: !(Maybe Text)
     , _utS3BucketName               :: !(Maybe Text)
+    , _utIsMultiRegionTrail         :: !(Maybe Bool)
     , _utName                       :: !Text
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
 
@@ -99,6 +105,8 @@
 --
 -- * 'utS3BucketName'
 --
+-- * 'utIsMultiRegionTrail'
+--
 -- * 'utName'
 updateTrail
     :: Text -- ^ 'utName'
@@ -113,6 +121,7 @@
     , _utIncludeGlobalServiceEvents = Nothing
     , _utCloudWatchLogsRoleARN = Nothing
     , _utS3BucketName = Nothing
+    , _utIsMultiRegionTrail = Nothing
     , _utName = pName_
     }
 
@@ -179,6 +188,16 @@
 utS3BucketName :: Lens' UpdateTrail (Maybe Text)
 utS3BucketName = lens _utS3BucketName (\ s a -> s{_utS3BucketName = a});
 
+-- | Specifies whether the trail applies only to the current region or to all
+-- regions. The default is false. If the trail exists only in the current
+-- region and this value is set to true, shadow trails (replications of the
+-- trail) will be created in the other regions. If the trail exists in all
+-- regions and this value is set to false, the trail will remain in the
+-- region where it was created, and its shadow trails in other regions will
+-- be deleted.
+utIsMultiRegionTrail :: Lens' UpdateTrail (Maybe Bool)
+utIsMultiRegionTrail = lens _utIsMultiRegionTrail (\ s a -> s{_utIsMultiRegionTrail = a});
+
 -- | Specifies the name of the trail or trail ARN. If 'Name' is a trail name,
 -- the string must meet the following requirements:
 --
@@ -212,6 +231,7 @@
                      <*> (x .?> "IncludeGlobalServiceEvents")
                      <*> (x .?> "CloudWatchLogsRoleArn")
                      <*> (x .?> "S3BucketName")
+                     <*> (x .?> "IsMultiRegionTrail")
                      <*> (pure (fromEnum s)))
 
 instance ToHeaders UpdateTrail where
@@ -240,6 +260,7 @@
                   ("CloudWatchLogsRoleArn" .=) <$>
                     _utCloudWatchLogsRoleARN,
                   ("S3BucketName" .=) <$> _utS3BucketName,
+                  ("IsMultiRegionTrail" .=) <$> _utIsMultiRegionTrail,
                   Just ("Name" .= _utName)])
 
 instance ToPath UpdateTrail where
@@ -263,6 +284,7 @@
     , _utrsIncludeGlobalServiceEvents :: !(Maybe Bool)
     , _utrsCloudWatchLogsRoleARN      :: !(Maybe Text)
     , _utrsS3BucketName               :: !(Maybe Text)
+    , _utrsIsMultiRegionTrail         :: !(Maybe Bool)
     , _utrsResponseStatus             :: !Int
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
 
@@ -290,6 +312,8 @@
 --
 -- * 'utrsS3BucketName'
 --
+-- * 'utrsIsMultiRegionTrail'
+--
 -- * 'utrsResponseStatus'
 updateTrailResponse
     :: Int -- ^ 'utrsResponseStatus'
@@ -306,6 +330,7 @@
     , _utrsIncludeGlobalServiceEvents = Nothing
     , _utrsCloudWatchLogsRoleARN = Nothing
     , _utrsS3BucketName = Nothing
+    , _utrsIsMultiRegionTrail = Nothing
     , _utrsResponseStatus = pResponseStatus_
     }
 
@@ -359,6 +384,10 @@
 -- files.
 utrsS3BucketName :: Lens' UpdateTrailResponse (Maybe Text)
 utrsS3BucketName = lens _utrsS3BucketName (\ s a -> s{_utrsS3BucketName = a});
+
+-- | Specifies whether the trail exists in one region or in all regions.
+utrsIsMultiRegionTrail :: Lens' UpdateTrailResponse (Maybe Bool)
+utrsIsMultiRegionTrail = lens _utrsIsMultiRegionTrail (\ s a -> s{_utrsIsMultiRegionTrail = a});
 
 -- | The response status code.
 utrsResponseStatus :: Lens' UpdateTrailResponse Int
diff --git a/gen/Network/AWS/CloudTrail/Waiters.hs b/gen/Network/AWS/CloudTrail/Waiters.hs
--- a/gen/Network/AWS/CloudTrail/Waiters.hs
+++ b/gen/Network/AWS/CloudTrail/Waiters.hs
@@ -16,5 +16,6 @@
 module Network.AWS.CloudTrail.Waiters where
 
 import           Network.AWS.CloudTrail.Types
+import           Network.AWS.Lens
 import           Network.AWS.Prelude
 import           Network.AWS.Waiter