diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 
 ## Version
 
-`1.4.3`
+`1.4.4`
 
 
 ## Description
diff --git a/amazonka-cognito-identity.cabal b/amazonka-cognito-identity.cabal
--- a/amazonka-cognito-identity.cabal
+++ b/amazonka-cognito-identity.cabal
@@ -1,5 +1,5 @@
 name:                  amazonka-cognito-identity
-version:               1.4.3
+version:               1.4.4
 synopsis:              Amazon Cognito Identity SDK.
 homepage:              https://github.com/brendanhay/amazonka
 bug-reports:           https://github.com/brendanhay/amazonka/issues
@@ -11,7 +11,7 @@
 category:              Network, AWS, Cloud, Distributed Computing
 build-type:            Simple
 cabal-version:         >= 1.10
-extra-source-files:    README.md fixture/*.yaml fixture/*.proto
+extra-source-files:    README.md fixture/*.yaml fixture/*.proto src/.gitkeep
 description:
     Amazon Cognito
 
@@ -129,7 +129,7 @@
         , Network.AWS.CognitoIdentity.Types.Sum
 
     build-depends:
-          amazonka-core == 1.4.3.*
+          amazonka-core == 1.4.4.*
         , base          >= 4.7     && < 5
 
 test-suite amazonka-cognito-identity-test
@@ -149,9 +149,9 @@
         , Test.AWS.CognitoIdentity.Internal
 
     build-depends:
-          amazonka-core == 1.4.3.*
-        , amazonka-test == 1.4.3.*
-        , amazonka-cognito-identity == 1.4.3.*
+          amazonka-core == 1.4.4.*
+        , amazonka-test == 1.4.4.*
+        , amazonka-cognito-identity == 1.4.4.*
         , base
         , bytestring
         , tasty
diff --git a/gen/Network/AWS/CognitoIdentity.hs b/gen/Network/AWS/CognitoIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity.hs
@@ -153,6 +153,7 @@
     -- ** IdentityPool
     , IdentityPool
     , identityPool
+    , ipSamlProviderARNs
     , ipSupportedLoginProviders
     , ipDeveloperProviderName
     , ipOpenIdConnectProviderARNs
diff --git a/gen/Network/AWS/CognitoIdentity/CreateIdentityPool.hs b/gen/Network/AWS/CognitoIdentity/CreateIdentityPool.hs
--- a/gen/Network/AWS/CognitoIdentity/CreateIdentityPool.hs
+++ b/gen/Network/AWS/CognitoIdentity/CreateIdentityPool.hs
@@ -33,6 +33,7 @@
       createIdentityPool
     , CreateIdentityPool
     -- * Request Lenses
+    , cipSamlProviderARNs
     , cipSupportedLoginProviders
     , cipDeveloperProviderName
     , cipOpenIdConnectProviderARNs
@@ -44,6 +45,7 @@
     , identityPool
     , IdentityPool
     -- * Response Lenses
+    , ipSamlProviderARNs
     , ipSupportedLoginProviders
     , ipDeveloperProviderName
     , ipOpenIdConnectProviderARNs
@@ -64,7 +66,8 @@
 --
 -- /See:/ 'createIdentityPool' smart constructor.
 data CreateIdentityPool = CreateIdentityPool'
-    { _cipSupportedLoginProviders        :: !(Maybe (Map Text Text))
+    { _cipSamlProviderARNs               :: !(Maybe [Text])
+    , _cipSupportedLoginProviders        :: !(Maybe (Map Text Text))
     , _cipDeveloperProviderName          :: !(Maybe Text)
     , _cipOpenIdConnectProviderARNs      :: !(Maybe [Text])
     , _cipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
@@ -76,6 +79,8 @@
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
+-- * 'cipSamlProviderARNs'
+--
 -- * 'cipSupportedLoginProviders'
 --
 -- * 'cipDeveloperProviderName'
@@ -93,7 +98,8 @@
     -> CreateIdentityPool
 createIdentityPool pIdentityPoolName_ pAllowUnauthenticatedIdentities_ =
     CreateIdentityPool'
-    { _cipSupportedLoginProviders = Nothing
+    { _cipSamlProviderARNs = Nothing
+    , _cipSupportedLoginProviders = Nothing
     , _cipDeveloperProviderName = Nothing
     , _cipOpenIdConnectProviderARNs = Nothing
     , _cipCognitoIdentityProviders = Nothing
@@ -101,6 +107,10 @@
     , _cipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
     }
 
+-- | An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.
+cipSamlProviderARNs :: Lens' CreateIdentityPool [Text]
+cipSamlProviderARNs = lens _cipSamlProviderARNs (\ s a -> s{_cipSamlProviderARNs = a}) . _Default . _Coerce;
+
 -- | Optional key:value pairs mapping provider names to provider app IDs.
 cipSupportedLoginProviders :: Lens' CreateIdentityPool (HashMap Text Text)
 cipSupportedLoginProviders = lens _cipSupportedLoginProviders (\ s a -> s{_cipSupportedLoginProviders = a}) . _Default . _Map;
@@ -115,7 +125,7 @@
 cipOpenIdConnectProviderARNs :: Lens' CreateIdentityPool [Text]
 cipOpenIdConnectProviderARNs = lens _cipOpenIdConnectProviderARNs (\ s a -> s{_cipOpenIdConnectProviderARNs = a}) . _Default . _Coerce;
 
--- | A list representing a Cognito User Identity Pool and its client ID.
+-- | An array of Amazon Cognito Identity user pools.
 cipCognitoIdentityProviders :: Lens' CreateIdentityPool [CognitoIdentityProvider]
 cipCognitoIdentityProviders = lens _cipCognitoIdentityProviders (\ s a -> s{_cipCognitoIdentityProviders = a}) . _Default . _Coerce;
 
@@ -150,7 +160,8 @@
         toJSON CreateIdentityPool'{..}
           = object
               (catMaybes
-                 [("SupportedLoginProviders" .=) <$>
+                 [("SamlProviderARNs" .=) <$> _cipSamlProviderARNs,
+                  ("SupportedLoginProviders" .=) <$>
                     _cipSupportedLoginProviders,
                   ("DeveloperProviderName" .=) <$>
                     _cipDeveloperProviderName,
diff --git a/gen/Network/AWS/CognitoIdentity/DescribeIdentityPool.hs b/gen/Network/AWS/CognitoIdentity/DescribeIdentityPool.hs
--- a/gen/Network/AWS/CognitoIdentity/DescribeIdentityPool.hs
+++ b/gen/Network/AWS/CognitoIdentity/DescribeIdentityPool.hs
@@ -33,6 +33,7 @@
     , identityPool
     , IdentityPool
     -- * Response Lenses
+    , ipSamlProviderARNs
     , ipSupportedLoginProviders
     , ipDeveloperProviderName
     , ipOpenIdConnectProviderARNs
diff --git a/gen/Network/AWS/CognitoIdentity/GetCredentialsForIdentity.hs b/gen/Network/AWS/CognitoIdentity/GetCredentialsForIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity/GetCredentialsForIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity/GetCredentialsForIdentity.hs
@@ -27,6 +27,7 @@
       getCredentialsForIdentity
     , GetCredentialsForIdentity
     -- * Request Lenses
+    , gcfiCustomRoleARN
     , gcfiLogins
     , gcfiIdentityId
 
@@ -50,14 +51,17 @@
 --
 -- /See:/ 'getCredentialsForIdentity' smart constructor.
 data GetCredentialsForIdentity = GetCredentialsForIdentity'
-    { _gcfiLogins     :: !(Maybe (Map Text Text))
-    , _gcfiIdentityId :: !Text
+    { _gcfiCustomRoleARN :: !(Maybe Text)
+    , _gcfiLogins        :: !(Maybe (Map Text Text))
+    , _gcfiIdentityId    :: !Text
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
 
 -- | Creates a value of 'GetCredentialsForIdentity' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
+-- * 'gcfiCustomRoleARN'
+--
 -- * 'gcfiLogins'
 --
 -- * 'gcfiIdentityId'
@@ -66,10 +70,15 @@
     -> GetCredentialsForIdentity
 getCredentialsForIdentity pIdentityId_ =
     GetCredentialsForIdentity'
-    { _gcfiLogins = Nothing
+    { _gcfiCustomRoleARN = Nothing
+    , _gcfiLogins = Nothing
     , _gcfiIdentityId = pIdentityId_
     }
 
+-- | The Amazon Resource Name (ARN) of the role to be assumed when multiple roles were received in the token from the identity provider. For example, a SAML-based identity provider. This parameter is optional for identity providers that do not support role customization.
+gcfiCustomRoleARN :: Lens' GetCredentialsForIdentity (Maybe Text)
+gcfiCustomRoleARN = lens _gcfiCustomRoleARN (\ s a -> s{_gcfiCustomRoleARN = a});
+
 -- | A set of optional name-value pairs that map provider names to provider tokens.
 gcfiLogins :: Lens' GetCredentialsForIdentity (HashMap Text Text)
 gcfiLogins = lens _gcfiLogins (\ s a -> s{_gcfiLogins = a}) . _Default . _Map;
@@ -107,7 +116,8 @@
         toJSON GetCredentialsForIdentity'{..}
           = object
               (catMaybes
-                 [("Logins" .=) <$> _gcfiLogins,
+                 [("CustomRoleArn" .=) <$> _gcfiCustomRoleARN,
+                  ("Logins" .=) <$> _gcfiLogins,
                   Just ("IdentityId" .= _gcfiIdentityId)])
 
 instance ToPath GetCredentialsForIdentity where
diff --git a/gen/Network/AWS/CognitoIdentity/GetId.hs b/gen/Network/AWS/CognitoIdentity/GetId.hs
--- a/gen/Network/AWS/CognitoIdentity/GetId.hs
+++ b/gen/Network/AWS/CognitoIdentity/GetId.hs
@@ -83,7 +83,6 @@
 -- The available provider names for 'Logins' are as follows:
 --
 -- -   Facebook: 'graph.facebook.com'
--- -   Amazon Cognito Identity Provider: 'cognito-idp.us-east-1.amazonaws.com\/us-east-1_123456789'
 -- -   Google: 'accounts.google.com'
 -- -   Amazon: 'www.amazon.com'
 -- -   Twitter: 'api.twitter.com'
diff --git a/gen/Network/AWS/CognitoIdentity/GetOpenIdToken.hs b/gen/Network/AWS/CognitoIdentity/GetOpenIdToken.hs
--- a/gen/Network/AWS/CognitoIdentity/GetOpenIdToken.hs
+++ b/gen/Network/AWS/CognitoIdentity/GetOpenIdToken.hs
@@ -72,7 +72,7 @@
     , _goitIdentityId = pIdentityId_
     }
 
--- | A set of optional name-value pairs that map provider names to provider tokens. When using graph.facebook.com and www.amazon.com, supply the access_token returned from the provider\'s authflow. For accounts.google.com, an Amazon Cognito Identity Provider, or any other OpenId Connect provider, always include the 'id_token'.
+-- | A set of optional name-value pairs that map provider names to provider tokens. When using graph.facebook.com and www.amazon.com, supply the access_token returned from the provider\'s authflow. For accounts.google.com or any other OpenId Connect provider, always include the id_token.
 goitLogins :: Lens' GetOpenIdToken (HashMap Text Text)
 goitLogins = lens _goitLogins (\ s a -> s{_goitLogins = a}) . _Default . _Map;
 
diff --git a/gen/Network/AWS/CognitoIdentity/Types.hs b/gen/Network/AWS/CognitoIdentity/Types.hs
--- a/gen/Network/AWS/CognitoIdentity/Types.hs
+++ b/gen/Network/AWS/CognitoIdentity/Types.hs
@@ -56,6 +56,7 @@
     -- * IdentityPool
     , IdentityPool
     , identityPool
+    , ipSamlProviderARNs
     , ipSupportedLoginProviders
     , ipDeveloperProviderName
     , ipOpenIdConnectProviderARNs
diff --git a/gen/Network/AWS/CognitoIdentity/Types/Product.hs b/gen/Network/AWS/CognitoIdentity/Types/Product.hs
--- a/gen/Network/AWS/CognitoIdentity/Types/Product.hs
+++ b/gen/Network/AWS/CognitoIdentity/Types/Product.hs
@@ -21,7 +21,7 @@
 import           Network.AWS.Lens
 import           Network.AWS.Prelude
 
--- | A provider representing a Cognito User Identity Pool and its client ID.
+-- | A provider representing an Amazon Cognito Identity User Pool and its client ID.
 --
 -- /See:/ 'cognitoIdentityProvider' smart constructor.
 data CognitoIdentityProvider = CognitoIdentityProvider'
@@ -44,11 +44,11 @@
     , _cipProviderName = Nothing
     }
 
--- | The client ID for the Cognito User Identity Pool.
+-- | The client ID for the Amazon Cognito Identity User Pool.
 cipClientId :: Lens' CognitoIdentityProvider (Maybe Text)
 cipClientId = lens _cipClientId (\ s a -> s{_cipClientId = a});
 
--- | The provider name for a Cognito User Identity Pool. For example, 'cognito-idp.us-east-1.amazonaws.com\/us-east-1_123456789'.
+-- | The provider name for an Amazon Cognito Identity User Pool. For example, 'cognito-idp.us-east-1.amazonaws.com\/us-east-1_123456789'.
 cipProviderName :: Lens' CognitoIdentityProvider (Maybe Text)
 cipProviderName = lens _cipProviderName (\ s a -> s{_cipProviderName = a});
 
@@ -194,7 +194,8 @@
 --
 -- /See:/ 'identityPool' smart constructor.
 data IdentityPool = IdentityPool'
-    { _ipSupportedLoginProviders        :: !(Maybe (Map Text Text))
+    { _ipSamlProviderARNs               :: !(Maybe [Text])
+    , _ipSupportedLoginProviders        :: !(Maybe (Map Text Text))
     , _ipDeveloperProviderName          :: !(Maybe Text)
     , _ipOpenIdConnectProviderARNs      :: !(Maybe [Text])
     , _ipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
@@ -207,6 +208,8 @@
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
+-- * 'ipSamlProviderARNs'
+--
 -- * 'ipSupportedLoginProviders'
 --
 -- * 'ipDeveloperProviderName'
@@ -227,7 +230,8 @@
     -> IdentityPool
 identityPool pIdentityPoolId_ pIdentityPoolName_ pAllowUnauthenticatedIdentities_ =
     IdentityPool'
-    { _ipSupportedLoginProviders = Nothing
+    { _ipSamlProviderARNs = Nothing
+    , _ipSupportedLoginProviders = Nothing
     , _ipDeveloperProviderName = Nothing
     , _ipOpenIdConnectProviderARNs = Nothing
     , _ipCognitoIdentityProviders = Nothing
@@ -236,6 +240,10 @@
     , _ipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
     }
 
+-- | An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.
+ipSamlProviderARNs :: Lens' IdentityPool [Text]
+ipSamlProviderARNs = lens _ipSamlProviderARNs (\ s a -> s{_ipSamlProviderARNs = a}) . _Default . _Coerce;
+
 -- | Optional key:value pairs mapping provider names to provider app IDs.
 ipSupportedLoginProviders :: Lens' IdentityPool (HashMap Text Text)
 ipSupportedLoginProviders = lens _ipSupportedLoginProviders (\ s a -> s{_ipSupportedLoginProviders = a}) . _Default . _Map;
@@ -248,7 +256,7 @@
 ipOpenIdConnectProviderARNs :: Lens' IdentityPool [Text]
 ipOpenIdConnectProviderARNs = lens _ipOpenIdConnectProviderARNs (\ s a -> s{_ipOpenIdConnectProviderARNs = a}) . _Default . _Coerce;
 
--- | A list representing a Cognito User Identity Pool and its client ID.
+-- | A list representing an Amazon Cognito Identity User Pool and its client ID.
 ipCognitoIdentityProviders :: Lens' IdentityPool [CognitoIdentityProvider]
 ipCognitoIdentityProviders = lens _ipCognitoIdentityProviders (\ s a -> s{_ipCognitoIdentityProviders = a}) . _Default . _Coerce;
 
@@ -269,8 +277,9 @@
           = withObject "IdentityPool"
               (\ x ->
                  IdentityPool' <$>
-                   (x .:? "SupportedLoginProviders" .!= mempty) <*>
-                     (x .:? "DeveloperProviderName")
+                   (x .:? "SamlProviderARNs" .!= mempty) <*>
+                     (x .:? "SupportedLoginProviders" .!= mempty)
+                     <*> (x .:? "DeveloperProviderName")
                      <*> (x .:? "OpenIdConnectProviderARNs" .!= mempty)
                      <*> (x .:? "CognitoIdentityProviders" .!= mempty)
                      <*> (x .: "IdentityPoolId")
@@ -285,7 +294,8 @@
         toJSON IdentityPool'{..}
           = object
               (catMaybes
-                 [("SupportedLoginProviders" .=) <$>
+                 [("SamlProviderARNs" .=) <$> _ipSamlProviderARNs,
+                  ("SupportedLoginProviders" .=) <$>
                     _ipSupportedLoginProviders,
                   ("DeveloperProviderName" .=) <$>
                     _ipDeveloperProviderName,
diff --git a/gen/Network/AWS/CognitoIdentity/Types/Sum.hs b/gen/Network/AWS/CognitoIdentity/Types/Sum.hs
--- a/gen/Network/AWS/CognitoIdentity/Types/Sum.hs
+++ b/gen/Network/AWS/CognitoIdentity/Types/Sum.hs
@@ -29,7 +29,7 @@
         "accessdenied" -> pure AccessDenied
         "internalservererror" -> pure InternalServerError
         e -> fromTextError $ "Failure parsing CognitoErrorCode from value: '" <> e
-           <> "'. Accepted values: AccessDenied, InternalServerError"
+           <> "'. Accepted values: accessdenied, internalservererror"
 
 instance ToText CognitoErrorCode where
     toText = \case
diff --git a/gen/Network/AWS/CognitoIdentity/UpdateIdentityPool.hs b/gen/Network/AWS/CognitoIdentity/UpdateIdentityPool.hs
--- a/gen/Network/AWS/CognitoIdentity/UpdateIdentityPool.hs
+++ b/gen/Network/AWS/CognitoIdentity/UpdateIdentityPool.hs
@@ -27,6 +27,7 @@
       updateIdentityPool
     , UpdateIdentityPool
     -- * Request Lenses
+    , uipSamlProviderARNs
     , uipSupportedLoginProviders
     , uipDeveloperProviderName
     , uipOpenIdConnectProviderARNs
@@ -39,6 +40,7 @@
     , identityPool
     , IdentityPool
     -- * Response Lenses
+    , ipSamlProviderARNs
     , ipSupportedLoginProviders
     , ipDeveloperProviderName
     , ipOpenIdConnectProviderARNs
@@ -59,7 +61,8 @@
 --
 -- /See:/ 'updateIdentityPool' smart constructor.
 data UpdateIdentityPool = UpdateIdentityPool'
-    { _uipSupportedLoginProviders        :: !(Maybe (Map Text Text))
+    { _uipSamlProviderARNs               :: !(Maybe [Text])
+    , _uipSupportedLoginProviders        :: !(Maybe (Map Text Text))
     , _uipDeveloperProviderName          :: !(Maybe Text)
     , _uipOpenIdConnectProviderARNs      :: !(Maybe [Text])
     , _uipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
@@ -72,6 +75,8 @@
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
+-- * 'uipSamlProviderARNs'
+--
 -- * 'uipSupportedLoginProviders'
 --
 -- * 'uipDeveloperProviderName'
@@ -92,7 +97,8 @@
     -> UpdateIdentityPool
 updateIdentityPool pIdentityPoolId_ pIdentityPoolName_ pAllowUnauthenticatedIdentities_ =
     UpdateIdentityPool'
-    { _uipSupportedLoginProviders = Nothing
+    { _uipSamlProviderARNs = Nothing
+    , _uipSupportedLoginProviders = Nothing
     , _uipDeveloperProviderName = Nothing
     , _uipOpenIdConnectProviderARNs = Nothing
     , _uipCognitoIdentityProviders = Nothing
@@ -101,6 +107,10 @@
     , _uipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
     }
 
+-- | An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.
+uipSamlProviderARNs :: Lens' UpdateIdentityPool [Text]
+uipSamlProviderARNs = lens _uipSamlProviderARNs (\ s a -> s{_uipSamlProviderARNs = a}) . _Default . _Coerce;
+
 -- | Optional key:value pairs mapping provider names to provider app IDs.
 uipSupportedLoginProviders :: Lens' UpdateIdentityPool (HashMap Text Text)
 uipSupportedLoginProviders = lens _uipSupportedLoginProviders (\ s a -> s{_uipSupportedLoginProviders = a}) . _Default . _Map;
@@ -113,7 +123,7 @@
 uipOpenIdConnectProviderARNs :: Lens' UpdateIdentityPool [Text]
 uipOpenIdConnectProviderARNs = lens _uipOpenIdConnectProviderARNs (\ s a -> s{_uipOpenIdConnectProviderARNs = a}) . _Default . _Coerce;
 
--- | A list representing a Cognito User Identity Pool and its client ID.
+-- | A list representing an Amazon Cognito Identity User Pool and its client ID.
 uipCognitoIdentityProviders :: Lens' UpdateIdentityPool [CognitoIdentityProvider]
 uipCognitoIdentityProviders = lens _uipCognitoIdentityProviders (\ s a -> s{_uipCognitoIdentityProviders = a}) . _Default . _Coerce;
 
@@ -152,7 +162,8 @@
         toJSON UpdateIdentityPool'{..}
           = object
               (catMaybes
-                 [("SupportedLoginProviders" .=) <$>
+                 [("SamlProviderARNs" .=) <$> _uipSamlProviderARNs,
+                  ("SupportedLoginProviders" .=) <$>
                     _uipSupportedLoginProviders,
                   ("DeveloperProviderName" .=) <$>
                     _uipDeveloperProviderName,
diff --git a/src/.gitkeep b/src/.gitkeep
new file mode 100644
--- /dev/null
+++ b/src/.gitkeep