diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 
 ## Version
 
-`1.4.5`
+`1.5.0`
 
 
 ## Description
diff --git a/amazonka-cognito-identity.cabal b/amazonka-cognito-identity.cabal
--- a/amazonka-cognito-identity.cabal
+++ b/amazonka-cognito-identity.cabal
@@ -1,13 +1,13 @@
 name:                  amazonka-cognito-identity
-version:               1.4.5
+version:               1.5.0
 synopsis:              Amazon Cognito Identity SDK.
 homepage:              https://github.com/brendanhay/amazonka
 bug-reports:           https://github.com/brendanhay/amazonka/issues
-license:               OtherLicense
+license:               MPL-2.0
 license-file:          LICENSE
 author:                Brendan Hay
-maintainer:            Brendan Hay <brendan.g.hay@gmail.com>
-copyright:             Copyright (c) 2013-2016 Brendan Hay
+maintainer:            Brendan Hay <brendan.g.hay+amazonka@gmail.com>
+copyright:             Copyright (c) 2013-2017 Brendan Hay
 category:              Network, AWS, Cloud, Distributed Computing
 build-type:            Simple
 cabal-version:         >= 1.10
@@ -29,14 +29,19 @@
     to get started.
 
 source-repository head
-    type:     git
-    location: git://github.com/brendanhay/amazonka.git
+    type:              git
+    location:          git://github.com/brendanhay/amazonka.git
+    subdir:            amazonka-cognito-identity
 
 library
     default-language:  Haskell2010
     hs-source-dirs:    src gen
 
-    ghc-options:       -Wall
+    ghc-options:
+        -Wall
+        -fwarn-incomplete-uni-patterns
+        -fwarn-incomplete-record-updates
+        -funbox-strict-fields
 
     exposed-modules:
           Network.AWS.CognitoIdentity
@@ -66,7 +71,7 @@
         , Network.AWS.CognitoIdentity.Types.Sum
 
     build-depends:
-          amazonka-core == 1.4.5.*
+          amazonka-core == 1.5.0.*
         , base          >= 4.7     && < 5
 
 test-suite amazonka-cognito-identity-test
@@ -86,9 +91,9 @@
         , Test.AWS.CognitoIdentity.Internal
 
     build-depends:
-          amazonka-core == 1.4.5.*
-        , amazonka-test == 1.4.5.*
-        , amazonka-cognito-identity == 1.4.5.*
+          amazonka-core == 1.5.0.*
+        , amazonka-test == 1.5.0.*
+        , amazonka-cognito-identity
         , base
         , bytestring
         , tasty
diff --git a/gen/Network/AWS/CognitoIdentity.hs b/gen/Network/AWS/CognitoIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity.hs
@@ -5,9 +5,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -126,13 +126,23 @@
 
     -- * Types
 
+    -- ** AmbiguousRoleResolutionType
+    , AmbiguousRoleResolutionType (..)
+
     -- ** CognitoErrorCode
     , CognitoErrorCode (..)
 
+    -- ** MappingRuleMatchType
+    , MappingRuleMatchType (..)
+
+    -- ** RoleMappingType
+    , RoleMappingType (..)
+
     -- ** CognitoIdentityProvider
     , CognitoIdentityProvider
     , cognitoIdentityProvider
     , cipClientId
+    , cipServerSideTokenCheck
     , cipProviderName
 
     -- ** Credentials
@@ -169,6 +179,26 @@
     , ipsdIdentityPoolId
     , ipsdIdentityPoolName
 
+    -- ** MappingRule
+    , MappingRule
+    , mappingRule
+    , mrClaim
+    , mrMatchType
+    , mrValue
+    , mrRoleARN
+
+    -- ** RoleMapping
+    , RoleMapping
+    , roleMapping
+    , rmRulesConfiguration
+    , rmAmbiguousRoleResolution
+    , rmType
+
+    -- ** RulesConfigurationType
+    , RulesConfigurationType
+    , rulesConfigurationType
+    , rctRules
+
     -- ** UnprocessedIdentityId
     , UnprocessedIdentityId
     , unprocessedIdentityId
@@ -176,26 +206,26 @@
     , uiiIdentityId
     ) where
 
-import           Network.AWS.CognitoIdentity.CreateIdentityPool
-import           Network.AWS.CognitoIdentity.DeleteIdentities
-import           Network.AWS.CognitoIdentity.DeleteIdentityPool
-import           Network.AWS.CognitoIdentity.DescribeIdentity
-import           Network.AWS.CognitoIdentity.DescribeIdentityPool
-import           Network.AWS.CognitoIdentity.GetCredentialsForIdentity
-import           Network.AWS.CognitoIdentity.GetId
-import           Network.AWS.CognitoIdentity.GetIdentityPoolRoles
-import           Network.AWS.CognitoIdentity.GetOpenIdToken
-import           Network.AWS.CognitoIdentity.GetOpenIdTokenForDeveloperIdentity
-import           Network.AWS.CognitoIdentity.ListIdentities
-import           Network.AWS.CognitoIdentity.ListIdentityPools
-import           Network.AWS.CognitoIdentity.LookupDeveloperIdentity
-import           Network.AWS.CognitoIdentity.MergeDeveloperIdentities
-import           Network.AWS.CognitoIdentity.SetIdentityPoolRoles
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.UnlinkDeveloperIdentity
-import           Network.AWS.CognitoIdentity.UnlinkIdentity
-import           Network.AWS.CognitoIdentity.UpdateIdentityPool
-import           Network.AWS.CognitoIdentity.Waiters
+import Network.AWS.CognitoIdentity.CreateIdentityPool
+import Network.AWS.CognitoIdentity.DeleteIdentities
+import Network.AWS.CognitoIdentity.DeleteIdentityPool
+import Network.AWS.CognitoIdentity.DescribeIdentity
+import Network.AWS.CognitoIdentity.DescribeIdentityPool
+import Network.AWS.CognitoIdentity.GetCredentialsForIdentity
+import Network.AWS.CognitoIdentity.GetId
+import Network.AWS.CognitoIdentity.GetIdentityPoolRoles
+import Network.AWS.CognitoIdentity.GetOpenIdToken
+import Network.AWS.CognitoIdentity.GetOpenIdTokenForDeveloperIdentity
+import Network.AWS.CognitoIdentity.ListIdentities
+import Network.AWS.CognitoIdentity.ListIdentityPools
+import Network.AWS.CognitoIdentity.LookupDeveloperIdentity
+import Network.AWS.CognitoIdentity.MergeDeveloperIdentities
+import Network.AWS.CognitoIdentity.SetIdentityPoolRoles
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.UnlinkDeveloperIdentity
+import Network.AWS.CognitoIdentity.UnlinkIdentity
+import Network.AWS.CognitoIdentity.UpdateIdentityPool
+import Network.AWS.CognitoIdentity.Waiters
 
 {- $errors
 Error matchers are designed for use with the functions provided by
diff --git a/gen/Network/AWS/CognitoIdentity/CreateIdentityPool.hs b/gen/Network/AWS/CognitoIdentity/CreateIdentityPool.hs
--- a/gen/Network/AWS/CognitoIdentity/CreateIdentityPool.hs
+++ b/gen/Network/AWS/CognitoIdentity/CreateIdentityPool.hs
@@ -12,15 +12,27 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.CreateIdentityPool
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
--- Creates a new identity pool. The identity pool is a store of user identity information that is specific to your AWS account. The limit on identity pools is 60 per account. The keys for @SupportedLoginProviders@ are as follows:     * Facebook: @graph.facebook.com@     * Google: @accounts.google.com@     * Amazon: @www.amazon.com@     * Twitter: @api.twitter.com@     * Digits: @www.digits.com@
+-- Creates a new identity pool. The identity pool is a store of user identity information that is specific to your AWS account. The limit on identity pools is 60 per account. The keys for @SupportedLoginProviders@ are as follows:
 --
 --
+--     * Facebook: @graph.facebook.com@
+--
+--     * Google: @accounts.google.com@
+--
+--     * Amazon: @www.amazon.com@
+--
+--     * Twitter: @api.twitter.com@
+--
+--     * Digits: @www.digits.com@
+--
+--
+--
 -- You must use AWS Developer credentials to call this API.
 --
 module Network.AWS.CognitoIdentity.CreateIdentityPool
@@ -51,12 +63,12 @@
     , ipAllowUnauthenticatedIdentities
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the CreateIdentityPool action.
 --
@@ -64,15 +76,16 @@
 --
 -- /See:/ 'createIdentityPool' smart constructor.
 data CreateIdentityPool = CreateIdentityPool'
-    { _cipSamlProviderARNs               :: !(Maybe [Text])
-    , _cipSupportedLoginProviders        :: !(Maybe (Map Text Text))
-    , _cipDeveloperProviderName          :: !(Maybe Text)
-    , _cipOpenIdConnectProviderARNs      :: !(Maybe [Text])
-    , _cipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
-    , _cipIdentityPoolName               :: !Text
-    , _cipAllowUnauthenticatedIdentities :: !Bool
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _cipSamlProviderARNs               :: !(Maybe [Text])
+  , _cipSupportedLoginProviders        :: !(Maybe (Map Text Text))
+  , _cipDeveloperProviderName          :: !(Maybe Text)
+  , _cipOpenIdConnectProviderARNs      :: !(Maybe [Text])
+  , _cipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
+  , _cipIdentityPoolName               :: !Text
+  , _cipAllowUnauthenticatedIdentities :: !Bool
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'CreateIdentityPool' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -85,7 +98,7 @@
 --
 -- * 'cipOpenIdConnectProviderARNs' - A list of OpendID Connect provider ARNs.
 --
--- * 'cipCognitoIdentityProviders' - An array of Amazon Cognito Identity user pools.
+-- * 'cipCognitoIdentityProviders' - An array of Amazon Cognito Identity user pools and their client IDs.
 --
 -- * 'cipIdentityPoolName' - A string that you provide.
 --
@@ -95,16 +108,17 @@
     -> Bool -- ^ 'cipAllowUnauthenticatedIdentities'
     -> CreateIdentityPool
 createIdentityPool pIdentityPoolName_ pAllowUnauthenticatedIdentities_ =
-    CreateIdentityPool'
-    { _cipSamlProviderARNs = Nothing
-    , _cipSupportedLoginProviders = Nothing
-    , _cipDeveloperProviderName = Nothing
-    , _cipOpenIdConnectProviderARNs = Nothing
-    , _cipCognitoIdentityProviders = Nothing
-    , _cipIdentityPoolName = pIdentityPoolName_
-    , _cipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
-    }
+  CreateIdentityPool'
+  { _cipSamlProviderARNs = Nothing
+  , _cipSupportedLoginProviders = Nothing
+  , _cipDeveloperProviderName = Nothing
+  , _cipOpenIdConnectProviderARNs = Nothing
+  , _cipCognitoIdentityProviders = Nothing
+  , _cipIdentityPoolName = pIdentityPoolName_
+  , _cipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
+  }
 
+
 -- | An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.
 cipSamlProviderARNs :: Lens' CreateIdentityPool [Text]
 cipSamlProviderARNs = lens _cipSamlProviderARNs (\ s a -> s{_cipSamlProviderARNs = a}) . _Default . _Coerce;
@@ -121,7 +135,7 @@
 cipOpenIdConnectProviderARNs :: Lens' CreateIdentityPool [Text]
 cipOpenIdConnectProviderARNs = lens _cipOpenIdConnectProviderARNs (\ s a -> s{_cipOpenIdConnectProviderARNs = a}) . _Default . _Coerce;
 
--- | An array of Amazon Cognito Identity user pools.
+-- | An array of Amazon Cognito Identity user pools and their client IDs.
 cipCognitoIdentityProviders :: Lens' CreateIdentityPool [CognitoIdentityProvider]
 cipCognitoIdentityProviders = lens _cipCognitoIdentityProviders (\ s a -> s{_cipCognitoIdentityProviders = a}) . _Default . _Coerce;
 
@@ -138,9 +152,9 @@
         request = postJSON cognitoIdentity
         response = receiveJSON (\ s h x -> eitherParseJSON x)
 
-instance Hashable CreateIdentityPool
+instance Hashable CreateIdentityPool where
 
-instance NFData CreateIdentityPool
+instance NFData CreateIdentityPool where
 
 instance ToHeaders CreateIdentityPool where
         toHeaders
diff --git a/gen/Network/AWS/CognitoIdentity/DeleteIdentities.hs b/gen/Network/AWS/CognitoIdentity/DeleteIdentities.hs
--- a/gen/Network/AWS/CognitoIdentity/DeleteIdentities.hs
+++ b/gen/Network/AWS/CognitoIdentity/DeleteIdentities.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.DeleteIdentities
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -39,12 +39,12 @@
     , dirsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @DeleteIdentities@ action.
 --
@@ -52,9 +52,10 @@
 --
 -- /See:/ 'deleteIdentities' smart constructor.
 newtype DeleteIdentities = DeleteIdentities'
-    { _diIdentityIdsToDelete :: List1 Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _diIdentityIdsToDelete :: List1 Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'DeleteIdentities' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -64,10 +65,9 @@
     :: NonEmpty Text -- ^ 'diIdentityIdsToDelete'
     -> DeleteIdentities
 deleteIdentities pIdentityIdsToDelete_ =
-    DeleteIdentities'
-    { _diIdentityIdsToDelete = _List1 # pIdentityIdsToDelete_
-    }
+  DeleteIdentities' {_diIdentityIdsToDelete = _List1 # pIdentityIdsToDelete_}
 
+
 -- | A list of 1-60 identities that you want to delete.
 diIdentityIdsToDelete :: Lens' DeleteIdentities (NonEmpty Text)
 diIdentityIdsToDelete = lens _diIdentityIdsToDelete (\ s a -> s{_diIdentityIdsToDelete = a}) . _List1;
@@ -82,9 +82,9 @@
                    (x .?> "UnprocessedIdentityIds" .!@ mempty) <*>
                      (pure (fromEnum s)))
 
-instance Hashable DeleteIdentities
+instance Hashable DeleteIdentities where
 
-instance NFData DeleteIdentities
+instance NFData DeleteIdentities where
 
 instance ToHeaders DeleteIdentities where
         toHeaders
@@ -115,10 +115,11 @@
 --
 -- /See:/ 'deleteIdentitiesResponse' smart constructor.
 data DeleteIdentitiesResponse = DeleteIdentitiesResponse'
-    { _dirsUnprocessedIdentityIds :: !(Maybe [UnprocessedIdentityId])
-    , _dirsResponseStatus         :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _dirsUnprocessedIdentityIds :: !(Maybe [UnprocessedIdentityId])
+  , _dirsResponseStatus         :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'DeleteIdentitiesResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -130,11 +131,12 @@
     :: Int -- ^ 'dirsResponseStatus'
     -> DeleteIdentitiesResponse
 deleteIdentitiesResponse pResponseStatus_ =
-    DeleteIdentitiesResponse'
-    { _dirsUnprocessedIdentityIds = Nothing
-    , _dirsResponseStatus = pResponseStatus_
-    }
+  DeleteIdentitiesResponse'
+  { _dirsUnprocessedIdentityIds = Nothing
+  , _dirsResponseStatus = pResponseStatus_
+  }
 
+
 -- | An array of UnprocessedIdentityId objects, each of which contains an ErrorCode and IdentityId.
 dirsUnprocessedIdentityIds :: Lens' DeleteIdentitiesResponse [UnprocessedIdentityId]
 dirsUnprocessedIdentityIds = lens _dirsUnprocessedIdentityIds (\ s a -> s{_dirsUnprocessedIdentityIds = a}) . _Default . _Coerce;
@@ -143,4 +145,4 @@
 dirsResponseStatus :: Lens' DeleteIdentitiesResponse Int
 dirsResponseStatus = lens _dirsResponseStatus (\ s a -> s{_dirsResponseStatus = a});
 
-instance NFData DeleteIdentitiesResponse
+instance NFData DeleteIdentitiesResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/DeleteIdentityPool.hs b/gen/Network/AWS/CognitoIdentity/DeleteIdentityPool.hs
--- a/gen/Network/AWS/CognitoIdentity/DeleteIdentityPool.hs
+++ b/gen/Network/AWS/CognitoIdentity/DeleteIdentityPool.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.DeleteIdentityPool
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -36,12 +36,12 @@
     , DeleteIdentityPoolResponse
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the DeleteIdentityPool action.
 --
@@ -49,9 +49,10 @@
 --
 -- /See:/ 'deleteIdentityPool' smart constructor.
 newtype DeleteIdentityPool = DeleteIdentityPool'
-    { _dIdentityPoolId :: Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _dIdentityPoolId :: Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'DeleteIdentityPool' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -61,10 +62,9 @@
     :: Text -- ^ 'dIdentityPoolId'
     -> DeleteIdentityPool
 deleteIdentityPool pIdentityPoolId_ =
-    DeleteIdentityPool'
-    { _dIdentityPoolId = pIdentityPoolId_
-    }
+  DeleteIdentityPool' {_dIdentityPoolId = pIdentityPoolId_}
 
+
 -- | An identity pool ID in the format REGION:GUID.
 dIdentityPoolId :: Lens' DeleteIdentityPool Text
 dIdentityPoolId = lens _dIdentityPoolId (\ s a -> s{_dIdentityPoolId = a});
@@ -75,9 +75,9 @@
         request = postJSON cognitoIdentity
         response = receiveNull DeleteIdentityPoolResponse'
 
-instance Hashable DeleteIdentityPool
+instance Hashable DeleteIdentityPool where
 
-instance NFData DeleteIdentityPool
+instance NFData DeleteIdentityPool where
 
 instance ToHeaders DeleteIdentityPool where
         toHeaders
@@ -103,13 +103,15 @@
 
 -- | /See:/ 'deleteIdentityPoolResponse' smart constructor.
 data DeleteIdentityPoolResponse =
-    DeleteIdentityPoolResponse'
-    deriving (Eq,Read,Show,Data,Typeable,Generic)
+  DeleteIdentityPoolResponse'
+  deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'DeleteIdentityPoolResponse' with the minimum fields required to make a request.
 --
 deleteIdentityPoolResponse
     :: DeleteIdentityPoolResponse
 deleteIdentityPoolResponse = DeleteIdentityPoolResponse'
 
-instance NFData DeleteIdentityPoolResponse
+
+instance NFData DeleteIdentityPoolResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/DescribeIdentity.hs b/gen/Network/AWS/CognitoIdentity/DescribeIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity/DescribeIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity/DescribeIdentity.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.DescribeIdentity
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -41,12 +41,12 @@
     , idIdentityId
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @DescribeIdentity@ action.
 --
@@ -54,9 +54,10 @@
 --
 -- /See:/ 'describeIdentity' smart constructor.
 newtype DescribeIdentity = DescribeIdentity'
-    { _diIdentityId :: Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _diIdentityId :: Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'DescribeIdentity' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -65,11 +66,9 @@
 describeIdentity
     :: Text -- ^ 'diIdentityId'
     -> DescribeIdentity
-describeIdentity pIdentityId_ =
-    DescribeIdentity'
-    { _diIdentityId = pIdentityId_
-    }
+describeIdentity pIdentityId_ = DescribeIdentity' {_diIdentityId = pIdentityId_}
 
+
 -- | A unique identifier in the format REGION:GUID.
 diIdentityId :: Lens' DescribeIdentity Text
 diIdentityId = lens _diIdentityId (\ s a -> s{_diIdentityId = a});
@@ -79,9 +78,9 @@
         request = postJSON cognitoIdentity
         response = receiveJSON (\ s h x -> eitherParseJSON x)
 
-instance Hashable DescribeIdentity
+instance Hashable DescribeIdentity where
 
-instance NFData DescribeIdentity
+instance NFData DescribeIdentity where
 
 instance ToHeaders DescribeIdentity where
         toHeaders
diff --git a/gen/Network/AWS/CognitoIdentity/DescribeIdentityPool.hs b/gen/Network/AWS/CognitoIdentity/DescribeIdentityPool.hs
--- a/gen/Network/AWS/CognitoIdentity/DescribeIdentityPool.hs
+++ b/gen/Network/AWS/CognitoIdentity/DescribeIdentityPool.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.DescribeIdentityPool
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -45,20 +45,23 @@
     , ipAllowUnauthenticatedIdentities
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the DescribeIdentityPool action.
 --
+--
+--
 -- /See:/ 'describeIdentityPool' smart constructor.
 newtype DescribeIdentityPool = DescribeIdentityPool'
-    { _dipIdentityPoolId :: Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _dipIdentityPoolId :: Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'DescribeIdentityPool' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -68,10 +71,9 @@
     :: Text -- ^ 'dipIdentityPoolId'
     -> DescribeIdentityPool
 describeIdentityPool pIdentityPoolId_ =
-    DescribeIdentityPool'
-    { _dipIdentityPoolId = pIdentityPoolId_
-    }
+  DescribeIdentityPool' {_dipIdentityPoolId = pIdentityPoolId_}
 
+
 -- | An identity pool ID in the format REGION:GUID.
 dipIdentityPoolId :: Lens' DescribeIdentityPool Text
 dipIdentityPoolId = lens _dipIdentityPoolId (\ s a -> s{_dipIdentityPoolId = a});
@@ -81,9 +83,9 @@
         request = postJSON cognitoIdentity
         response = receiveJSON (\ s h x -> eitherParseJSON x)
 
-instance Hashable DescribeIdentityPool
+instance Hashable DescribeIdentityPool where
 
-instance NFData DescribeIdentityPool
+instance NFData DescribeIdentityPool where
 
 instance ToHeaders DescribeIdentityPool where
         toHeaders
diff --git a/gen/Network/AWS/CognitoIdentity/GetCredentialsForIdentity.hs b/gen/Network/AWS/CognitoIdentity/GetCredentialsForIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity/GetCredentialsForIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity/GetCredentialsForIdentity.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.GetCredentialsForIdentity
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -42,12 +42,12 @@
     , gcfirsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @GetCredentialsForIdentity@ action.
 --
@@ -55,11 +55,12 @@
 --
 -- /See:/ 'getCredentialsForIdentity' smart constructor.
 data GetCredentialsForIdentity = GetCredentialsForIdentity'
-    { _gcfiCustomRoleARN :: !(Maybe Text)
-    , _gcfiLogins        :: !(Maybe (Map Text Text))
-    , _gcfiIdentityId    :: !Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _gcfiCustomRoleARN :: !(Maybe Text)
+  , _gcfiLogins        :: !(Maybe (Map Text Text))
+  , _gcfiIdentityId    :: !Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetCredentialsForIdentity' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -73,12 +74,13 @@
     :: Text -- ^ 'gcfiIdentityId'
     -> GetCredentialsForIdentity
 getCredentialsForIdentity pIdentityId_ =
-    GetCredentialsForIdentity'
-    { _gcfiCustomRoleARN = Nothing
-    , _gcfiLogins = Nothing
-    , _gcfiIdentityId = pIdentityId_
-    }
+  GetCredentialsForIdentity'
+  { _gcfiCustomRoleARN = Nothing
+  , _gcfiLogins = Nothing
+  , _gcfiIdentityId = pIdentityId_
+  }
 
+
 -- | The Amazon Resource Name (ARN) of the role to be assumed when multiple roles were received in the token from the identity provider. For example, a SAML-based identity provider. This parameter is optional for identity providers that do not support role customization.
 gcfiCustomRoleARN :: Lens' GetCredentialsForIdentity (Maybe Text)
 gcfiCustomRoleARN = lens _gcfiCustomRoleARN (\ s a -> s{_gcfiCustomRoleARN = a});
@@ -102,9 +104,9 @@
                    (x .?> "Credentials") <*> (x .?> "IdentityId") <*>
                      (pure (fromEnum s)))
 
-instance Hashable GetCredentialsForIdentity
+instance Hashable GetCredentialsForIdentity where
 
-instance NFData GetCredentialsForIdentity
+instance NFData GetCredentialsForIdentity where
 
 instance ToHeaders GetCredentialsForIdentity where
         toHeaders
@@ -136,11 +138,12 @@
 --
 -- /See:/ 'getCredentialsForIdentityResponse' smart constructor.
 data GetCredentialsForIdentityResponse = GetCredentialsForIdentityResponse'
-    { _gcfirsCredentials    :: !(Maybe Credentials)
-    , _gcfirsIdentityId     :: !(Maybe Text)
-    , _gcfirsResponseStatus :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _gcfirsCredentials    :: !(Maybe Credentials)
+  , _gcfirsIdentityId     :: !(Maybe Text)
+  , _gcfirsResponseStatus :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetCredentialsForIdentityResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -154,12 +157,13 @@
     :: Int -- ^ 'gcfirsResponseStatus'
     -> GetCredentialsForIdentityResponse
 getCredentialsForIdentityResponse pResponseStatus_ =
-    GetCredentialsForIdentityResponse'
-    { _gcfirsCredentials = Nothing
-    , _gcfirsIdentityId = Nothing
-    , _gcfirsResponseStatus = pResponseStatus_
-    }
+  GetCredentialsForIdentityResponse'
+  { _gcfirsCredentials = Nothing
+  , _gcfirsIdentityId = Nothing
+  , _gcfirsResponseStatus = pResponseStatus_
+  }
 
+
 -- | Credentials for the provided identity ID.
 gcfirsCredentials :: Lens' GetCredentialsForIdentityResponse (Maybe Credentials)
 gcfirsCredentials = lens _gcfirsCredentials (\ s a -> s{_gcfirsCredentials = a});
@@ -173,3 +177,4 @@
 gcfirsResponseStatus = lens _gcfirsResponseStatus (\ s a -> s{_gcfirsResponseStatus = a});
 
 instance NFData GetCredentialsForIdentityResponse
+         where
diff --git a/gen/Network/AWS/CognitoIdentity/GetId.hs b/gen/Network/AWS/CognitoIdentity/GetId.hs
--- a/gen/Network/AWS/CognitoIdentity/GetId.hs
+++ b/gen/Network/AWS/CognitoIdentity/GetId.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.GetId
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -41,46 +41,50 @@
     , girsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the GetId action.
 --
+--
+--
 -- /See:/ 'getId' smart constructor.
 data GetId = GetId'
-    { _giAccountId      :: !(Maybe Text)
-    , _giLogins         :: !(Maybe (Map Text Text))
-    , _giIdentityPoolId :: !Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _giAccountId      :: !(Maybe Text)
+  , _giLogins         :: !(Maybe (Map Text Text))
+  , _giIdentityPoolId :: !Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetId' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
 -- * 'giAccountId' - A standard AWS account ID (9+ digits).
 --
--- * 'giLogins' - A set of optional name-value pairs that map provider names to provider tokens. The available provider names for @Logins@ are as follows:     * Facebook: @graph.facebook.com@     * Google: @accounts.google.com@     * Amazon: @www.amazon.com@     * Twitter: @api.twitter.com@     * Digits: @www.digits.com@
+-- * 'giLogins' - A set of optional name-value pairs that map provider names to provider tokens. The available provider names for @Logins@ are as follows:     * Facebook: @graph.facebook.com@      * Amazon Cognito Identity Provider: @cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789@      * Google: @accounts.google.com@      * Amazon: @www.amazon.com@      * Twitter: @api.twitter.com@      * Digits: @www.digits.com@
 --
 -- * 'giIdentityPoolId' - An identity pool ID in the format REGION:GUID.
 getId
     :: Text -- ^ 'giIdentityPoolId'
     -> GetId
 getId pIdentityPoolId_ =
-    GetId'
-    { _giAccountId = Nothing
-    , _giLogins = Nothing
-    , _giIdentityPoolId = pIdentityPoolId_
-    }
+  GetId'
+  { _giAccountId = Nothing
+  , _giLogins = Nothing
+  , _giIdentityPoolId = pIdentityPoolId_
+  }
 
+
 -- | A standard AWS account ID (9+ digits).
 giAccountId :: Lens' GetId (Maybe Text)
 giAccountId = lens _giAccountId (\ s a -> s{_giAccountId = a});
 
--- | A set of optional name-value pairs that map provider names to provider tokens. The available provider names for @Logins@ are as follows:     * Facebook: @graph.facebook.com@     * Google: @accounts.google.com@     * Amazon: @www.amazon.com@     * Twitter: @api.twitter.com@     * Digits: @www.digits.com@
+-- | A set of optional name-value pairs that map provider names to provider tokens. The available provider names for @Logins@ are as follows:     * Facebook: @graph.facebook.com@      * Amazon Cognito Identity Provider: @cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789@      * Google: @accounts.google.com@      * Amazon: @www.amazon.com@      * Twitter: @api.twitter.com@      * Digits: @www.digits.com@
 giLogins :: Lens' GetId (HashMap Text Text)
 giLogins = lens _giLogins (\ s a -> s{_giLogins = a}) . _Default . _Map;
 
@@ -97,9 +101,9 @@
                  GetIdResponse' <$>
                    (x .?> "IdentityId") <*> (pure (fromEnum s)))
 
-instance Hashable GetId
+instance Hashable GetId where
 
-instance NFData GetId
+instance NFData GetId where
 
 instance ToHeaders GetId where
         toHeaders
@@ -126,12 +130,15 @@
 
 -- | Returned in response to a GetId request.
 --
+--
+--
 -- /See:/ 'getIdResponse' smart constructor.
 data GetIdResponse = GetIdResponse'
-    { _girsIdentityId     :: !(Maybe Text)
-    , _girsResponseStatus :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _girsIdentityId     :: !(Maybe Text)
+  , _girsResponseStatus :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetIdResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -143,11 +150,10 @@
     :: Int -- ^ 'girsResponseStatus'
     -> GetIdResponse
 getIdResponse pResponseStatus_ =
-    GetIdResponse'
-    { _girsIdentityId = Nothing
-    , _girsResponseStatus = pResponseStatus_
-    }
+  GetIdResponse'
+  {_girsIdentityId = Nothing, _girsResponseStatus = pResponseStatus_}
 
+
 -- | A unique identifier in the format REGION:GUID.
 girsIdentityId :: Lens' GetIdResponse (Maybe Text)
 girsIdentityId = lens _girsIdentityId (\ s a -> s{_girsIdentityId = a});
@@ -156,4 +162,4 @@
 girsResponseStatus :: Lens' GetIdResponse Int
 girsResponseStatus = lens _girsResponseStatus (\ s a -> s{_girsResponseStatus = a});
 
-instance NFData GetIdResponse
+instance NFData GetIdResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/GetIdentityPoolRoles.hs b/gen/Network/AWS/CognitoIdentity/GetIdentityPoolRoles.hs
--- a/gen/Network/AWS/CognitoIdentity/GetIdentityPoolRoles.hs
+++ b/gen/Network/AWS/CognitoIdentity/GetIdentityPoolRoles.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.GetIdentityPoolRoles
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -37,15 +37,16 @@
     -- * Response Lenses
     , giprrsRoles
     , giprrsIdentityPoolId
+    , giprrsRoleMappings
     , giprrsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @GetIdentityPoolRoles@ action.
 --
@@ -53,9 +54,10 @@
 --
 -- /See:/ 'getIdentityPoolRoles' smart constructor.
 newtype GetIdentityPoolRoles = GetIdentityPoolRoles'
-    { _giprIdentityPoolId :: Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _giprIdentityPoolId :: Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetIdentityPoolRoles' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -65,10 +67,9 @@
     :: Text -- ^ 'giprIdentityPoolId'
     -> GetIdentityPoolRoles
 getIdentityPoolRoles pIdentityPoolId_ =
-    GetIdentityPoolRoles'
-    { _giprIdentityPoolId = pIdentityPoolId_
-    }
+  GetIdentityPoolRoles' {_giprIdentityPoolId = pIdentityPoolId_}
 
+
 -- | An identity pool ID in the format REGION:GUID.
 giprIdentityPoolId :: Lens' GetIdentityPoolRoles Text
 giprIdentityPoolId = lens _giprIdentityPoolId (\ s a -> s{_giprIdentityPoolId = a});
@@ -83,11 +84,12 @@
                  GetIdentityPoolRolesResponse' <$>
                    (x .?> "Roles" .!@ mempty) <*>
                      (x .?> "IdentityPoolId")
+                     <*> (x .?> "RoleMappings" .!@ mempty)
                      <*> (pure (fromEnum s)))
 
-instance Hashable GetIdentityPoolRoles
+instance Hashable GetIdentityPoolRoles where
 
-instance NFData GetIdentityPoolRoles
+instance NFData GetIdentityPoolRoles where
 
 instance ToHeaders GetIdentityPoolRoles where
         toHeaders
@@ -117,11 +119,13 @@
 --
 -- /See:/ 'getIdentityPoolRolesResponse' smart constructor.
 data GetIdentityPoolRolesResponse = GetIdentityPoolRolesResponse'
-    { _giprrsRoles          :: !(Maybe (Map Text Text))
-    , _giprrsIdentityPoolId :: !(Maybe Text)
-    , _giprrsResponseStatus :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _giprrsRoles          :: !(Maybe (Map Text Text))
+  , _giprrsIdentityPoolId :: !(Maybe Text)
+  , _giprrsRoleMappings   :: !(Maybe (Map Text RoleMapping))
+  , _giprrsResponseStatus :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetIdentityPoolRolesResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -130,17 +134,21 @@
 --
 -- * 'giprrsIdentityPoolId' - An identity pool ID in the format REGION:GUID.
 --
+-- * 'giprrsRoleMappings' - How users for a specific identity provider are to mapped to roles. This is a String-to-'RoleMapping' object map. The string identifies the identity provider, for example, "graph.facebook.com" or "cognito-idp-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id".
+--
 -- * 'giprrsResponseStatus' - -- | The response status code.
 getIdentityPoolRolesResponse
     :: Int -- ^ 'giprrsResponseStatus'
     -> GetIdentityPoolRolesResponse
 getIdentityPoolRolesResponse pResponseStatus_ =
-    GetIdentityPoolRolesResponse'
-    { _giprrsRoles = Nothing
-    , _giprrsIdentityPoolId = Nothing
-    , _giprrsResponseStatus = pResponseStatus_
-    }
+  GetIdentityPoolRolesResponse'
+  { _giprrsRoles = Nothing
+  , _giprrsIdentityPoolId = Nothing
+  , _giprrsRoleMappings = Nothing
+  , _giprrsResponseStatus = pResponseStatus_
+  }
 
+
 -- | The map of roles associated with this pool. Currently only authenticated and unauthenticated roles are supported.
 giprrsRoles :: Lens' GetIdentityPoolRolesResponse (HashMap Text Text)
 giprrsRoles = lens _giprrsRoles (\ s a -> s{_giprrsRoles = a}) . _Default . _Map;
@@ -149,8 +157,12 @@
 giprrsIdentityPoolId :: Lens' GetIdentityPoolRolesResponse (Maybe Text)
 giprrsIdentityPoolId = lens _giprrsIdentityPoolId (\ s a -> s{_giprrsIdentityPoolId = a});
 
+-- | How users for a specific identity provider are to mapped to roles. This is a String-to-'RoleMapping' object map. The string identifies the identity provider, for example, "graph.facebook.com" or "cognito-idp-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id".
+giprrsRoleMappings :: Lens' GetIdentityPoolRolesResponse (HashMap Text RoleMapping)
+giprrsRoleMappings = lens _giprrsRoleMappings (\ s a -> s{_giprrsRoleMappings = a}) . _Default . _Map;
+
 -- | -- | The response status code.
 giprrsResponseStatus :: Lens' GetIdentityPoolRolesResponse Int
 giprrsResponseStatus = lens _giprrsResponseStatus (\ s a -> s{_giprrsResponseStatus = a});
 
-instance NFData GetIdentityPoolRolesResponse
+instance NFData GetIdentityPoolRolesResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/GetOpenIdToken.hs b/gen/Network/AWS/CognitoIdentity/GetOpenIdToken.hs
--- a/gen/Network/AWS/CognitoIdentity/GetOpenIdToken.hs
+++ b/gen/Network/AWS/CognitoIdentity/GetOpenIdToken.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.GetOpenIdToken
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -43,38 +43,39 @@
     , goitrsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the GetOpenIdToken action.
 --
+--
+--
 -- /See:/ 'getOpenIdToken' smart constructor.
 data GetOpenIdToken = GetOpenIdToken'
-    { _goitLogins     :: !(Maybe (Map Text Text))
-    , _goitIdentityId :: !Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _goitLogins     :: !(Maybe (Map Text Text))
+  , _goitIdentityId :: !Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetOpenIdToken' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
--- * 'goitLogins' - A set of optional name-value pairs that map provider names to provider tokens. When using graph.facebook.com and www.amazon.com, supply the access_token returned from the provider's authflow. For accounts.google.com or any other OpenId Connect provider, always include the id_token.
+-- * 'goitLogins' - A set of optional name-value pairs that map provider names to provider tokens. When using graph.facebook.com and www.amazon.com, supply the access_token returned from the provider's authflow. For accounts.google.com, an Amazon Cognito Identity Provider, or any other OpenId Connect provider, always include the @id_token@ .
 --
 -- * 'goitIdentityId' - A unique identifier in the format REGION:GUID.
 getOpenIdToken
     :: Text -- ^ 'goitIdentityId'
     -> GetOpenIdToken
 getOpenIdToken pIdentityId_ =
-    GetOpenIdToken'
-    { _goitLogins = Nothing
-    , _goitIdentityId = pIdentityId_
-    }
+  GetOpenIdToken' {_goitLogins = Nothing, _goitIdentityId = pIdentityId_}
 
--- | A set of optional name-value pairs that map provider names to provider tokens. When using graph.facebook.com and www.amazon.com, supply the access_token returned from the provider's authflow. For accounts.google.com or any other OpenId Connect provider, always include the id_token.
+
+-- | A set of optional name-value pairs that map provider names to provider tokens. When using graph.facebook.com and www.amazon.com, supply the access_token returned from the provider's authflow. For accounts.google.com, an Amazon Cognito Identity Provider, or any other OpenId Connect provider, always include the @id_token@ .
 goitLogins :: Lens' GetOpenIdToken (HashMap Text Text)
 goitLogins = lens _goitLogins (\ s a -> s{_goitLogins = a}) . _Default . _Map;
 
@@ -92,9 +93,9 @@
                    (x .?> "Token") <*> (x .?> "IdentityId") <*>
                      (pure (fromEnum s)))
 
-instance Hashable GetOpenIdToken
+instance Hashable GetOpenIdToken where
 
-instance NFData GetOpenIdToken
+instance NFData GetOpenIdToken where
 
 instance ToHeaders GetOpenIdToken where
         toHeaders
@@ -121,13 +122,16 @@
 
 -- | Returned in response to a successful GetOpenIdToken request.
 --
+--
+--
 -- /See:/ 'getOpenIdTokenResponse' smart constructor.
 data GetOpenIdTokenResponse = GetOpenIdTokenResponse'
-    { _goitrsToken          :: !(Maybe Text)
-    , _goitrsIdentityId     :: !(Maybe Text)
-    , _goitrsResponseStatus :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _goitrsToken          :: !(Maybe Text)
+  , _goitrsIdentityId     :: !(Maybe Text)
+  , _goitrsResponseStatus :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetOpenIdTokenResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -141,12 +145,13 @@
     :: Int -- ^ 'goitrsResponseStatus'
     -> GetOpenIdTokenResponse
 getOpenIdTokenResponse pResponseStatus_ =
-    GetOpenIdTokenResponse'
-    { _goitrsToken = Nothing
-    , _goitrsIdentityId = Nothing
-    , _goitrsResponseStatus = pResponseStatus_
-    }
+  GetOpenIdTokenResponse'
+  { _goitrsToken = Nothing
+  , _goitrsIdentityId = Nothing
+  , _goitrsResponseStatus = pResponseStatus_
+  }
 
+
 -- | An OpenID token, valid for 15 minutes.
 goitrsToken :: Lens' GetOpenIdTokenResponse (Maybe Text)
 goitrsToken = lens _goitrsToken (\ s a -> s{_goitrsToken = a});
@@ -159,4 +164,4 @@
 goitrsResponseStatus :: Lens' GetOpenIdTokenResponse Int
 goitrsResponseStatus = lens _goitrsResponseStatus (\ s a -> s{_goitrsResponseStatus = a});
 
-instance NFData GetOpenIdTokenResponse
+instance NFData GetOpenIdTokenResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/GetOpenIdTokenForDeveloperIdentity.hs b/gen/Network/AWS/CognitoIdentity/GetOpenIdTokenForDeveloperIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity/GetOpenIdTokenForDeveloperIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity/GetOpenIdTokenForDeveloperIdentity.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.GetOpenIdTokenForDeveloperIdentity
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -45,12 +45,12 @@
     , goitfdirsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @GetOpenIdTokenForDeveloperIdentity@ action.
 --
@@ -58,12 +58,13 @@
 --
 -- /See:/ 'getOpenIdTokenForDeveloperIdentity' smart constructor.
 data GetOpenIdTokenForDeveloperIdentity = GetOpenIdTokenForDeveloperIdentity'
-    { _goitfdiTokenDuration  :: !(Maybe Nat)
-    , _goitfdiIdentityId     :: !(Maybe Text)
-    , _goitfdiIdentityPoolId :: !Text
-    , _goitfdiLogins         :: !(Map Text Text)
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _goitfdiTokenDuration  :: !(Maybe Nat)
+  , _goitfdiIdentityId     :: !(Maybe Text)
+  , _goitfdiIdentityPoolId :: !Text
+  , _goitfdiLogins         :: !(Map Text Text)
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetOpenIdTokenForDeveloperIdentity' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -79,13 +80,14 @@
     :: Text -- ^ 'goitfdiIdentityPoolId'
     -> GetOpenIdTokenForDeveloperIdentity
 getOpenIdTokenForDeveloperIdentity pIdentityPoolId_ =
-    GetOpenIdTokenForDeveloperIdentity'
-    { _goitfdiTokenDuration = Nothing
-    , _goitfdiIdentityId = Nothing
-    , _goitfdiIdentityPoolId = pIdentityPoolId_
-    , _goitfdiLogins = mempty
-    }
+  GetOpenIdTokenForDeveloperIdentity'
+  { _goitfdiTokenDuration = Nothing
+  , _goitfdiIdentityId = Nothing
+  , _goitfdiIdentityPoolId = pIdentityPoolId_
+  , _goitfdiLogins = mempty
+  }
 
+
 -- | The expiration time of the token, in seconds. You can specify a custom expiration time for the token so that you can cache it. If you don't provide an expiration time, the token is valid for 15 minutes. You can exchange the token with Amazon STS for temporary AWS credentials, which are valid for a maximum of one hour. The maximum token duration you can set is 24 hours. You should take care in setting the expiration time for a token, as there are significant security implications: an attacker could use a leaked token to access your AWS resources for the token's duration.
 goitfdiTokenDuration :: Lens' GetOpenIdTokenForDeveloperIdentity (Maybe Natural)
 goitfdiTokenDuration = lens _goitfdiTokenDuration (\ s a -> s{_goitfdiTokenDuration = a}) . mapping _Nat;
@@ -103,7 +105,8 @@
 goitfdiLogins = lens _goitfdiLogins (\ s a -> s{_goitfdiLogins = a}) . _Map;
 
 instance AWSRequest
-         GetOpenIdTokenForDeveloperIdentity where
+           GetOpenIdTokenForDeveloperIdentity
+         where
         type Rs GetOpenIdTokenForDeveloperIdentity =
              GetOpenIdTokenForDeveloperIdentityResponse
         request = postJSON cognitoIdentity
@@ -115,8 +118,10 @@
                      (pure (fromEnum s)))
 
 instance Hashable GetOpenIdTokenForDeveloperIdentity
+         where
 
 instance NFData GetOpenIdTokenForDeveloperIdentity
+         where
 
 instance ToHeaders GetOpenIdTokenForDeveloperIdentity
          where
@@ -153,11 +158,12 @@
 --
 -- /See:/ 'getOpenIdTokenForDeveloperIdentityResponse' smart constructor.
 data GetOpenIdTokenForDeveloperIdentityResponse = GetOpenIdTokenForDeveloperIdentityResponse'
-    { _goitfdirsToken          :: !(Maybe Text)
-    , _goitfdirsIdentityId     :: !(Maybe Text)
-    , _goitfdirsResponseStatus :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _goitfdirsToken          :: !(Maybe Text)
+  , _goitfdirsIdentityId     :: !(Maybe Text)
+  , _goitfdirsResponseStatus :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'GetOpenIdTokenForDeveloperIdentityResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -171,12 +177,13 @@
     :: Int -- ^ 'goitfdirsResponseStatus'
     -> GetOpenIdTokenForDeveloperIdentityResponse
 getOpenIdTokenForDeveloperIdentityResponse pResponseStatus_ =
-    GetOpenIdTokenForDeveloperIdentityResponse'
-    { _goitfdirsToken = Nothing
-    , _goitfdirsIdentityId = Nothing
-    , _goitfdirsResponseStatus = pResponseStatus_
-    }
+  GetOpenIdTokenForDeveloperIdentityResponse'
+  { _goitfdirsToken = Nothing
+  , _goitfdirsIdentityId = Nothing
+  , _goitfdirsResponseStatus = pResponseStatus_
+  }
 
+
 -- | An OpenID token.
 goitfdirsToken :: Lens' GetOpenIdTokenForDeveloperIdentityResponse (Maybe Text)
 goitfdirsToken = lens _goitfdirsToken (\ s a -> s{_goitfdirsToken = a});
@@ -190,4 +197,5 @@
 goitfdirsResponseStatus = lens _goitfdirsResponseStatus (\ s a -> s{_goitfdirsResponseStatus = a});
 
 instance NFData
-         GetOpenIdTokenForDeveloperIdentityResponse
+           GetOpenIdTokenForDeveloperIdentityResponse
+         where
diff --git a/gen/Network/AWS/CognitoIdentity/ListIdentities.hs b/gen/Network/AWS/CognitoIdentity/ListIdentities.hs
--- a/gen/Network/AWS/CognitoIdentity/ListIdentities.hs
+++ b/gen/Network/AWS/CognitoIdentity/ListIdentities.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.ListIdentities
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -44,23 +44,26 @@
     , lirsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the ListIdentities action.
 --
+--
+--
 -- /See:/ 'listIdentities' smart constructor.
 data ListIdentities = ListIdentities'
-    { _liHideDisabled   :: !(Maybe Bool)
-    , _liNextToken      :: !(Maybe Text)
-    , _liIdentityPoolId :: !Text
-    , _liMaxResults     :: !Nat
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _liHideDisabled   :: !(Maybe Bool)
+  , _liNextToken      :: !(Maybe Text)
+  , _liIdentityPoolId :: !Text
+  , _liMaxResults     :: !Nat
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'ListIdentities' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -77,13 +80,14 @@
     -> Natural -- ^ 'liMaxResults'
     -> ListIdentities
 listIdentities pIdentityPoolId_ pMaxResults_ =
-    ListIdentities'
-    { _liHideDisabled = Nothing
-    , _liNextToken = Nothing
-    , _liIdentityPoolId = pIdentityPoolId_
-    , _liMaxResults = _Nat # pMaxResults_
-    }
+  ListIdentities'
+  { _liHideDisabled = Nothing
+  , _liNextToken = Nothing
+  , _liIdentityPoolId = pIdentityPoolId_
+  , _liMaxResults = _Nat # pMaxResults_
+  }
 
+
 -- | An optional boolean parameter that allows you to hide disabled identities. If omitted, the ListIdentities API will include disabled identities in the response.
 liHideDisabled :: Lens' ListIdentities (Maybe Bool)
 liHideDisabled = lens _liHideDisabled (\ s a -> s{_liHideDisabled = a});
@@ -111,9 +115,9 @@
                      (x .?> "Identities" .!@ mempty)
                      <*> (pure (fromEnum s)))
 
-instance Hashable ListIdentities
+instance Hashable ListIdentities where
 
-instance NFData ListIdentities
+instance NFData ListIdentities where
 
 instance ToHeaders ListIdentities where
         toHeaders
@@ -142,14 +146,17 @@
 
 -- | The response to a ListIdentities request.
 --
+--
+--
 -- /See:/ 'listIdentitiesResponse' smart constructor.
 data ListIdentitiesResponse = ListIdentitiesResponse'
-    { _lirsIdentityPoolId :: !(Maybe Text)
-    , _lirsNextToken      :: !(Maybe Text)
-    , _lirsIdentities     :: !(Maybe [IdentityDescription])
-    , _lirsResponseStatus :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _lirsIdentityPoolId :: !(Maybe Text)
+  , _lirsNextToken      :: !(Maybe Text)
+  , _lirsIdentities     :: !(Maybe [IdentityDescription])
+  , _lirsResponseStatus :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'ListIdentitiesResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -165,13 +172,14 @@
     :: Int -- ^ 'lirsResponseStatus'
     -> ListIdentitiesResponse
 listIdentitiesResponse pResponseStatus_ =
-    ListIdentitiesResponse'
-    { _lirsIdentityPoolId = Nothing
-    , _lirsNextToken = Nothing
-    , _lirsIdentities = Nothing
-    , _lirsResponseStatus = pResponseStatus_
-    }
+  ListIdentitiesResponse'
+  { _lirsIdentityPoolId = Nothing
+  , _lirsNextToken = Nothing
+  , _lirsIdentities = Nothing
+  , _lirsResponseStatus = pResponseStatus_
+  }
 
+
 -- | An identity pool ID in the format REGION:GUID.
 lirsIdentityPoolId :: Lens' ListIdentitiesResponse (Maybe Text)
 lirsIdentityPoolId = lens _lirsIdentityPoolId (\ s a -> s{_lirsIdentityPoolId = a});
@@ -188,4 +196,4 @@
 lirsResponseStatus :: Lens' ListIdentitiesResponse Int
 lirsResponseStatus = lens _lirsResponseStatus (\ s a -> s{_lirsResponseStatus = a});
 
-instance NFData ListIdentitiesResponse
+instance NFData ListIdentitiesResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/ListIdentityPools.hs b/gen/Network/AWS/CognitoIdentity/ListIdentityPools.hs
--- a/gen/Network/AWS/CognitoIdentity/ListIdentityPools.hs
+++ b/gen/Network/AWS/CognitoIdentity/ListIdentityPools.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.ListIdentityPools
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -41,21 +41,24 @@
     , liprsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the ListIdentityPools action.
 --
+--
+--
 -- /See:/ 'listIdentityPools' smart constructor.
 data ListIdentityPools = ListIdentityPools'
-    { _lipNextToken  :: !(Maybe Text)
-    , _lipMaxResults :: !Nat
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _lipNextToken  :: !(Maybe Text)
+  , _lipMaxResults :: !Nat
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'ListIdentityPools' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -67,11 +70,10 @@
     :: Natural -- ^ 'lipMaxResults'
     -> ListIdentityPools
 listIdentityPools pMaxResults_ =
-    ListIdentityPools'
-    { _lipNextToken = Nothing
-    , _lipMaxResults = _Nat # pMaxResults_
-    }
+  ListIdentityPools'
+  {_lipNextToken = Nothing, _lipMaxResults = _Nat # pMaxResults_}
 
+
 -- | A pagination token.
 lipNextToken :: Lens' ListIdentityPools (Maybe Text)
 lipNextToken = lens _lipNextToken (\ s a -> s{_lipNextToken = a});
@@ -91,9 +93,9 @@
                      (x .?> "NextToken")
                      <*> (pure (fromEnum s)))
 
-instance Hashable ListIdentityPools
+instance Hashable ListIdentityPools where
 
-instance NFData ListIdentityPools
+instance NFData ListIdentityPools where
 
 instance ToHeaders ListIdentityPools where
         toHeaders
@@ -120,13 +122,16 @@
 
 -- | The result of a successful ListIdentityPools action.
 --
+--
+--
 -- /See:/ 'listIdentityPoolsResponse' smart constructor.
 data ListIdentityPoolsResponse = ListIdentityPoolsResponse'
-    { _liprsIdentityPools  :: !(Maybe [IdentityPoolShortDescription])
-    , _liprsNextToken      :: !(Maybe Text)
-    , _liprsResponseStatus :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _liprsIdentityPools  :: !(Maybe [IdentityPoolShortDescription])
+  , _liprsNextToken      :: !(Maybe Text)
+  , _liprsResponseStatus :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'ListIdentityPoolsResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -140,12 +145,13 @@
     :: Int -- ^ 'liprsResponseStatus'
     -> ListIdentityPoolsResponse
 listIdentityPoolsResponse pResponseStatus_ =
-    ListIdentityPoolsResponse'
-    { _liprsIdentityPools = Nothing
-    , _liprsNextToken = Nothing
-    , _liprsResponseStatus = pResponseStatus_
-    }
+  ListIdentityPoolsResponse'
+  { _liprsIdentityPools = Nothing
+  , _liprsNextToken = Nothing
+  , _liprsResponseStatus = pResponseStatus_
+  }
 
+
 -- | The identity pools returned by the ListIdentityPools action.
 liprsIdentityPools :: Lens' ListIdentityPoolsResponse [IdentityPoolShortDescription]
 liprsIdentityPools = lens _liprsIdentityPools (\ s a -> s{_liprsIdentityPools = a}) . _Default . _Coerce;
@@ -158,4 +164,4 @@
 liprsResponseStatus :: Lens' ListIdentityPoolsResponse Int
 liprsResponseStatus = lens _liprsResponseStatus (\ s a -> s{_liprsResponseStatus = a});
 
-instance NFData ListIdentityPoolsResponse
+instance NFData ListIdentityPoolsResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/LookupDeveloperIdentity.hs b/gen/Network/AWS/CognitoIdentity/LookupDeveloperIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity/LookupDeveloperIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity/LookupDeveloperIdentity.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.LookupDeveloperIdentity
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -45,12 +45,12 @@
     , ldirsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @LookupDeveloperIdentityInput@ action.
 --
@@ -58,13 +58,14 @@
 --
 -- /See:/ 'lookupDeveloperIdentity' smart constructor.
 data LookupDeveloperIdentity = LookupDeveloperIdentity'
-    { _ldiDeveloperUserIdentifier :: !(Maybe Text)
-    , _ldiNextToken               :: !(Maybe Text)
-    , _ldiIdentityId              :: !(Maybe Text)
-    , _ldiMaxResults              :: !(Maybe Nat)
-    , _ldiIdentityPoolId          :: !Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _ldiDeveloperUserIdentifier :: !(Maybe Text)
+  , _ldiNextToken               :: !(Maybe Text)
+  , _ldiIdentityId              :: !(Maybe Text)
+  , _ldiMaxResults              :: !(Maybe Nat)
+  , _ldiIdentityPoolId          :: !Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'LookupDeveloperIdentity' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -82,14 +83,15 @@
     :: Text -- ^ 'ldiIdentityPoolId'
     -> LookupDeveloperIdentity
 lookupDeveloperIdentity pIdentityPoolId_ =
-    LookupDeveloperIdentity'
-    { _ldiDeveloperUserIdentifier = Nothing
-    , _ldiNextToken = Nothing
-    , _ldiIdentityId = Nothing
-    , _ldiMaxResults = Nothing
-    , _ldiIdentityPoolId = pIdentityPoolId_
-    }
+  LookupDeveloperIdentity'
+  { _ldiDeveloperUserIdentifier = Nothing
+  , _ldiNextToken = Nothing
+  , _ldiIdentityId = Nothing
+  , _ldiMaxResults = Nothing
+  , _ldiIdentityPoolId = pIdentityPoolId_
+  }
 
+
 -- | A unique ID used by your backend authentication process to identify a user. Typically, a developer identity provider would issue many developer user identifiers, in keeping with the number of users.
 ldiDeveloperUserIdentifier :: Lens' LookupDeveloperIdentity (Maybe Text)
 ldiDeveloperUserIdentifier = lens _ldiDeveloperUserIdentifier (\ s a -> s{_ldiDeveloperUserIdentifier = a});
@@ -122,9 +124,9 @@
                      (x .?> "DeveloperUserIdentifierList" .!@ mempty)
                      <*> (pure (fromEnum s)))
 
-instance Hashable LookupDeveloperIdentity
+instance Hashable LookupDeveloperIdentity where
 
-instance NFData LookupDeveloperIdentity
+instance NFData LookupDeveloperIdentity where
 
 instance ToHeaders LookupDeveloperIdentity where
         toHeaders
@@ -159,12 +161,13 @@
 --
 -- /See:/ 'lookupDeveloperIdentityResponse' smart constructor.
 data LookupDeveloperIdentityResponse = LookupDeveloperIdentityResponse'
-    { _ldirsNextToken                   :: !(Maybe Text)
-    , _ldirsIdentityId                  :: !(Maybe Text)
-    , _ldirsDeveloperUserIdentifierList :: !(Maybe [Text])
-    , _ldirsResponseStatus              :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _ldirsNextToken                   :: !(Maybe Text)
+  , _ldirsIdentityId                  :: !(Maybe Text)
+  , _ldirsDeveloperUserIdentifierList :: !(Maybe [Text])
+  , _ldirsResponseStatus              :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'LookupDeveloperIdentityResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -180,13 +183,14 @@
     :: Int -- ^ 'ldirsResponseStatus'
     -> LookupDeveloperIdentityResponse
 lookupDeveloperIdentityResponse pResponseStatus_ =
-    LookupDeveloperIdentityResponse'
-    { _ldirsNextToken = Nothing
-    , _ldirsIdentityId = Nothing
-    , _ldirsDeveloperUserIdentifierList = Nothing
-    , _ldirsResponseStatus = pResponseStatus_
-    }
+  LookupDeveloperIdentityResponse'
+  { _ldirsNextToken = Nothing
+  , _ldirsIdentityId = Nothing
+  , _ldirsDeveloperUserIdentifierList = Nothing
+  , _ldirsResponseStatus = pResponseStatus_
+  }
 
+
 -- | A pagination token. The first call you make will have @NextToken@ set to null. After that the service will return @NextToken@ values as needed. For example, let's say you make a request with @MaxResults@ set to 10, and there are 20 matches in the database. The service will return a pagination token as a part of the response. This token can be used to call the API again and get results starting from the 11th match.
 ldirsNextToken :: Lens' LookupDeveloperIdentityResponse (Maybe Text)
 ldirsNextToken = lens _ldirsNextToken (\ s a -> s{_ldirsNextToken = a});
@@ -203,4 +207,4 @@
 ldirsResponseStatus :: Lens' LookupDeveloperIdentityResponse Int
 ldirsResponseStatus = lens _ldirsResponseStatus (\ s a -> s{_ldirsResponseStatus = a});
 
-instance NFData LookupDeveloperIdentityResponse
+instance NFData LookupDeveloperIdentityResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/MergeDeveloperIdentities.hs b/gen/Network/AWS/CognitoIdentity/MergeDeveloperIdentities.hs
--- a/gen/Network/AWS/CognitoIdentity/MergeDeveloperIdentities.hs
+++ b/gen/Network/AWS/CognitoIdentity/MergeDeveloperIdentities.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.MergeDeveloperIdentities
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -42,12 +42,12 @@
     , mdirsResponseStatus
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @MergeDeveloperIdentities@ action.
 --
@@ -55,12 +55,13 @@
 --
 -- /See:/ 'mergeDeveloperIdentities' smart constructor.
 data MergeDeveloperIdentities = MergeDeveloperIdentities'
-    { _mdiSourceUserIdentifier      :: !Text
-    , _mdiDestinationUserIdentifier :: !Text
-    , _mdiDeveloperProviderName     :: !Text
-    , _mdiIdentityPoolId            :: !Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _mdiSourceUserIdentifier      :: !Text
+  , _mdiDestinationUserIdentifier :: !Text
+  , _mdiDeveloperProviderName     :: !Text
+  , _mdiIdentityPoolId            :: !Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'MergeDeveloperIdentities' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -79,13 +80,14 @@
     -> Text -- ^ 'mdiIdentityPoolId'
     -> MergeDeveloperIdentities
 mergeDeveloperIdentities pSourceUserIdentifier_ pDestinationUserIdentifier_ pDeveloperProviderName_ pIdentityPoolId_ =
-    MergeDeveloperIdentities'
-    { _mdiSourceUserIdentifier = pSourceUserIdentifier_
-    , _mdiDestinationUserIdentifier = pDestinationUserIdentifier_
-    , _mdiDeveloperProviderName = pDeveloperProviderName_
-    , _mdiIdentityPoolId = pIdentityPoolId_
-    }
+  MergeDeveloperIdentities'
+  { _mdiSourceUserIdentifier = pSourceUserIdentifier_
+  , _mdiDestinationUserIdentifier = pDestinationUserIdentifier_
+  , _mdiDeveloperProviderName = pDeveloperProviderName_
+  , _mdiIdentityPoolId = pIdentityPoolId_
+  }
 
+
 -- | User identifier for the source user. The value should be a @DeveloperUserIdentifier@ .
 mdiSourceUserIdentifier :: Lens' MergeDeveloperIdentities Text
 mdiSourceUserIdentifier = lens _mdiSourceUserIdentifier (\ s a -> s{_mdiSourceUserIdentifier = a});
@@ -112,9 +114,9 @@
                  MergeDeveloperIdentitiesResponse' <$>
                    (x .?> "IdentityId") <*> (pure (fromEnum s)))
 
-instance Hashable MergeDeveloperIdentities
+instance Hashable MergeDeveloperIdentities where
 
-instance NFData MergeDeveloperIdentities
+instance NFData MergeDeveloperIdentities where
 
 instance ToHeaders MergeDeveloperIdentities where
         toHeaders
@@ -152,10 +154,11 @@
 --
 -- /See:/ 'mergeDeveloperIdentitiesResponse' smart constructor.
 data MergeDeveloperIdentitiesResponse = MergeDeveloperIdentitiesResponse'
-    { _mdirsIdentityId     :: !(Maybe Text)
-    , _mdirsResponseStatus :: !Int
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _mdirsIdentityId     :: !(Maybe Text)
+  , _mdirsResponseStatus :: !Int
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'MergeDeveloperIdentitiesResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -167,11 +170,10 @@
     :: Int -- ^ 'mdirsResponseStatus'
     -> MergeDeveloperIdentitiesResponse
 mergeDeveloperIdentitiesResponse pResponseStatus_ =
-    MergeDeveloperIdentitiesResponse'
-    { _mdirsIdentityId = Nothing
-    , _mdirsResponseStatus = pResponseStatus_
-    }
+  MergeDeveloperIdentitiesResponse'
+  {_mdirsIdentityId = Nothing, _mdirsResponseStatus = pResponseStatus_}
 
+
 -- | A unique identifier in the format REGION:GUID.
 mdirsIdentityId :: Lens' MergeDeveloperIdentitiesResponse (Maybe Text)
 mdirsIdentityId = lens _mdirsIdentityId (\ s a -> s{_mdirsIdentityId = a});
@@ -181,3 +183,4 @@
 mdirsResponseStatus = lens _mdirsResponseStatus (\ s a -> s{_mdirsResponseStatus = a});
 
 instance NFData MergeDeveloperIdentitiesResponse
+         where
diff --git a/gen/Network/AWS/CognitoIdentity/SetIdentityPoolRoles.hs b/gen/Network/AWS/CognitoIdentity/SetIdentityPoolRoles.hs
--- a/gen/Network/AWS/CognitoIdentity/SetIdentityPoolRoles.hs
+++ b/gen/Network/AWS/CognitoIdentity/SetIdentityPoolRoles.hs
@@ -12,13 +12,13 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.SetIdentityPoolRoles
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
--- Sets the roles for an identity pool. These roles are used when making calls to @GetCredentialsForIdentity@ action.
+-- Sets the roles for an identity pool. These roles are used when making calls to 'GetCredentialsForIdentity' action.
 --
 --
 -- You must use AWS Developer credentials to call this API.
@@ -29,6 +29,7 @@
       setIdentityPoolRoles
     , SetIdentityPoolRoles
     -- * Request Lenses
+    , siprRoleMappings
     , siprIdentityPoolId
     , siprRoles
 
@@ -37,12 +38,12 @@
     , SetIdentityPoolRolesResponse
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @SetIdentityPoolRoles@ action.
 --
@@ -50,14 +51,18 @@
 --
 -- /See:/ 'setIdentityPoolRoles' smart constructor.
 data SetIdentityPoolRoles = SetIdentityPoolRoles'
-    { _siprIdentityPoolId :: !Text
-    , _siprRoles          :: !(Map Text Text)
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _siprRoleMappings   :: !(Maybe (Map Text RoleMapping))
+  , _siprIdentityPoolId :: !Text
+  , _siprRoles          :: !(Map Text Text)
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'SetIdentityPoolRoles' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
+-- * 'siprRoleMappings' - How users for a specific identity provider are to mapped to roles. This is a string to 'RoleMapping' object map. The string identifies the identity provider, for example, "graph.facebook.com" or "cognito-idp-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id". Up to 25 rules can be specified per identity provider.
+--
 -- * 'siprIdentityPoolId' - An identity pool ID in the format REGION:GUID.
 --
 -- * 'siprRoles' - The map of roles associated with this pool. For a given role, the key will be either "authenticated" or "unauthenticated" and the value will be the Role ARN.
@@ -65,11 +70,17 @@
     :: Text -- ^ 'siprIdentityPoolId'
     -> SetIdentityPoolRoles
 setIdentityPoolRoles pIdentityPoolId_ =
-    SetIdentityPoolRoles'
-    { _siprIdentityPoolId = pIdentityPoolId_
-    , _siprRoles = mempty
-    }
+  SetIdentityPoolRoles'
+  { _siprRoleMappings = Nothing
+  , _siprIdentityPoolId = pIdentityPoolId_
+  , _siprRoles = mempty
+  }
 
+
+-- | How users for a specific identity provider are to mapped to roles. This is a string to 'RoleMapping' object map. The string identifies the identity provider, for example, "graph.facebook.com" or "cognito-idp-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id". Up to 25 rules can be specified per identity provider.
+siprRoleMappings :: Lens' SetIdentityPoolRoles (HashMap Text RoleMapping)
+siprRoleMappings = lens _siprRoleMappings (\ s a -> s{_siprRoleMappings = a}) . _Default . _Map;
+
 -- | An identity pool ID in the format REGION:GUID.
 siprIdentityPoolId :: Lens' SetIdentityPoolRoles Text
 siprIdentityPoolId = lens _siprIdentityPoolId (\ s a -> s{_siprIdentityPoolId = a});
@@ -84,9 +95,9 @@
         request = postJSON cognitoIdentity
         response = receiveNull SetIdentityPoolRolesResponse'
 
-instance Hashable SetIdentityPoolRoles
+instance Hashable SetIdentityPoolRoles where
 
-instance NFData SetIdentityPoolRoles
+instance NFData SetIdentityPoolRoles where
 
 instance ToHeaders SetIdentityPoolRoles where
         toHeaders
@@ -102,7 +113,8 @@
         toJSON SetIdentityPoolRoles'{..}
           = object
               (catMaybes
-                 [Just ("IdentityPoolId" .= _siprIdentityPoolId),
+                 [("RoleMappings" .=) <$> _siprRoleMappings,
+                  Just ("IdentityPoolId" .= _siprIdentityPoolId),
                   Just ("Roles" .= _siprRoles)])
 
 instance ToPath SetIdentityPoolRoles where
@@ -113,13 +125,15 @@
 
 -- | /See:/ 'setIdentityPoolRolesResponse' smart constructor.
 data SetIdentityPoolRolesResponse =
-    SetIdentityPoolRolesResponse'
-    deriving (Eq,Read,Show,Data,Typeable,Generic)
+  SetIdentityPoolRolesResponse'
+  deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'SetIdentityPoolRolesResponse' with the minimum fields required to make a request.
 --
 setIdentityPoolRolesResponse
     :: SetIdentityPoolRolesResponse
 setIdentityPoolRolesResponse = SetIdentityPoolRolesResponse'
 
-instance NFData SetIdentityPoolRolesResponse
+
+instance NFData SetIdentityPoolRolesResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/Types.hs b/gen/Network/AWS/CognitoIdentity/Types.hs
--- a/gen/Network/AWS/CognitoIdentity/Types.hs
+++ b/gen/Network/AWS/CognitoIdentity/Types.hs
@@ -4,9 +4,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.Types
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -28,13 +28,23 @@
     , _ResourceNotFoundException
     , _LimitExceededException
 
+    -- * AmbiguousRoleResolutionType
+    , AmbiguousRoleResolutionType (..)
+
     -- * CognitoErrorCode
     , CognitoErrorCode (..)
 
+    -- * MappingRuleMatchType
+    , MappingRuleMatchType (..)
+
+    -- * RoleMappingType
+    , RoleMappingType (..)
+
     -- * CognitoIdentityProvider
     , CognitoIdentityProvider
     , cognitoIdentityProvider
     , cipClientId
+    , cipServerSideTokenCheck
     , cipProviderName
 
     -- * Credentials
@@ -71,6 +81,26 @@
     , ipsdIdentityPoolId
     , ipsdIdentityPoolName
 
+    -- * MappingRule
+    , MappingRule
+    , mappingRule
+    , mrClaim
+    , mrMatchType
+    , mrValue
+    , mrRoleARN
+
+    -- * RoleMapping
+    , RoleMapping
+    , roleMapping
+    , rmRulesConfiguration
+    , rmAmbiguousRoleResolution
+    , rmType
+
+    -- * RulesConfigurationType
+    , RulesConfigurationType
+    , rulesConfigurationType
+    , rctRules
+
     -- * UnprocessedIdentityId
     , UnprocessedIdentityId
     , unprocessedIdentityId
@@ -78,38 +108,40 @@
     , uiiIdentityId
     ) where
 
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.CognitoIdentity.Types.Sum
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Sign.V4
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.CognitoIdentity.Types.Sum
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Sign.V4
 
 -- | API version @2014-06-30@ of the Amazon Cognito Identity SDK configuration.
 cognitoIdentity :: Service
 cognitoIdentity =
-    Service
-    { _svcAbbrev = "CognitoIdentity"
-    , _svcSigner = v4
-    , _svcPrefix = "cognito-identity"
-    , _svcVersion = "2014-06-30"
-    , _svcEndpoint = defaultEndpoint cognitoIdentity
-    , _svcTimeout = Just 70
-    , _svcCheck = statusSuccess
-    , _svcError = parseJSONError "CognitoIdentity"
-    , _svcRetry = retry
-    }
+  Service
+  { _svcAbbrev = "CognitoIdentity"
+  , _svcSigner = v4
+  , _svcPrefix = "cognito-identity"
+  , _svcVersion = "2014-06-30"
+  , _svcEndpoint = defaultEndpoint cognitoIdentity
+  , _svcTimeout = Just 70
+  , _svcCheck = statusSuccess
+  , _svcError = parseJSONError "CognitoIdentity"
+  , _svcRetry = retry
+  }
   where
     retry =
-        Exponential
-        { _retryBase = 5.0e-2
-        , _retryGrowth = 2
-        , _retryAttempts = 5
-        , _retryCheck = check
-        }
+      Exponential
+      { _retryBase = 5.0e-2
+      , _retryGrowth = 2
+      , _retryAttempts = 5
+      , _retryCheck = check
+      }
     check e
+      | has (hasCode "ThrottledException" . hasStatus 400) e =
+        Just "throttled_exception"
       | has (hasStatus 429) e = Just "too_many_requests"
       | has (hasCode "ThrottlingException" . hasStatus 400) e =
-          Just "throttling_exception"
+        Just "throttling_exception"
       | has (hasCode "Throttling" . hasStatus 400) e = Just "throttling"
       | has (hasStatus 504) e = Just "gateway_timeout"
       | has (hasStatus 502) e = Just "bad_gateway"
@@ -118,60 +150,91 @@
       | has (hasStatus 509) e = Just "limit_exceeded"
       | otherwise = Nothing
 
+
 -- | Thrown if the identity pool has no role associated for the given auth type (auth/unauth) or if the AssumeRole fails.
 --
 --
 _InvalidIdentityPoolConfigurationException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidIdentityPoolConfigurationException =
-    _ServiceError . hasCode "InvalidIdentityPoolConfigurationException"
+  _MatchServiceError cognitoIdentity "InvalidIdentityPoolConfigurationException"
 
+
 -- | Thrown for missing or bad input parameter(s).
+--
+--
 _InvalidParameterException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidParameterException =
-    _ServiceError . hasCode "InvalidParameterException"
+  _MatchServiceError cognitoIdentity "InvalidParameterException"
 
+
 -- | Thrown when a user is not authorized to access the requested resource.
+--
+--
 _NotAuthorizedException :: AsError a => Getting (First ServiceError) a ServiceError
-_NotAuthorizedException = _ServiceError . hasCode "NotAuthorizedException"
+_NotAuthorizedException =
+  _MatchServiceError cognitoIdentity "NotAuthorizedException"
 
+
 -- | Thrown when the service encounters an error during processing the request.
+--
+--
 _InternalErrorException :: AsError a => Getting (First ServiceError) a ServiceError
-_InternalErrorException = _ServiceError . hasCode "InternalErrorException"
+_InternalErrorException =
+  _MatchServiceError cognitoIdentity "InternalErrorException"
 
+
 -- | An exception thrown when a dependent service such as Facebook or Twitter is not responding
 --
 --
 _ExternalServiceException :: AsError a => Getting (First ServiceError) a ServiceError
-_ExternalServiceException = _ServiceError . hasCode "ExternalServiceException"
+_ExternalServiceException =
+  _MatchServiceError cognitoIdentity "ExternalServiceException"
 
+
 -- | Thrown when a request is throttled.
+--
+--
 _TooManyRequestsException :: AsError a => Getting (First ServiceError) a ServiceError
-_TooManyRequestsException = _ServiceError . hasCode "TooManyRequestsException"
+_TooManyRequestsException =
+  _MatchServiceError cognitoIdentity "TooManyRequestsException"
 
+
 -- | Thrown if there are parallel requests to modify a resource.
 --
 --
 _ConcurrentModificationException :: AsError a => Getting (First ServiceError) a ServiceError
 _ConcurrentModificationException =
-    _ServiceError . hasCode "ConcurrentModificationException"
+  _MatchServiceError cognitoIdentity "ConcurrentModificationException"
 
+
 -- | Thrown when a user tries to use a login which is already linked to another account.
+--
+--
 _ResourceConflictException :: AsError a => Getting (First ServiceError) a ServiceError
 _ResourceConflictException =
-    _ServiceError . hasCode "ResourceConflictException"
+  _MatchServiceError cognitoIdentity "ResourceConflictException"
 
+
 -- | The provided developer user identifier is already registered with Cognito under a different identity ID.
 --
 --
 _DeveloperUserAlreadyRegisteredException :: AsError a => Getting (First ServiceError) a ServiceError
 _DeveloperUserAlreadyRegisteredException =
-    _ServiceError . hasCode "DeveloperUserAlreadyRegisteredException"
+  _MatchServiceError cognitoIdentity "DeveloperUserAlreadyRegisteredException"
 
+
 -- | Thrown when the requested resource (for example, a dataset or record) does not exist.
+--
+--
 _ResourceNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
 _ResourceNotFoundException =
-    _ServiceError . hasCode "ResourceNotFoundException"
+  _MatchServiceError cognitoIdentity "ResourceNotFoundException"
 
+
 -- | Thrown when the total number of user pools has exceeded a preset limit.
+--
+--
 _LimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError
-_LimitExceededException = _ServiceError . hasCode "LimitExceededException"
+_LimitExceededException =
+  _MatchServiceError cognitoIdentity "LimitExceededException"
+
diff --git a/gen/Network/AWS/CognitoIdentity/Types/Product.hs b/gen/Network/AWS/CognitoIdentity/Types/Product.hs
--- a/gen/Network/AWS/CognitoIdentity/Types/Product.hs
+++ b/gen/Network/AWS/CognitoIdentity/Types/Product.hs
@@ -9,17 +9,17 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.Types.Product
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
 module Network.AWS.CognitoIdentity.Types.Product where
 
-import           Network.AWS.CognitoIdentity.Types.Sum
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
+import Network.AWS.CognitoIdentity.Types.Sum
+import Network.AWS.Lens
+import Network.AWS.Prelude
 
 -- | A provider representing an Amazon Cognito Identity User Pool and its client ID.
 --
@@ -27,29 +27,39 @@
 --
 -- /See:/ 'cognitoIdentityProvider' smart constructor.
 data CognitoIdentityProvider = CognitoIdentityProvider'
-    { _cipClientId     :: !(Maybe Text)
-    , _cipProviderName :: !(Maybe Text)
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _cipClientId             :: !(Maybe Text)
+  , _cipServerSideTokenCheck :: !(Maybe Bool)
+  , _cipProviderName         :: !(Maybe Text)
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'CognitoIdentityProvider' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
 -- * 'cipClientId' - The client ID for the Amazon Cognito Identity User Pool.
 --
+-- * 'cipServerSideTokenCheck' - TRUE if server-side token validation is enabled for the identity provider’s token.
+--
 -- * 'cipProviderName' - The provider name for an Amazon Cognito Identity User Pool. For example, @cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789@ .
 cognitoIdentityProvider
     :: CognitoIdentityProvider
 cognitoIdentityProvider =
-    CognitoIdentityProvider'
-    { _cipClientId = Nothing
-    , _cipProviderName = Nothing
-    }
+  CognitoIdentityProvider'
+  { _cipClientId = Nothing
+  , _cipServerSideTokenCheck = Nothing
+  , _cipProviderName = Nothing
+  }
 
+
 -- | The client ID for the Amazon Cognito Identity User Pool.
 cipClientId :: Lens' CognitoIdentityProvider (Maybe Text)
 cipClientId = lens _cipClientId (\ s a -> s{_cipClientId = a});
 
+-- | TRUE if server-side token validation is enabled for the identity provider’s token.
+cipServerSideTokenCheck :: Lens' CognitoIdentityProvider (Maybe Bool)
+cipServerSideTokenCheck = lens _cipServerSideTokenCheck (\ s a -> s{_cipServerSideTokenCheck = a});
+
 -- | The provider name for an Amazon Cognito Identity User Pool. For example, @cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789@ .
 cipProviderName :: Lens' CognitoIdentityProvider (Maybe Text)
 cipProviderName = lens _cipProviderName (\ s a -> s{_cipProviderName = a});
@@ -59,17 +69,20 @@
           = withObject "CognitoIdentityProvider"
               (\ x ->
                  CognitoIdentityProvider' <$>
-                   (x .:? "ClientId") <*> (x .:? "ProviderName"))
+                   (x .:? "ClientId") <*> (x .:? "ServerSideTokenCheck")
+                     <*> (x .:? "ProviderName"))
 
-instance Hashable CognitoIdentityProvider
+instance Hashable CognitoIdentityProvider where
 
-instance NFData CognitoIdentityProvider
+instance NFData CognitoIdentityProvider where
 
 instance ToJSON CognitoIdentityProvider where
         toJSON CognitoIdentityProvider'{..}
           = object
               (catMaybes
                  [("ClientId" .=) <$> _cipClientId,
+                  ("ServerSideTokenCheck" .=) <$>
+                    _cipServerSideTokenCheck,
                   ("ProviderName" .=) <$> _cipProviderName])
 
 -- | Credentials for the provided identity ID.
@@ -78,12 +91,13 @@
 --
 -- /See:/ 'credentials' smart constructor.
 data Credentials = Credentials'
-    { _cSessionToken :: !(Maybe Text)
-    , _cExpiration   :: !(Maybe POSIX)
-    , _cSecretKey    :: !(Maybe Text)
-    , _cAccessKeyId  :: !(Maybe Text)
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _cSessionToken :: !(Maybe Text)
+  , _cExpiration   :: !(Maybe POSIX)
+  , _cSecretKey    :: !(Maybe Text)
+  , _cAccessKeyId  :: !(Maybe Text)
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'Credentials' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -98,13 +112,14 @@
 credentials
     :: Credentials
 credentials =
-    Credentials'
-    { _cSessionToken = Nothing
-    , _cExpiration = Nothing
-    , _cSecretKey = Nothing
-    , _cAccessKeyId = Nothing
-    }
+  Credentials'
+  { _cSessionToken = Nothing
+  , _cExpiration = Nothing
+  , _cSecretKey = Nothing
+  , _cAccessKeyId = Nothing
+  }
 
+
 -- | The Session Token portion of the credentials
 cSessionToken :: Lens' Credentials (Maybe Text)
 cSessionToken = lens _cSessionToken (\ s a -> s{_cSessionToken = a});
@@ -130,20 +145,23 @@
                      (x .:? "SecretKey")
                      <*> (x .:? "AccessKeyId"))
 
-instance Hashable Credentials
+instance Hashable Credentials where
 
-instance NFData Credentials
+instance NFData Credentials where
 
 -- | A description of the identity.
 --
+--
+--
 -- /See:/ 'identityDescription' smart constructor.
 data IdentityDescription = IdentityDescription'
-    { _idLastModifiedDate :: !(Maybe POSIX)
-    , _idCreationDate     :: !(Maybe POSIX)
-    , _idLogins           :: !(Maybe [Text])
-    , _idIdentityId       :: !(Maybe Text)
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _idLastModifiedDate :: !(Maybe POSIX)
+  , _idCreationDate     :: !(Maybe POSIX)
+  , _idLogins           :: !(Maybe [Text])
+  , _idIdentityId       :: !(Maybe Text)
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'IdentityDescription' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -158,13 +176,14 @@
 identityDescription
     :: IdentityDescription
 identityDescription =
-    IdentityDescription'
-    { _idLastModifiedDate = Nothing
-    , _idCreationDate = Nothing
-    , _idLogins = Nothing
-    , _idIdentityId = Nothing
-    }
+  IdentityDescription'
+  { _idLastModifiedDate = Nothing
+  , _idCreationDate = Nothing
+  , _idLogins = Nothing
+  , _idIdentityId = Nothing
+  }
 
+
 -- | Date on which the identity was last modified.
 idLastModifiedDate :: Lens' IdentityDescription (Maybe UTCTime)
 idLastModifiedDate = lens _idLastModifiedDate (\ s a -> s{_idLastModifiedDate = a}) . mapping _Time;
@@ -190,24 +209,27 @@
                      <*> (x .:? "Logins" .!= mempty)
                      <*> (x .:? "IdentityId"))
 
-instance Hashable IdentityDescription
+instance Hashable IdentityDescription where
 
-instance NFData IdentityDescription
+instance NFData IdentityDescription where
 
--- | An object representing a Cognito identity pool.
+-- | An object representing an Amazon Cognito identity pool.
 --
+--
+--
 -- /See:/ 'identityPool' smart constructor.
 data IdentityPool = IdentityPool'
-    { _ipSamlProviderARNs               :: !(Maybe [Text])
-    , _ipSupportedLoginProviders        :: !(Maybe (Map Text Text))
-    , _ipDeveloperProviderName          :: !(Maybe Text)
-    , _ipOpenIdConnectProviderARNs      :: !(Maybe [Text])
-    , _ipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
-    , _ipIdentityPoolId                 :: !Text
-    , _ipIdentityPoolName               :: !Text
-    , _ipAllowUnauthenticatedIdentities :: !Bool
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _ipSamlProviderARNs               :: !(Maybe [Text])
+  , _ipSupportedLoginProviders        :: !(Maybe (Map Text Text))
+  , _ipDeveloperProviderName          :: !(Maybe Text)
+  , _ipOpenIdConnectProviderARNs      :: !(Maybe [Text])
+  , _ipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
+  , _ipIdentityPoolId                 :: !Text
+  , _ipIdentityPoolName               :: !Text
+  , _ipAllowUnauthenticatedIdentities :: !Bool
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'IdentityPool' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -233,17 +255,18 @@
     -> Bool -- ^ 'ipAllowUnauthenticatedIdentities'
     -> IdentityPool
 identityPool pIdentityPoolId_ pIdentityPoolName_ pAllowUnauthenticatedIdentities_ =
-    IdentityPool'
-    { _ipSamlProviderARNs = Nothing
-    , _ipSupportedLoginProviders = Nothing
-    , _ipDeveloperProviderName = Nothing
-    , _ipOpenIdConnectProviderARNs = Nothing
-    , _ipCognitoIdentityProviders = Nothing
-    , _ipIdentityPoolId = pIdentityPoolId_
-    , _ipIdentityPoolName = pIdentityPoolName_
-    , _ipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
-    }
+  IdentityPool'
+  { _ipSamlProviderARNs = Nothing
+  , _ipSupportedLoginProviders = Nothing
+  , _ipDeveloperProviderName = Nothing
+  , _ipOpenIdConnectProviderARNs = Nothing
+  , _ipCognitoIdentityProviders = Nothing
+  , _ipIdentityPoolId = pIdentityPoolId_
+  , _ipIdentityPoolName = pIdentityPoolName_
+  , _ipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
+  }
 
+
 -- | An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.
 ipSamlProviderARNs :: Lens' IdentityPool [Text]
 ipSamlProviderARNs = lens _ipSamlProviderARNs (\ s a -> s{_ipSamlProviderARNs = a}) . _Default . _Coerce;
@@ -290,9 +313,9 @@
                      <*> (x .: "IdentityPoolName")
                      <*> (x .: "AllowUnauthenticatedIdentities"))
 
-instance Hashable IdentityPool
+instance Hashable IdentityPool where
 
-instance NFData IdentityPool
+instance NFData IdentityPool where
 
 instance ToJSON IdentityPool where
         toJSON IdentityPool'{..}
@@ -315,12 +338,15 @@
 
 -- | A description of the identity pool.
 --
+--
+--
 -- /See:/ 'identityPoolShortDescription' smart constructor.
 data IdentityPoolShortDescription = IdentityPoolShortDescription'
-    { _ipsdIdentityPoolId   :: !(Maybe Text)
-    , _ipsdIdentityPoolName :: !(Maybe Text)
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _ipsdIdentityPoolId   :: !(Maybe Text)
+  , _ipsdIdentityPoolName :: !(Maybe Text)
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'IdentityPoolShortDescription' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -331,11 +357,10 @@
 identityPoolShortDescription
     :: IdentityPoolShortDescription
 identityPoolShortDescription =
-    IdentityPoolShortDescription'
-    { _ipsdIdentityPoolId = Nothing
-    , _ipsdIdentityPoolName = Nothing
-    }
+  IdentityPoolShortDescription'
+  {_ipsdIdentityPoolId = Nothing, _ipsdIdentityPoolName = Nothing}
 
+
 -- | An identity pool ID in the format REGION:GUID.
 ipsdIdentityPoolId :: Lens' IdentityPoolShortDescription (Maybe Text)
 ipsdIdentityPoolId = lens _ipsdIdentityPoolId (\ s a -> s{_ipsdIdentityPoolId = a});
@@ -352,20 +377,203 @@
                    (x .:? "IdentityPoolId") <*>
                      (x .:? "IdentityPoolName"))
 
-instance Hashable IdentityPoolShortDescription
+instance Hashable IdentityPoolShortDescription where
 
-instance NFData IdentityPoolShortDescription
+instance NFData IdentityPoolShortDescription where
 
+-- | A rule that maps a claim name, a claim value, and a match type to a role ARN.
+--
+--
+--
+-- /See:/ 'mappingRule' smart constructor.
+data MappingRule = MappingRule'
+  { _mrClaim     :: !Text
+  , _mrMatchType :: !MappingRuleMatchType
+  , _mrValue     :: !Text
+  , _mrRoleARN   :: !Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
+
+
+-- | Creates a value of 'MappingRule' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'mrClaim' - The claim name that must be present in the token, for example, "isAdmin" or "paid".
+--
+-- * 'mrMatchType' - The match condition that specifies how closely the claim value in the IdP token must match @Value@ .
+--
+-- * 'mrValue' - A brief string that the claim must match, for example, "paid" or "yes".
+--
+-- * 'mrRoleARN' - The role ARN.
+mappingRule
+    :: Text -- ^ 'mrClaim'
+    -> MappingRuleMatchType -- ^ 'mrMatchType'
+    -> Text -- ^ 'mrValue'
+    -> Text -- ^ 'mrRoleARN'
+    -> MappingRule
+mappingRule pClaim_ pMatchType_ pValue_ pRoleARN_ =
+  MappingRule'
+  { _mrClaim = pClaim_
+  , _mrMatchType = pMatchType_
+  , _mrValue = pValue_
+  , _mrRoleARN = pRoleARN_
+  }
+
+
+-- | The claim name that must be present in the token, for example, "isAdmin" or "paid".
+mrClaim :: Lens' MappingRule Text
+mrClaim = lens _mrClaim (\ s a -> s{_mrClaim = a});
+
+-- | The match condition that specifies how closely the claim value in the IdP token must match @Value@ .
+mrMatchType :: Lens' MappingRule MappingRuleMatchType
+mrMatchType = lens _mrMatchType (\ s a -> s{_mrMatchType = a});
+
+-- | A brief string that the claim must match, for example, "paid" or "yes".
+mrValue :: Lens' MappingRule Text
+mrValue = lens _mrValue (\ s a -> s{_mrValue = a});
+
+-- | The role ARN.
+mrRoleARN :: Lens' MappingRule Text
+mrRoleARN = lens _mrRoleARN (\ s a -> s{_mrRoleARN = a});
+
+instance FromJSON MappingRule where
+        parseJSON
+          = withObject "MappingRule"
+              (\ x ->
+                 MappingRule' <$>
+                   (x .: "Claim") <*> (x .: "MatchType") <*>
+                     (x .: "Value")
+                     <*> (x .: "RoleARN"))
+
+instance Hashable MappingRule where
+
+instance NFData MappingRule where
+
+instance ToJSON MappingRule where
+        toJSON MappingRule'{..}
+          = object
+              (catMaybes
+                 [Just ("Claim" .= _mrClaim),
+                  Just ("MatchType" .= _mrMatchType),
+                  Just ("Value" .= _mrValue),
+                  Just ("RoleARN" .= _mrRoleARN)])
+
+-- | A role mapping.
+--
+--
+--
+-- /See:/ 'roleMapping' smart constructor.
+data RoleMapping = RoleMapping'
+  { _rmRulesConfiguration      :: !(Maybe RulesConfigurationType)
+  , _rmAmbiguousRoleResolution :: !(Maybe AmbiguousRoleResolutionType)
+  , _rmType                    :: !RoleMappingType
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
+
+
+-- | Creates a value of 'RoleMapping' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'rmRulesConfiguration' - The rules to be used for mapping users to roles. If you specify Rules as the role mapping type, @RulesConfiguration@ is required.
+--
+-- * 'rmAmbiguousRoleResolution' - If you specify Token or Rules as the @Type@ , @AmbiguousRoleResolution@ is required. Specifies the action to be taken if either no rules match the claim value for the @Rules@ type, or there is no @cognito:preferred_role@ claim and there are multiple @cognito:roles@ matches for the @Token@ type.
+--
+-- * 'rmType' - The role mapping type. Token will use @cognito:roles@ and @cognito:preferred_role@ claims from the Cognito identity provider token to map groups to roles. Rules will attempt to match claims from the token to map to a role.
+roleMapping
+    :: RoleMappingType -- ^ 'rmType'
+    -> RoleMapping
+roleMapping pType_ =
+  RoleMapping'
+  { _rmRulesConfiguration = Nothing
+  , _rmAmbiguousRoleResolution = Nothing
+  , _rmType = pType_
+  }
+
+
+-- | The rules to be used for mapping users to roles. If you specify Rules as the role mapping type, @RulesConfiguration@ is required.
+rmRulesConfiguration :: Lens' RoleMapping (Maybe RulesConfigurationType)
+rmRulesConfiguration = lens _rmRulesConfiguration (\ s a -> s{_rmRulesConfiguration = a});
+
+-- | If you specify Token or Rules as the @Type@ , @AmbiguousRoleResolution@ is required. Specifies the action to be taken if either no rules match the claim value for the @Rules@ type, or there is no @cognito:preferred_role@ claim and there are multiple @cognito:roles@ matches for the @Token@ type.
+rmAmbiguousRoleResolution :: Lens' RoleMapping (Maybe AmbiguousRoleResolutionType)
+rmAmbiguousRoleResolution = lens _rmAmbiguousRoleResolution (\ s a -> s{_rmAmbiguousRoleResolution = a});
+
+-- | The role mapping type. Token will use @cognito:roles@ and @cognito:preferred_role@ claims from the Cognito identity provider token to map groups to roles. Rules will attempt to match claims from the token to map to a role.
+rmType :: Lens' RoleMapping RoleMappingType
+rmType = lens _rmType (\ s a -> s{_rmType = a});
+
+instance FromJSON RoleMapping where
+        parseJSON
+          = withObject "RoleMapping"
+              (\ x ->
+                 RoleMapping' <$>
+                   (x .:? "RulesConfiguration") <*>
+                     (x .:? "AmbiguousRoleResolution")
+                     <*> (x .: "Type"))
+
+instance Hashable RoleMapping where
+
+instance NFData RoleMapping where
+
+instance ToJSON RoleMapping where
+        toJSON RoleMapping'{..}
+          = object
+              (catMaybes
+                 [("RulesConfiguration" .=) <$> _rmRulesConfiguration,
+                  ("AmbiguousRoleResolution" .=) <$>
+                    _rmAmbiguousRoleResolution,
+                  Just ("Type" .= _rmType)])
+
+-- | A container for rules.
+--
+--
+--
+-- /See:/ 'rulesConfigurationType' smart constructor.
+newtype RulesConfigurationType = RulesConfigurationType'
+  { _rctRules :: List1 MappingRule
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
+
+
+-- | Creates a value of 'RulesConfigurationType' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'rctRules' - An array of rules. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
+rulesConfigurationType
+    :: NonEmpty MappingRule -- ^ 'rctRules'
+    -> RulesConfigurationType
+rulesConfigurationType pRules_ =
+  RulesConfigurationType' {_rctRules = _List1 # pRules_}
+
+
+-- | An array of rules. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
+rctRules :: Lens' RulesConfigurationType (NonEmpty MappingRule)
+rctRules = lens _rctRules (\ s a -> s{_rctRules = a}) . _List1;
+
+instance FromJSON RulesConfigurationType where
+        parseJSON
+          = withObject "RulesConfigurationType"
+              (\ x -> RulesConfigurationType' <$> (x .: "Rules"))
+
+instance Hashable RulesConfigurationType where
+
+instance NFData RulesConfigurationType where
+
+instance ToJSON RulesConfigurationType where
+        toJSON RulesConfigurationType'{..}
+          = object (catMaybes [Just ("Rules" .= _rctRules)])
+
 -- | An array of UnprocessedIdentityId objects, each of which contains an ErrorCode and IdentityId.
 --
 --
 --
 -- /See:/ 'unprocessedIdentityId' smart constructor.
 data UnprocessedIdentityId = UnprocessedIdentityId'
-    { _uiiErrorCode  :: !(Maybe CognitoErrorCode)
-    , _uiiIdentityId :: !(Maybe Text)
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _uiiErrorCode  :: !(Maybe CognitoErrorCode)
+  , _uiiIdentityId :: !(Maybe Text)
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'UnprocessedIdentityId' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -376,11 +584,9 @@
 unprocessedIdentityId
     :: UnprocessedIdentityId
 unprocessedIdentityId =
-    UnprocessedIdentityId'
-    { _uiiErrorCode = Nothing
-    , _uiiIdentityId = Nothing
-    }
+  UnprocessedIdentityId' {_uiiErrorCode = Nothing, _uiiIdentityId = Nothing}
 
+
 -- | The error code indicating the type of error that occurred.
 uiiErrorCode :: Lens' UnprocessedIdentityId (Maybe CognitoErrorCode)
 uiiErrorCode = lens _uiiErrorCode (\ s a -> s{_uiiErrorCode = a});
@@ -396,6 +602,6 @@
                  UnprocessedIdentityId' <$>
                    (x .:? "ErrorCode") <*> (x .:? "IdentityId"))
 
-instance Hashable UnprocessedIdentityId
+instance Hashable UnprocessedIdentityId where
 
-instance NFData UnprocessedIdentityId
+instance NFData UnprocessedIdentityId where
diff --git a/gen/Network/AWS/CognitoIdentity/Types/Sum.hs b/gen/Network/AWS/CognitoIdentity/Types/Sum.hs
--- a/gen/Network/AWS/CognitoIdentity/Types/Sum.hs
+++ b/gen/Network/AWS/CognitoIdentity/Types/Sum.hs
@@ -9,21 +9,52 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.Types.Sum
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
 module Network.AWS.CognitoIdentity.Types.Sum where
 
-import           Network.AWS.Prelude
+import Network.AWS.Prelude
 
+data AmbiguousRoleResolutionType
+  = AuthenticatedRole
+  | Deny
+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic)
+
+
+instance FromText AmbiguousRoleResolutionType where
+    parser = takeLowerText >>= \case
+        "authenticatedrole" -> pure AuthenticatedRole
+        "deny" -> pure Deny
+        e -> fromTextError $ "Failure parsing AmbiguousRoleResolutionType from value: '" <> e
+           <> "'. Accepted values: authenticatedrole, deny"
+
+instance ToText AmbiguousRoleResolutionType where
+    toText = \case
+        AuthenticatedRole -> "AuthenticatedRole"
+        Deny -> "Deny"
+
+instance Hashable     AmbiguousRoleResolutionType
+instance NFData       AmbiguousRoleResolutionType
+instance ToByteString AmbiguousRoleResolutionType
+instance ToQuery      AmbiguousRoleResolutionType
+instance ToHeader     AmbiguousRoleResolutionType
+
+instance ToJSON AmbiguousRoleResolutionType where
+    toJSON = toJSONText
+
+instance FromJSON AmbiguousRoleResolutionType where
+    parseJSON = parseJSONText "AmbiguousRoleResolutionType"
+
 data CognitoErrorCode
-    = AccessDenied
-    | InternalServerError
-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)
+  = AccessDenied
+  | InternalServerError
+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic)
 
+
 instance FromText CognitoErrorCode where
     parser = takeLowerText >>= \case
         "accessdenied" -> pure AccessDenied
@@ -44,3 +75,69 @@
 
 instance FromJSON CognitoErrorCode where
     parseJSON = parseJSONText "CognitoErrorCode"
+
+data MappingRuleMatchType
+  = Contains
+  | Equals
+  | NotEqual
+  | StartsWith
+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic)
+
+
+instance FromText MappingRuleMatchType where
+    parser = takeLowerText >>= \case
+        "contains" -> pure Contains
+        "equals" -> pure Equals
+        "notequal" -> pure NotEqual
+        "startswith" -> pure StartsWith
+        e -> fromTextError $ "Failure parsing MappingRuleMatchType from value: '" <> e
+           <> "'. Accepted values: contains, equals, notequal, startswith"
+
+instance ToText MappingRuleMatchType where
+    toText = \case
+        Contains -> "Contains"
+        Equals -> "Equals"
+        NotEqual -> "NotEqual"
+        StartsWith -> "StartsWith"
+
+instance Hashable     MappingRuleMatchType
+instance NFData       MappingRuleMatchType
+instance ToByteString MappingRuleMatchType
+instance ToQuery      MappingRuleMatchType
+instance ToHeader     MappingRuleMatchType
+
+instance ToJSON MappingRuleMatchType where
+    toJSON = toJSONText
+
+instance FromJSON MappingRuleMatchType where
+    parseJSON = parseJSONText "MappingRuleMatchType"
+
+data RoleMappingType
+  = Rules
+  | Token
+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic)
+
+
+instance FromText RoleMappingType where
+    parser = takeLowerText >>= \case
+        "rules" -> pure Rules
+        "token" -> pure Token
+        e -> fromTextError $ "Failure parsing RoleMappingType from value: '" <> e
+           <> "'. Accepted values: rules, token"
+
+instance ToText RoleMappingType where
+    toText = \case
+        Rules -> "Rules"
+        Token -> "Token"
+
+instance Hashable     RoleMappingType
+instance NFData       RoleMappingType
+instance ToByteString RoleMappingType
+instance ToQuery      RoleMappingType
+instance ToHeader     RoleMappingType
+
+instance ToJSON RoleMappingType where
+    toJSON = toJSONText
+
+instance FromJSON RoleMappingType where
+    parseJSON = parseJSONText "RoleMappingType"
diff --git a/gen/Network/AWS/CognitoIdentity/UnlinkDeveloperIdentity.hs b/gen/Network/AWS/CognitoIdentity/UnlinkDeveloperIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity/UnlinkDeveloperIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity/UnlinkDeveloperIdentity.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.UnlinkDeveloperIdentity
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -39,12 +39,12 @@
     , UnlinkDeveloperIdentityResponse
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the @UnlinkDeveloperIdentity@ action.
 --
@@ -52,12 +52,13 @@
 --
 -- /See:/ 'unlinkDeveloperIdentity' smart constructor.
 data UnlinkDeveloperIdentity = UnlinkDeveloperIdentity'
-    { _udiIdentityId              :: !Text
-    , _udiIdentityPoolId          :: !Text
-    , _udiDeveloperProviderName   :: !Text
-    , _udiDeveloperUserIdentifier :: !Text
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _udiIdentityId              :: !Text
+  , _udiIdentityPoolId          :: !Text
+  , _udiDeveloperProviderName   :: !Text
+  , _udiDeveloperUserIdentifier :: !Text
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'UnlinkDeveloperIdentity' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -76,13 +77,14 @@
     -> Text -- ^ 'udiDeveloperUserIdentifier'
     -> UnlinkDeveloperIdentity
 unlinkDeveloperIdentity pIdentityId_ pIdentityPoolId_ pDeveloperProviderName_ pDeveloperUserIdentifier_ =
-    UnlinkDeveloperIdentity'
-    { _udiIdentityId = pIdentityId_
-    , _udiIdentityPoolId = pIdentityPoolId_
-    , _udiDeveloperProviderName = pDeveloperProviderName_
-    , _udiDeveloperUserIdentifier = pDeveloperUserIdentifier_
-    }
+  UnlinkDeveloperIdentity'
+  { _udiIdentityId = pIdentityId_
+  , _udiIdentityPoolId = pIdentityPoolId_
+  , _udiDeveloperProviderName = pDeveloperProviderName_
+  , _udiDeveloperUserIdentifier = pDeveloperUserIdentifier_
+  }
 
+
 -- | A unique identifier in the format REGION:GUID.
 udiIdentityId :: Lens' UnlinkDeveloperIdentity Text
 udiIdentityId = lens _udiIdentityId (\ s a -> s{_udiIdentityId = a});
@@ -106,9 +108,9 @@
         response
           = receiveNull UnlinkDeveloperIdentityResponse'
 
-instance Hashable UnlinkDeveloperIdentity
+instance Hashable UnlinkDeveloperIdentity where
 
-instance NFData UnlinkDeveloperIdentity
+instance NFData UnlinkDeveloperIdentity where
 
 instance ToHeaders UnlinkDeveloperIdentity where
         toHeaders
@@ -141,13 +143,15 @@
 
 -- | /See:/ 'unlinkDeveloperIdentityResponse' smart constructor.
 data UnlinkDeveloperIdentityResponse =
-    UnlinkDeveloperIdentityResponse'
-    deriving (Eq,Read,Show,Data,Typeable,Generic)
+  UnlinkDeveloperIdentityResponse'
+  deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'UnlinkDeveloperIdentityResponse' with the minimum fields required to make a request.
 --
 unlinkDeveloperIdentityResponse
     :: UnlinkDeveloperIdentityResponse
 unlinkDeveloperIdentityResponse = UnlinkDeveloperIdentityResponse'
 
-instance NFData UnlinkDeveloperIdentityResponse
+
+instance NFData UnlinkDeveloperIdentityResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/UnlinkIdentity.hs b/gen/Network/AWS/CognitoIdentity/UnlinkIdentity.hs
--- a/gen/Network/AWS/CognitoIdentity/UnlinkIdentity.hs
+++ b/gen/Network/AWS/CognitoIdentity/UnlinkIdentity.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.UnlinkIdentity
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -38,22 +38,25 @@
     , UnlinkIdentityResponse
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
 -- | Input to the UnlinkIdentity action.
 --
+--
+--
 -- /See:/ 'unlinkIdentity' smart constructor.
 data UnlinkIdentity = UnlinkIdentity'
-    { _uiIdentityId     :: !Text
-    , _uiLogins         :: !(Map Text Text)
-    , _uiLoginsToRemove :: ![Text]
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _uiIdentityId     :: !Text
+  , _uiLogins         :: !(Map Text Text)
+  , _uiLoginsToRemove :: ![Text]
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'UnlinkIdentity' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -67,12 +70,10 @@
     :: Text -- ^ 'uiIdentityId'
     -> UnlinkIdentity
 unlinkIdentity pIdentityId_ =
-    UnlinkIdentity'
-    { _uiIdentityId = pIdentityId_
-    , _uiLogins = mempty
-    , _uiLoginsToRemove = mempty
-    }
+  UnlinkIdentity'
+  {_uiIdentityId = pIdentityId_, _uiLogins = mempty, _uiLoginsToRemove = mempty}
 
+
 -- | A unique identifier in the format REGION:GUID.
 uiIdentityId :: Lens' UnlinkIdentity Text
 uiIdentityId = lens _uiIdentityId (\ s a -> s{_uiIdentityId = a});
@@ -90,9 +91,9 @@
         request = postJSON cognitoIdentity
         response = receiveNull UnlinkIdentityResponse'
 
-instance Hashable UnlinkIdentity
+instance Hashable UnlinkIdentity where
 
-instance NFData UnlinkIdentity
+instance NFData UnlinkIdentity where
 
 instance ToHeaders UnlinkIdentity where
         toHeaders
@@ -120,13 +121,15 @@
 
 -- | /See:/ 'unlinkIdentityResponse' smart constructor.
 data UnlinkIdentityResponse =
-    UnlinkIdentityResponse'
-    deriving (Eq,Read,Show,Data,Typeable,Generic)
+  UnlinkIdentityResponse'
+  deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'UnlinkIdentityResponse' with the minimum fields required to make a request.
 --
 unlinkIdentityResponse
     :: UnlinkIdentityResponse
 unlinkIdentityResponse = UnlinkIdentityResponse'
 
-instance NFData UnlinkIdentityResponse
+
+instance NFData UnlinkIdentityResponse where
diff --git a/gen/Network/AWS/CognitoIdentity/UpdateIdentityPool.hs b/gen/Network/AWS/CognitoIdentity/UpdateIdentityPool.hs
--- a/gen/Network/AWS/CognitoIdentity/UpdateIdentityPool.hs
+++ b/gen/Network/AWS/CognitoIdentity/UpdateIdentityPool.hs
@@ -12,9 +12,9 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.UpdateIdentityPool
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
@@ -52,27 +52,30 @@
     , ipAllowUnauthenticatedIdentities
     ) where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.CognitoIdentity.Types.Product
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Request
-import           Network.AWS.Response
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.CognitoIdentity.Types.Product
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Request
+import Network.AWS.Response
 
--- | An object representing a Cognito identity pool.
+-- | An object representing an Amazon Cognito identity pool.
 --
+--
+--
 -- /See:/ 'updateIdentityPool' smart constructor.
 data UpdateIdentityPool = UpdateIdentityPool'
-    { _uipSamlProviderARNs               :: !(Maybe [Text])
-    , _uipSupportedLoginProviders        :: !(Maybe (Map Text Text))
-    , _uipDeveloperProviderName          :: !(Maybe Text)
-    , _uipOpenIdConnectProviderARNs      :: !(Maybe [Text])
-    , _uipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
-    , _uipIdentityPoolId                 :: !Text
-    , _uipIdentityPoolName               :: !Text
-    , _uipAllowUnauthenticatedIdentities :: !Bool
-    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+  { _uipSamlProviderARNs               :: !(Maybe [Text])
+  , _uipSupportedLoginProviders        :: !(Maybe (Map Text Text))
+  , _uipDeveloperProviderName          :: !(Maybe Text)
+  , _uipOpenIdConnectProviderARNs      :: !(Maybe [Text])
+  , _uipCognitoIdentityProviders       :: !(Maybe [CognitoIdentityProvider])
+  , _uipIdentityPoolId                 :: !Text
+  , _uipIdentityPoolName               :: !Text
+  , _uipAllowUnauthenticatedIdentities :: !Bool
+  } deriving (Eq, Read, Show, Data, Typeable, Generic)
 
+
 -- | Creates a value of 'UpdateIdentityPool' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
@@ -98,17 +101,18 @@
     -> Bool -- ^ 'uipAllowUnauthenticatedIdentities'
     -> UpdateIdentityPool
 updateIdentityPool pIdentityPoolId_ pIdentityPoolName_ pAllowUnauthenticatedIdentities_ =
-    UpdateIdentityPool'
-    { _uipSamlProviderARNs = Nothing
-    , _uipSupportedLoginProviders = Nothing
-    , _uipDeveloperProviderName = Nothing
-    , _uipOpenIdConnectProviderARNs = Nothing
-    , _uipCognitoIdentityProviders = Nothing
-    , _uipIdentityPoolId = pIdentityPoolId_
-    , _uipIdentityPoolName = pIdentityPoolName_
-    , _uipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
-    }
+  UpdateIdentityPool'
+  { _uipSamlProviderARNs = Nothing
+  , _uipSupportedLoginProviders = Nothing
+  , _uipDeveloperProviderName = Nothing
+  , _uipOpenIdConnectProviderARNs = Nothing
+  , _uipCognitoIdentityProviders = Nothing
+  , _uipIdentityPoolId = pIdentityPoolId_
+  , _uipIdentityPoolName = pIdentityPoolName_
+  , _uipAllowUnauthenticatedIdentities = pAllowUnauthenticatedIdentities_
+  }
 
+
 -- | An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.
 uipSamlProviderARNs :: Lens' UpdateIdentityPool [Text]
 uipSamlProviderARNs = lens _uipSamlProviderARNs (\ s a -> s{_uipSamlProviderARNs = a}) . _Default . _Coerce;
@@ -146,9 +150,9 @@
         request = postJSON cognitoIdentity
         response = receiveJSON (\ s h x -> eitherParseJSON x)
 
-instance Hashable UpdateIdentityPool
+instance Hashable UpdateIdentityPool where
 
-instance NFData UpdateIdentityPool
+instance NFData UpdateIdentityPool where
 
 instance ToHeaders UpdateIdentityPool where
         toHeaders
diff --git a/gen/Network/AWS/CognitoIdentity/Waiters.hs b/gen/Network/AWS/CognitoIdentity/Waiters.hs
--- a/gen/Network/AWS/CognitoIdentity/Waiters.hs
+++ b/gen/Network/AWS/CognitoIdentity/Waiters.hs
@@ -7,15 +7,15 @@
 
 -- |
 -- Module      : Network.AWS.CognitoIdentity.Waiters
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
 module Network.AWS.CognitoIdentity.Waiters where
 
-import           Network.AWS.CognitoIdentity.Types
-import           Network.AWS.Lens
-import           Network.AWS.Prelude
-import           Network.AWS.Waiter
+import Network.AWS.CognitoIdentity.Types
+import Network.AWS.Lens
+import Network.AWS.Prelude
+import Network.AWS.Waiter
diff --git a/test/Main.hs b/test/Main.hs
--- a/test/Main.hs
+++ b/test/Main.hs
@@ -2,9 +2,9 @@
 
 -- |
 -- Module      : Main
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
diff --git a/test/Test/AWS/Gen/CognitoIdentity.hs b/test/Test/AWS/Gen/CognitoIdentity.hs
--- a/test/Test/AWS/Gen/CognitoIdentity.hs
+++ b/test/Test/AWS/Gen/CognitoIdentity.hs
@@ -5,20 +5,20 @@
 
 -- |
 -- Module      : Test.AWS.Gen.CognitoIdentity
--- Copyright   : (c) 2013-2016 Brendan Hay
+-- Copyright   : (c) 2013-2017 Brendan Hay
 -- License     : Mozilla Public License, v. 2.0.
--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>
 -- Stability   : auto-generated
 -- Portability : non-portable (GHC extensions)
 --
 module Test.AWS.Gen.CognitoIdentity where
 
 import Data.Proxy
+import Network.AWS.CognitoIdentity
+import Test.AWS.CognitoIdentity.Internal
 import Test.AWS.Fixture
 import Test.AWS.Prelude
 import Test.Tasty
-import Network.AWS.CognitoIdentity
-import Test.AWS.CognitoIdentity.Internal
 
 -- Auto-generated: the actual test selection needs to be manually placed into
 -- the top-level so that real test data can be incrementally added.
