diff --git a/amazonka-glacier.cabal b/amazonka-glacier.cabal
--- a/amazonka-glacier.cabal
+++ b/amazonka-glacier.cabal
@@ -1,5 +1,5 @@
 name:                  amazonka-glacier
-version:               0.3.4
+version:               0.3.5
 synopsis:              Amazon Glacier SDK.
 homepage:              https://github.com/brendanhay/amazonka
 license:               OtherLicense
@@ -43,11 +43,13 @@
         , Network.AWS.Glacier.CreateVault
         , Network.AWS.Glacier.DeleteArchive
         , Network.AWS.Glacier.DeleteVault
+        , Network.AWS.Glacier.DeleteVaultAccessPolicy
         , Network.AWS.Glacier.DeleteVaultNotifications
         , Network.AWS.Glacier.DescribeJob
         , Network.AWS.Glacier.DescribeVault
         , Network.AWS.Glacier.GetDataRetrievalPolicy
         , Network.AWS.Glacier.GetJobOutput
+        , Network.AWS.Glacier.GetVaultAccessPolicy
         , Network.AWS.Glacier.GetVaultNotifications
         , Network.AWS.Glacier.InitiateJob
         , Network.AWS.Glacier.InitiateMultipartUpload
@@ -56,6 +58,7 @@
         , Network.AWS.Glacier.ListParts
         , Network.AWS.Glacier.ListVaults
         , Network.AWS.Glacier.SetDataRetrievalPolicy
+        , Network.AWS.Glacier.SetVaultAccessPolicy
         , Network.AWS.Glacier.SetVaultNotifications
         , Network.AWS.Glacier.Types
         , Network.AWS.Glacier.UploadArchive
@@ -64,5 +67,5 @@
     other-modules:
 
     build-depends:
-          amazonka-core == 0.3.4.*
+          amazonka-core == 0.3.5.*
         , base          >= 4.7     && < 5
diff --git a/gen/Network/AWS/Glacier.hs b/gen/Network/AWS/Glacier.hs
--- a/gen/Network/AWS/Glacier.hs
+++ b/gen/Network/AWS/Glacier.hs
@@ -22,11 +22,13 @@
     , module Network.AWS.Glacier.CreateVault
     , module Network.AWS.Glacier.DeleteArchive
     , module Network.AWS.Glacier.DeleteVault
+    , module Network.AWS.Glacier.DeleteVaultAccessPolicy
     , module Network.AWS.Glacier.DeleteVaultNotifications
     , module Network.AWS.Glacier.DescribeJob
     , module Network.AWS.Glacier.DescribeVault
     , module Network.AWS.Glacier.GetDataRetrievalPolicy
     , module Network.AWS.Glacier.GetJobOutput
+    , module Network.AWS.Glacier.GetVaultAccessPolicy
     , module Network.AWS.Glacier.GetVaultNotifications
     , module Network.AWS.Glacier.InitiateJob
     , module Network.AWS.Glacier.InitiateMultipartUpload
@@ -35,6 +37,7 @@
     , module Network.AWS.Glacier.ListParts
     , module Network.AWS.Glacier.ListVaults
     , module Network.AWS.Glacier.SetDataRetrievalPolicy
+    , module Network.AWS.Glacier.SetVaultAccessPolicy
     , module Network.AWS.Glacier.SetVaultNotifications
     , module Network.AWS.Glacier.Types
     , module Network.AWS.Glacier.UploadArchive
@@ -46,11 +49,13 @@
 import Network.AWS.Glacier.CreateVault
 import Network.AWS.Glacier.DeleteArchive
 import Network.AWS.Glacier.DeleteVault
+import Network.AWS.Glacier.DeleteVaultAccessPolicy
 import Network.AWS.Glacier.DeleteVaultNotifications
 import Network.AWS.Glacier.DescribeJob
 import Network.AWS.Glacier.DescribeVault
 import Network.AWS.Glacier.GetDataRetrievalPolicy
 import Network.AWS.Glacier.GetJobOutput
+import Network.AWS.Glacier.GetVaultAccessPolicy
 import Network.AWS.Glacier.GetVaultNotifications
 import Network.AWS.Glacier.InitiateJob
 import Network.AWS.Glacier.InitiateMultipartUpload
@@ -59,6 +64,7 @@
 import Network.AWS.Glacier.ListParts
 import Network.AWS.Glacier.ListVaults
 import Network.AWS.Glacier.SetDataRetrievalPolicy
+import Network.AWS.Glacier.SetVaultAccessPolicy
 import Network.AWS.Glacier.SetVaultNotifications
 import Network.AWS.Glacier.Types
 import Network.AWS.Glacier.UploadArchive
diff --git a/gen/Network/AWS/Glacier/AbortMultipartUpload.hs b/gen/Network/AWS/Glacier/AbortMultipartUpload.hs
--- a/gen/Network/AWS/Glacier/AbortMultipartUpload.hs
+++ b/gen/Network/AWS/Glacier/AbortMultipartUpload.hs
@@ -89,10 +89,11 @@
     , _amuUploadId  = p3
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 amuAccountId :: Lens' AbortMultipartUpload Text
 amuAccountId = lens _amuAccountId (\s a -> s { _amuAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/CompleteMultipartUpload.hs b/gen/Network/AWS/Glacier/CompleteMultipartUpload.hs
--- a/gen/Network/AWS/Glacier/CompleteMultipartUpload.hs
+++ b/gen/Network/AWS/Glacier/CompleteMultipartUpload.hs
@@ -127,10 +127,11 @@
     , _cmuChecksum    = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 cmuAccountId :: Lens' CompleteMultipartUpload Text
 cmuAccountId = lens _cmuAccountId (\s a -> s { _cmuAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/CreateVault.hs b/gen/Network/AWS/Glacier/CreateVault.hs
--- a/gen/Network/AWS/Glacier/CreateVault.hs
+++ b/gen/Network/AWS/Glacier/CreateVault.hs
@@ -91,10 +91,12 @@
     , _cvVaultName = p2
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID. This value must match the AWS
+-- account ID associated with the credentials used to sign the request. You can
+-- either specify an AWS account ID or optionally a single apos'-'apos (hyphen),
+-- in which case Amazon Glacier uses the AWS account ID associated with the
+-- credentials used to sign the request. If you specify your Account ID, do not
+-- include any hyphens (apos-apos) in the ID.
 cvAccountId :: Lens' CreateVault Text
 cvAccountId = lens _cvAccountId (\s a -> s { _cvAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/DeleteArchive.hs b/gen/Network/AWS/Glacier/DeleteArchive.hs
--- a/gen/Network/AWS/Glacier/DeleteArchive.hs
+++ b/gen/Network/AWS/Glacier/DeleteArchive.hs
@@ -92,10 +92,11 @@
     , _daArchiveId = p3
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 daAccountId :: Lens' DeleteArchive Text
 daAccountId = lens _daAccountId (\s a -> s { _daAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/DeleteVault.hs b/gen/Network/AWS/Glacier/DeleteVault.hs
--- a/gen/Network/AWS/Glacier/DeleteVault.hs
+++ b/gen/Network/AWS/Glacier/DeleteVault.hs
@@ -83,10 +83,11 @@
     , _dv1VaultName = p2
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 dv1AccountId :: Lens' DeleteVault Text
 dv1AccountId = lens _dv1AccountId (\s a -> s { _dv1AccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/DeleteVaultAccessPolicy.hs b/gen/Network/AWS/Glacier/DeleteVaultAccessPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/Glacier/DeleteVaultAccessPolicy.hs
@@ -0,0 +1,120 @@
+{-# LANGUAGE DataKinds                   #-}
+{-# LANGUAGE DeriveGeneric               #-}
+{-# LANGUAGE FlexibleInstances           #-}
+{-# LANGUAGE GeneralizedNewtypeDeriving  #-}
+{-# LANGUAGE LambdaCase                  #-}
+{-# LANGUAGE NoImplicitPrelude           #-}
+{-# LANGUAGE OverloadedStrings           #-}
+{-# LANGUAGE RecordWildCards             #-}
+{-# LANGUAGE TypeFamilies                #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- Module      : Network.AWS.Glacier.DeleteVaultAccessPolicy
+-- Copyright   : (c) 2013-2014 Brendan Hay <brendan.g.hay@gmail.com>
+-- License     : This Source Code Form is subject to the terms of
+--               the Mozilla Public License, v. 2.0.
+--               A copy of the MPL can be found in the LICENSE file or
+--               you can obtain it at http://mozilla.org/MPL/2.0/.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : experimental
+-- Portability : non-portable (GHC extensions)
+--
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- | This operation deletes the access policy associated with the specified vault.
+-- The operation is eventually consistent—that is, it might take some time for
+-- Amazon Glacier to completely remove the access policy, and you might still
+-- see the effect of the policy for a short time after you send the delete
+-- request.
+--
+-- This operation is idempotent. You can invoke delete multiple times, even if
+-- there is no policy associated with the vault. For more information about
+-- vault access policies, see <http://docs.aws.amazon.com/amazonglacier/latest/dev/vault-access-policy.html Amazon Glacier Access Control with Vault AccessPolicies>.
+--
+-- <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-DeleteVaultAccessPolicy.html>
+module Network.AWS.Glacier.DeleteVaultAccessPolicy
+    (
+    -- * Request
+      DeleteVaultAccessPolicy
+    -- ** Request constructor
+    , deleteVaultAccessPolicy
+    -- ** Request lenses
+    , dvapAccountId
+    , dvapVaultName
+
+    -- * Response
+    , DeleteVaultAccessPolicyResponse
+    -- ** Response constructor
+    , deleteVaultAccessPolicyResponse
+    ) where
+
+import Network.AWS.Data (Object)
+import Network.AWS.Prelude
+import Network.AWS.Request.RestJSON
+import Network.AWS.Glacier.Types
+import qualified GHC.Exts
+
+data DeleteVaultAccessPolicy = DeleteVaultAccessPolicy
+    { _dvapAccountId :: Text
+    , _dvapVaultName :: Text
+    } deriving (Eq, Ord, Read, Show)
+
+-- | 'DeleteVaultAccessPolicy' constructor.
+--
+-- The fields accessible through corresponding lenses are:
+--
+-- * 'dvapAccountId' @::@ 'Text'
+--
+-- * 'dvapVaultName' @::@ 'Text'
+--
+deleteVaultAccessPolicy :: Text -- ^ 'dvapAccountId'
+                        -> Text -- ^ 'dvapVaultName'
+                        -> DeleteVaultAccessPolicy
+deleteVaultAccessPolicy p1 p2 = DeleteVaultAccessPolicy
+    { _dvapAccountId = p1
+    , _dvapVaultName = p2
+    }
+
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
+dvapAccountId :: Lens' DeleteVaultAccessPolicy Text
+dvapAccountId = lens _dvapAccountId (\s a -> s { _dvapAccountId = a })
+
+-- | The name of the vault.
+dvapVaultName :: Lens' DeleteVaultAccessPolicy Text
+dvapVaultName = lens _dvapVaultName (\s a -> s { _dvapVaultName = a })
+
+data DeleteVaultAccessPolicyResponse = DeleteVaultAccessPolicyResponse
+    deriving (Eq, Ord, Read, Show, Generic)
+
+-- | 'DeleteVaultAccessPolicyResponse' constructor.
+deleteVaultAccessPolicyResponse :: DeleteVaultAccessPolicyResponse
+deleteVaultAccessPolicyResponse = DeleteVaultAccessPolicyResponse
+
+instance ToPath DeleteVaultAccessPolicy where
+    toPath DeleteVaultAccessPolicy{..} = mconcat
+        [ "/"
+        , toText _dvapAccountId
+        , "/vaults/"
+        , toText _dvapVaultName
+        , "/access-policy"
+        ]
+
+instance ToQuery DeleteVaultAccessPolicy where
+    toQuery = const mempty
+
+instance ToHeaders DeleteVaultAccessPolicy
+
+instance ToJSON DeleteVaultAccessPolicy where
+    toJSON = const (toJSON Empty)
+
+instance AWSRequest DeleteVaultAccessPolicy where
+    type Sv DeleteVaultAccessPolicy = Glacier
+    type Rs DeleteVaultAccessPolicy = DeleteVaultAccessPolicyResponse
+
+    request  = delete
+    response = nullResponse DeleteVaultAccessPolicyResponse
diff --git a/gen/Network/AWS/Glacier/DeleteVaultNotifications.hs b/gen/Network/AWS/Glacier/DeleteVaultNotifications.hs
--- a/gen/Network/AWS/Glacier/DeleteVaultNotifications.hs
+++ b/gen/Network/AWS/Glacier/DeleteVaultNotifications.hs
@@ -80,10 +80,11 @@
     , _dvnVaultName = p2
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 dvnAccountId :: Lens' DeleteVaultNotifications Text
 dvnAccountId = lens _dvnAccountId (\s a -> s { _dvnAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/DescribeJob.hs b/gen/Network/AWS/Glacier/DescribeJob.hs
--- a/gen/Network/AWS/Glacier/DescribeJob.hs
+++ b/gen/Network/AWS/Glacier/DescribeJob.hs
@@ -110,10 +110,11 @@
     , _djJobId     = p3
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 djAccountId :: Lens' DescribeJob Text
 djAccountId = lens _djAccountId (\s a -> s { _djAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/DescribeVault.hs b/gen/Network/AWS/Glacier/DescribeVault.hs
--- a/gen/Network/AWS/Glacier/DescribeVault.hs
+++ b/gen/Network/AWS/Glacier/DescribeVault.hs
@@ -90,10 +90,11 @@
     , _dvVaultName = p2
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 dvAccountId :: Lens' DescribeVault Text
 dvAccountId = lens _dvAccountId (\s a -> s { _dvAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/GetDataRetrievalPolicy.hs b/gen/Network/AWS/Glacier/GetDataRetrievalPolicy.hs
--- a/gen/Network/AWS/Glacier/GetDataRetrievalPolicy.hs
+++ b/gen/Network/AWS/Glacier/GetDataRetrievalPolicy.hs
@@ -22,7 +22,11 @@
 --
 -- Derived from AWS service descriptions, licensed under Apache 2.0.
 
--- | <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetDataRetrievalPolicy.html>
+-- | This operation returns the current data retrieval policy for the account and
+-- region specified in the GET request. For more information about data
+-- retrieval policies, see <http://docs.aws.amazon.com/amazonglacier/latest/dev/data-retrieval-policy.html Amazon Glacier Data Retrieval Policies>.
+--
+-- <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetDataRetrievalPolicy.html>
 module Network.AWS.Glacier.GetDataRetrievalPolicy
     (
     -- * Request
@@ -62,6 +66,12 @@
     { _gdrpAccountId = p1
     }
 
+-- | The 'AccountId' value is the AWS account ID. This value must match the AWS
+-- account ID associated with the credentials used to sign the request. You can
+-- either specify an AWS account ID or optionally a single apos'-'apos (hyphen),
+-- in which case Amazon Glacier uses the AWS account ID associated with the
+-- credentials used to sign the request. If you specify your Account ID, do not
+-- include any hyphens (apos-apos) in the ID.
 gdrpAccountId :: Lens' GetDataRetrievalPolicy Text
 gdrpAccountId = lens _gdrpAccountId (\s a -> s { _gdrpAccountId = a })
 
@@ -80,6 +90,7 @@
     { _gdrprPolicy = Nothing
     }
 
+-- | Contains the returned data retrieval policy in JSON format.
 gdrprPolicy :: Lens' GetDataRetrievalPolicyResponse (Maybe DataRetrievalPolicy)
 gdrprPolicy = lens _gdrprPolicy (\s a -> s { _gdrprPolicy = a })
 
diff --git a/gen/Network/AWS/Glacier/GetJobOutput.hs b/gen/Network/AWS/Glacier/GetJobOutput.hs
--- a/gen/Network/AWS/Glacier/GetJobOutput.hs
+++ b/gen/Network/AWS/Glacier/GetJobOutput.hs
@@ -40,10 +40,10 @@
 -- Download a 128 MB chunk of output by specifying the appropriate byte range
 -- using the 'Range' header.
 --
--- Along with the data, the response includes a checksum of the payload. You
--- compute the checksum of the payload on the client and compare it with the
--- checksum you received in the response to ensure you received all the expected
--- data.
+-- Along with the data, the response includes a SHA256 tree hash of the
+-- payload. You compute the checksum of the payload on the client and compare it
+-- with the checksum you received in the response to ensure you received all the
+-- expected data.
 --
 -- Repeat steps 1 and 2 for all the eight 128 MB chunks of output data, each
 -- time specifying the appropriate byte range.
@@ -126,10 +126,11 @@
     , _gjoRange     = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 gjoAccountId :: Lens' GetJobOutput Text
 gjoAccountId = lens _gjoAccountId (\s a -> s { _gjoAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/GetVaultAccessPolicy.hs b/gen/Network/AWS/Glacier/GetVaultAccessPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/Glacier/GetVaultAccessPolicy.hs
@@ -0,0 +1,133 @@
+{-# LANGUAGE DataKinds                   #-}
+{-# LANGUAGE DeriveGeneric               #-}
+{-# LANGUAGE FlexibleInstances           #-}
+{-# LANGUAGE GeneralizedNewtypeDeriving  #-}
+{-# LANGUAGE LambdaCase                  #-}
+{-# LANGUAGE NoImplicitPrelude           #-}
+{-# LANGUAGE OverloadedStrings           #-}
+{-# LANGUAGE RecordWildCards             #-}
+{-# LANGUAGE TypeFamilies                #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- Module      : Network.AWS.Glacier.GetVaultAccessPolicy
+-- Copyright   : (c) 2013-2014 Brendan Hay <brendan.g.hay@gmail.com>
+-- License     : This Source Code Form is subject to the terms of
+--               the Mozilla Public License, v. 2.0.
+--               A copy of the MPL can be found in the LICENSE file or
+--               you can obtain it at http://mozilla.org/MPL/2.0/.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : experimental
+-- Portability : non-portable (GHC extensions)
+--
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- | This operation retrieves the 'access-policy' subresource set on the vault—for
+-- more information on setting this subresource, see <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-SetVaultAccessPolicy.html Set Vault Access Policy(PUT access-policy)>. If there is no access policy set on the vault, the
+-- operation returns a '404 Not found' error. For more information about vault
+-- access policies, see <http://docs.aws.amazon.com/amazonglacier/latest/dev/vault-access-policy.html Amazon Glacier Access Control with Vault Access Policies>.
+--
+-- <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetVaultAccessPolicy.html>
+module Network.AWS.Glacier.GetVaultAccessPolicy
+    (
+    -- * Request
+      GetVaultAccessPolicy
+    -- ** Request constructor
+    , getVaultAccessPolicy
+    -- ** Request lenses
+    , gvapAccountId
+    , gvapVaultName
+
+    -- * Response
+    , GetVaultAccessPolicyResponse
+    -- ** Response constructor
+    , getVaultAccessPolicyResponse
+    -- ** Response lenses
+    , gvaprPolicy
+    ) where
+
+import Network.AWS.Data (Object)
+import Network.AWS.Prelude
+import Network.AWS.Request.RestJSON
+import Network.AWS.Glacier.Types
+import qualified GHC.Exts
+
+data GetVaultAccessPolicy = GetVaultAccessPolicy
+    { _gvapAccountId :: Text
+    , _gvapVaultName :: Text
+    } deriving (Eq, Ord, Read, Show)
+
+-- | 'GetVaultAccessPolicy' constructor.
+--
+-- The fields accessible through corresponding lenses are:
+--
+-- * 'gvapAccountId' @::@ 'Text'
+--
+-- * 'gvapVaultName' @::@ 'Text'
+--
+getVaultAccessPolicy :: Text -- ^ 'gvapAccountId'
+                     -> Text -- ^ 'gvapVaultName'
+                     -> GetVaultAccessPolicy
+getVaultAccessPolicy p1 p2 = GetVaultAccessPolicy
+    { _gvapAccountId = p1
+    , _gvapVaultName = p2
+    }
+
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
+gvapAccountId :: Lens' GetVaultAccessPolicy Text
+gvapAccountId = lens _gvapAccountId (\s a -> s { _gvapAccountId = a })
+
+-- | The name of the vault.
+gvapVaultName :: Lens' GetVaultAccessPolicy Text
+gvapVaultName = lens _gvapVaultName (\s a -> s { _gvapVaultName = a })
+
+newtype GetVaultAccessPolicyResponse = GetVaultAccessPolicyResponse
+    { _gvaprPolicy :: Maybe VaultAccessPolicy
+    } deriving (Eq, Read, Show)
+
+-- | 'GetVaultAccessPolicyResponse' constructor.
+--
+-- The fields accessible through corresponding lenses are:
+--
+-- * 'gvaprPolicy' @::@ 'Maybe' 'VaultAccessPolicy'
+--
+getVaultAccessPolicyResponse :: GetVaultAccessPolicyResponse
+getVaultAccessPolicyResponse = GetVaultAccessPolicyResponse
+    { _gvaprPolicy = Nothing
+    }
+
+-- | Contains the returned vault access policy as a JSON string.
+gvaprPolicy :: Lens' GetVaultAccessPolicyResponse (Maybe VaultAccessPolicy)
+gvaprPolicy = lens _gvaprPolicy (\s a -> s { _gvaprPolicy = a })
+
+instance ToPath GetVaultAccessPolicy where
+    toPath GetVaultAccessPolicy{..} = mconcat
+        [ "/"
+        , toText _gvapAccountId
+        , "/vaults/"
+        , toText _gvapVaultName
+        , "/access-policy"
+        ]
+
+instance ToQuery GetVaultAccessPolicy where
+    toQuery = const mempty
+
+instance ToHeaders GetVaultAccessPolicy
+
+instance ToJSON GetVaultAccessPolicy where
+    toJSON = const (toJSON Empty)
+
+instance AWSRequest GetVaultAccessPolicy where
+    type Sv GetVaultAccessPolicy = Glacier
+    type Rs GetVaultAccessPolicy = GetVaultAccessPolicyResponse
+
+    request  = get
+    response = jsonResponse
+
+instance FromJSON GetVaultAccessPolicyResponse where
+    parseJSON = withObject "GetVaultAccessPolicyResponse" $ \o -> GetVaultAccessPolicyResponse
+        <$> o .:? "policy"
diff --git a/gen/Network/AWS/Glacier/GetVaultNotifications.hs b/gen/Network/AWS/Glacier/GetVaultNotifications.hs
--- a/gen/Network/AWS/Glacier/GetVaultNotifications.hs
+++ b/gen/Network/AWS/Glacier/GetVaultNotifications.hs
@@ -83,10 +83,11 @@
     , _gvnVaultName = p2
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 gvnAccountId :: Lens' GetVaultNotifications Text
 gvnAccountId = lens _gvnAccountId (\s a -> s { _gvnAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/InitiateJob.hs b/gen/Network/AWS/Glacier/InitiateJob.hs
--- a/gen/Network/AWS/Glacier/InitiateJob.hs
+++ b/gen/Network/AWS/Glacier/InitiateJob.hs
@@ -30,6 +30,11 @@
 --
 -- Initiate a retrieval job.
 --
+-- A data retrieval policy can cause your initiate retrieval job request to
+-- fail with a PolicyEnforcedException exception. For more information about
+-- data retrieval policies, see <http://docs.aws.amazon.com/amazonglacier/latest/dev/data-retrieval-policy.html Amazon Glacier Data Retrieval Policies>. For more
+-- information about the PolicyEnforcedException exception, see <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-error-responses.html Error Responses>.
+--
 -- After the job completes, download the bytes.
 --
 -- The retrieval request is executed asynchronously. When you initiate a
@@ -179,10 +184,11 @@
     , _ijJobParameters = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 ijAccountId :: Lens' InitiateJob Text
 ijAccountId = lens _ijAccountId (\s a -> s { _ijAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/InitiateMultipartUpload.hs b/gen/Network/AWS/Glacier/InitiateMultipartUpload.hs
--- a/gen/Network/AWS/Glacier/InitiateMultipartUpload.hs
+++ b/gen/Network/AWS/Glacier/InitiateMultipartUpload.hs
@@ -111,10 +111,11 @@
     , _imuPartSize           = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 imuAccountId :: Lens' InitiateMultipartUpload Text
 imuAccountId = lens _imuAccountId (\s a -> s { _imuAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/ListJobs.hs b/gen/Network/AWS/Glacier/ListJobs.hs
--- a/gen/Network/AWS/Glacier/ListJobs.hs
+++ b/gen/Network/AWS/Glacier/ListJobs.hs
@@ -129,10 +129,11 @@
     , _ljCompleted  = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 ljAccountId :: Lens' ListJobs Text
 ljAccountId = lens _ljAccountId (\s a -> s { _ljAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/ListMultipartUploads.hs b/gen/Network/AWS/Glacier/ListMultipartUploads.hs
--- a/gen/Network/AWS/Glacier/ListMultipartUploads.hs
+++ b/gen/Network/AWS/Glacier/ListMultipartUploads.hs
@@ -105,10 +105,11 @@
     , _lmuLimit     = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 lmuAccountId :: Lens' ListMultipartUploads Text
 lmuAccountId = lens _lmuAccountId (\s a -> s { _lmuAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/ListParts.hs b/gen/Network/AWS/Glacier/ListParts.hs
--- a/gen/Network/AWS/Glacier/ListParts.hs
+++ b/gen/Network/AWS/Glacier/ListParts.hs
@@ -110,10 +110,11 @@
     , _lpLimit     = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 lpAccountId :: Lens' ListParts Text
 lpAccountId = lens _lpAccountId (\s a -> s { _lpAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/ListVaults.hs b/gen/Network/AWS/Glacier/ListVaults.hs
--- a/gen/Network/AWS/Glacier/ListVaults.hs
+++ b/gen/Network/AWS/Glacier/ListVaults.hs
@@ -92,10 +92,12 @@
     , _lvLimit     = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID. This value must match the AWS
+-- account ID associated with the credentials used to sign the request. You can
+-- either specify an AWS account ID or optionally a single apos'-'apos (hyphen),
+-- in which case Amazon Glacier uses the AWS account ID associated with the
+-- credentials used to sign the request. If you specify your Account ID, do not
+-- include any hyphens (apos-apos) in the ID.
 lvAccountId :: Lens' ListVaults Text
 lvAccountId = lens _lvAccountId (\s a -> s { _lvAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/SetDataRetrievalPolicy.hs b/gen/Network/AWS/Glacier/SetDataRetrievalPolicy.hs
--- a/gen/Network/AWS/Glacier/SetDataRetrievalPolicy.hs
+++ b/gen/Network/AWS/Glacier/SetDataRetrievalPolicy.hs
@@ -22,7 +22,16 @@
 --
 -- Derived from AWS service descriptions, licensed under Apache 2.0.
 
--- | <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-SetDataRetrievalPolicy.html>
+-- | This operation sets and then enacts a data retrieval policy in the region
+-- specified in the PUT request. You can set one policy per region for an AWS
+-- account. The policy is enacted within a few minutes of a successful PUT
+-- operation.
+--
+-- The set policy operation does not affect retrieval jobs that were in
+-- progress before the policy was enacted. For more information about data
+-- retrieval policies, see <http://docs.aws.amazon.com/amazonglacier/latest/dev/data-retrieval-policy.html Amazon Glacier Data Retrieval Policies>.
+--
+-- <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-SetDataRetrievalPolicy.html>
 module Network.AWS.Glacier.SetDataRetrievalPolicy
     (
     -- * Request
@@ -65,9 +74,16 @@
     , _sdrpPolicy    = Nothing
     }
 
+-- | The 'AccountId' value is the AWS account ID. This value must match the AWS
+-- account ID associated with the credentials used to sign the request. You can
+-- either specify an AWS account ID or optionally a single apos'-'apos (hyphen),
+-- in which case Amazon Glacier uses the AWS account ID associated with the
+-- credentials used to sign the request. If you specify your Account ID, do not
+-- include any hyphens (apos-apos) in the ID.
 sdrpAccountId :: Lens' SetDataRetrievalPolicy Text
 sdrpAccountId = lens _sdrpAccountId (\s a -> s { _sdrpAccountId = a })
 
+-- | The data retrieval policy in JSON format.
 sdrpPolicy :: Lens' SetDataRetrievalPolicy (Maybe DataRetrievalPolicy)
 sdrpPolicy = lens _sdrpPolicy (\s a -> s { _sdrpPolicy = a })
 
diff --git a/gen/Network/AWS/Glacier/SetVaultAccessPolicy.hs b/gen/Network/AWS/Glacier/SetVaultAccessPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/Glacier/SetVaultAccessPolicy.hs
@@ -0,0 +1,128 @@
+{-# LANGUAGE DataKinds                   #-}
+{-# LANGUAGE DeriveGeneric               #-}
+{-# LANGUAGE FlexibleInstances           #-}
+{-# LANGUAGE GeneralizedNewtypeDeriving  #-}
+{-# LANGUAGE LambdaCase                  #-}
+{-# LANGUAGE NoImplicitPrelude           #-}
+{-# LANGUAGE OverloadedStrings           #-}
+{-# LANGUAGE RecordWildCards             #-}
+{-# LANGUAGE TypeFamilies                #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- Module      : Network.AWS.Glacier.SetVaultAccessPolicy
+-- Copyright   : (c) 2013-2014 Brendan Hay <brendan.g.hay@gmail.com>
+-- License     : This Source Code Form is subject to the terms of
+--               the Mozilla Public License, v. 2.0.
+--               A copy of the MPL can be found in the LICENSE file or
+--               you can obtain it at http://mozilla.org/MPL/2.0/.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : experimental
+-- Portability : non-portable (GHC extensions)
+--
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- | This operation configures an access policy for a vault and will overwrite an
+-- existing policy. To configure a vault access policy, send a PUT request to
+-- the 'access-policy' subresource of the vault. An access policy is specific to a
+-- vault and is also called a vault subresource. You can set one access policy
+-- per vault and the policy can be up to 20 KB in size. For more information
+-- about vault access policies, see <http://docs.aws.amazon.com/amazonglacier/latest/dev/vault-access-policy.html Amazon Glacier Access Control with VaultAccess Policies>.
+--
+-- <http://docs.aws.amazon.com/amazonglacier/latest/dev/api-SetVaultAccessPolicy.html>
+module Network.AWS.Glacier.SetVaultAccessPolicy
+    (
+    -- * Request
+      SetVaultAccessPolicy
+    -- ** Request constructor
+    , setVaultAccessPolicy
+    -- ** Request lenses
+    , svapAccountId
+    , svapPolicy
+    , svapVaultName
+
+    -- * Response
+    , SetVaultAccessPolicyResponse
+    -- ** Response constructor
+    , setVaultAccessPolicyResponse
+    ) where
+
+import Network.AWS.Data (Object)
+import Network.AWS.Prelude
+import Network.AWS.Request.RestJSON
+import Network.AWS.Glacier.Types
+import qualified GHC.Exts
+
+data SetVaultAccessPolicy = SetVaultAccessPolicy
+    { _svapAccountId :: Text
+    , _svapPolicy    :: Maybe VaultAccessPolicy
+    , _svapVaultName :: Text
+    } deriving (Eq, Read, Show)
+
+-- | 'SetVaultAccessPolicy' constructor.
+--
+-- The fields accessible through corresponding lenses are:
+--
+-- * 'svapAccountId' @::@ 'Text'
+--
+-- * 'svapPolicy' @::@ 'Maybe' 'VaultAccessPolicy'
+--
+-- * 'svapVaultName' @::@ 'Text'
+--
+setVaultAccessPolicy :: Text -- ^ 'svapAccountId'
+                     -> Text -- ^ 'svapVaultName'
+                     -> SetVaultAccessPolicy
+setVaultAccessPolicy p1 p2 = SetVaultAccessPolicy
+    { _svapAccountId = p1
+    , _svapVaultName = p2
+    , _svapPolicy    = Nothing
+    }
+
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
+svapAccountId :: Lens' SetVaultAccessPolicy Text
+svapAccountId = lens _svapAccountId (\s a -> s { _svapAccountId = a })
+
+-- | The vault access policy as a JSON string.
+svapPolicy :: Lens' SetVaultAccessPolicy (Maybe VaultAccessPolicy)
+svapPolicy = lens _svapPolicy (\s a -> s { _svapPolicy = a })
+
+-- | The name of the vault.
+svapVaultName :: Lens' SetVaultAccessPolicy Text
+svapVaultName = lens _svapVaultName (\s a -> s { _svapVaultName = a })
+
+data SetVaultAccessPolicyResponse = SetVaultAccessPolicyResponse
+    deriving (Eq, Ord, Read, Show, Generic)
+
+-- | 'SetVaultAccessPolicyResponse' constructor.
+setVaultAccessPolicyResponse :: SetVaultAccessPolicyResponse
+setVaultAccessPolicyResponse = SetVaultAccessPolicyResponse
+
+instance ToPath SetVaultAccessPolicy where
+    toPath SetVaultAccessPolicy{..} = mconcat
+        [ "/"
+        , toText _svapAccountId
+        , "/vaults/"
+        , toText _svapVaultName
+        , "/access-policy"
+        ]
+
+instance ToQuery SetVaultAccessPolicy where
+    toQuery = const mempty
+
+instance ToHeaders SetVaultAccessPolicy
+
+instance ToJSON SetVaultAccessPolicy where
+    toJSON SetVaultAccessPolicy{..} = object
+        [ "policy" .= _svapPolicy
+        ]
+
+instance AWSRequest SetVaultAccessPolicy where
+    type Sv SetVaultAccessPolicy = Glacier
+    type Rs SetVaultAccessPolicy = SetVaultAccessPolicyResponse
+
+    request  = put
+    response = nullResponse SetVaultAccessPolicyResponse
diff --git a/gen/Network/AWS/Glacier/SetVaultNotifications.hs b/gen/Network/AWS/Glacier/SetVaultNotifications.hs
--- a/gen/Network/AWS/Glacier/SetVaultNotifications.hs
+++ b/gen/Network/AWS/Glacier/SetVaultNotifications.hs
@@ -97,10 +97,11 @@
     , _svnVaultNotificationConfig = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 svnAccountId :: Lens' SetVaultNotifications Text
 svnAccountId = lens _svnAccountId (\s a -> s { _svnAccountId = a })
 
diff --git a/gen/Network/AWS/Glacier/Types.hs b/gen/Network/AWS/Glacier/Types.hs
--- a/gen/Network/AWS/Glacier/Types.hs
+++ b/gen/Network/AWS/Glacier/Types.hs
@@ -131,6 +131,11 @@
     , gjdStatusMessage
     , gjdVaultARN
 
+    -- * VaultAccessPolicy
+    , VaultAccessPolicy
+    , vaultAccessPolicy
+    , vapPolicy
+
     -- * StatusCode
     , StatusCode (..)
     ) where
@@ -175,7 +180,7 @@
               -> JSONError
               -> Bool
         check (statusCode -> s) (awsErrorCode -> e)
-            | s == 400 && "ThrottlingException" == e = True -- Throttling
+            | s == 400 && (Just "ThrottlingException") == e = True -- Throttling
             | s == 500  = True -- General Server Error
             | s == 509  = True -- Limit Exceeded
             | s == 503  = True -- Service Unavailable
@@ -596,9 +601,15 @@
     , _drrBytesPerHour = Nothing
     }
 
+-- | The maximum number of bytes that can be retrieved in an hour.
+--
+-- This field is required only if the value of the Strategy field is 'BytesPerHour'. Your PUT operation will be rejected if the Strategy field is not set to 'BytesPerHour' and you set this field.
 drrBytesPerHour :: Lens' DataRetrievalRule (Maybe Integer)
 drrBytesPerHour = lens _drrBytesPerHour (\s a -> s { _drrBytesPerHour = a })
 
+-- | The type of data retrieval policy to set.
+--
+-- Valid values: BytesPerHour|FreeTier|None
 drrStrategy :: Lens' DataRetrievalRule (Maybe Text)
 drrStrategy = lens _drrStrategy (\s a -> s { _drrStrategy = a })
 
@@ -809,6 +820,8 @@
     { _drpRules = mempty
     }
 
+-- | The policy rule. Although this is a list type, currently there must be only
+-- one rule, which contains a Strategy field and optionally a BytesPerHour field.
 drpRules :: Lens' DataRetrievalPolicy [DataRetrievalRule]
 drpRules = lens _drpRules (\s a -> s { _drpRules = a }) . _List
 
@@ -1047,6 +1060,34 @@
         , "ArchiveSHA256TreeHash"        .= _gjdArchiveSHA256TreeHash
         , "RetrievalByteRange"           .= _gjdRetrievalByteRange
         , "InventoryRetrievalParameters" .= _gjdInventoryRetrievalParameters
+        ]
+
+newtype VaultAccessPolicy = VaultAccessPolicy
+    { _vapPolicy :: Maybe Text
+    } deriving (Eq, Ord, Read, Show, Monoid)
+
+-- | 'VaultAccessPolicy' constructor.
+--
+-- The fields accessible through corresponding lenses are:
+--
+-- * 'vapPolicy' @::@ 'Maybe' 'Text'
+--
+vaultAccessPolicy :: VaultAccessPolicy
+vaultAccessPolicy = VaultAccessPolicy
+    { _vapPolicy = Nothing
+    }
+
+-- | The vault access policy.
+vapPolicy :: Lens' VaultAccessPolicy (Maybe Text)
+vapPolicy = lens _vapPolicy (\s a -> s { _vapPolicy = a })
+
+instance FromJSON VaultAccessPolicy where
+    parseJSON = withObject "VaultAccessPolicy" $ \o -> VaultAccessPolicy
+        <$> o .:? "Policy"
+
+instance ToJSON VaultAccessPolicy where
+    toJSON VaultAccessPolicy{..} = object
+        [ "Policy" .= _vapPolicy
         ]
 
 data StatusCode
diff --git a/gen/Network/AWS/Glacier/UploadArchive.hs b/gen/Network/AWS/Glacier/UploadArchive.hs
--- a/gen/Network/AWS/Glacier/UploadArchive.hs
+++ b/gen/Network/AWS/Glacier/UploadArchive.hs
@@ -118,10 +118,11 @@
     , _uaChecksum           = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 uaAccountId :: Lens' UploadArchive Text
 uaAccountId = lens _uaAccountId (\s a -> s { _uaAccountId = a })
 
@@ -134,7 +135,7 @@
 uaBody :: Lens' UploadArchive RqBody
 uaBody = lens _uaBody (\s a -> s { _uaBody = a })
 
--- | The SHA256 checksum (a linear hash) of the payload.
+-- | The SHA256 tree hash of the data being uploaded.
 uaChecksum :: Lens' UploadArchive (Maybe Text)
 uaChecksum = lens _uaChecksum (\s a -> s { _uaChecksum = a })
 
diff --git a/gen/Network/AWS/Glacier/UploadMultipartPart.hs b/gen/Network/AWS/Glacier/UploadMultipartPart.hs
--- a/gen/Network/AWS/Glacier/UploadMultipartPart.hs
+++ b/gen/Network/AWS/Glacier/UploadMultipartPart.hs
@@ -129,10 +129,11 @@
     , _umpRange     = Nothing
     }
 
--- | The 'AccountId' is the AWS Account ID. You can specify either the AWS Account
--- ID or optionally a '-', in which case Amazon Glacier uses the AWS Account ID
--- associated with the credentials used to sign the request. If you specify your
--- Account ID, do not include hyphens in it.
+-- | The 'AccountId' value is the AWS account ID of the account that owns the vault.
+-- You can either specify an AWS account ID or optionally a single apos'-'apos
+-- (hyphen), in which case Amazon Glacier uses the AWS account ID associated
+-- with the credentials used to sign the request. If you use an account ID, do
+-- not include any hyphens (apos-apos) in the ID.
 umpAccountId :: Lens' UploadMultipartPart Text
 umpAccountId = lens _umpAccountId (\s a -> s { _umpAccountId = a })
 
