diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 
 ## Version
 
-`1.0.1`
+`1.1.0`
 
 
 ## Description
diff --git a/Setup.hs b/Setup.hs
--- a/Setup.hs
+++ b/Setup.hs
@@ -1,2 +1,2 @@
-import Distribution.Simple
+import           Distribution.Simple
 main = defaultMain
diff --git a/amazonka-kms.cabal b/amazonka-kms.cabal
--- a/amazonka-kms.cabal
+++ b/amazonka-kms.cabal
@@ -1,5 +1,5 @@
 name:                  amazonka-kms
-version:               1.0.1
+version:               1.1.0
 synopsis:              Amazon Key Management Service SDK.
 homepage:              https://github.com/brendanhay/amazonka
 license:               OtherLicense
@@ -147,7 +147,7 @@
         , Network.AWS.KMS.Types.Sum
 
     build-depends:
-          amazonka-core == 1.0.1.*
+          amazonka-core == 1.1.0.*
         , base          >= 4.7     && < 5
 
 test-suite amazonka-kms-test
@@ -166,9 +166,9 @@
         , Test.AWS.KMS.Internal
 
     build-depends:
-          amazonka-core == 1.0.1
-        , amazonka-test == 1.0.1
-        , amazonka-kms == 1.0.1
+          amazonka-core == 1.1.0
+        , amazonka-test == 1.1.0
+        , amazonka-kms == 1.1.0
         , base
         , bytestring
         , lens
diff --git a/gen/Network/AWS/KMS/Decrypt.hs b/gen/Network/AWS/KMS/Decrypt.hs
--- a/gen/Network/AWS/KMS/Decrypt.hs
+++ b/gen/Network/AWS/KMS/Decrypt.hs
@@ -99,6 +99,12 @@
 dGrantTokens = lens _dGrantTokens (\ s a -> s{_dGrantTokens = a}) . _Default . _Coerce;
 
 -- | Ciphertext to be decrypted. The blob includes metadata.
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
 dCiphertextBlob :: Lens' Decrypt ByteString
 dCiphertextBlob = lens _dCiphertextBlob (\ s a -> s{_dCiphertextBlob = a}) . _Base64;
 
@@ -168,6 +174,12 @@
 
 -- | Decrypted plaintext data. This value may not be returned if the customer
 -- master key is not available or if you didn\'t have permission to use it.
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
 drsPlaintext :: Lens' DecryptResponse (Maybe ByteString)
 drsPlaintext = lens _drsPlaintext (\ s a -> s{_drsPlaintext = a}) . mapping (_Sensitive . _Base64);
 
diff --git a/gen/Network/AWS/KMS/Encrypt.hs b/gen/Network/AWS/KMS/Encrypt.hs
--- a/gen/Network/AWS/KMS/Encrypt.hs
+++ b/gen/Network/AWS/KMS/Encrypt.hs
@@ -126,6 +126,12 @@
 eKeyId = lens _eKeyId (\ s a -> s{_eKeyId = a});
 
 -- | Data to be encrypted.
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
 ePlaintext :: Lens' Encrypt ByteString
 ePlaintext = lens _ePlaintext (\ s a -> s{_ePlaintext = a}) . _Sensitive . _Base64;
 
@@ -194,6 +200,12 @@
 
 -- | The encrypted plaintext. If you are using the CLI, the value is Base64
 -- encoded. Otherwise, it is not encoded.
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
 ersCiphertextBlob :: Lens' EncryptResponse (Maybe ByteString)
 ersCiphertextBlob = lens _ersCiphertextBlob (\ s a -> s{_ersCiphertextBlob = a}) . mapping _Base64;
 
diff --git a/gen/Network/AWS/KMS/GenerateDataKey.hs b/gen/Network/AWS/KMS/GenerateDataKey.hs
--- a/gen/Network/AWS/KMS/GenerateDataKey.hs
+++ b/gen/Network/AWS/KMS/GenerateDataKey.hs
@@ -70,10 +70,10 @@
     , generateDataKeyResponse
     , GenerateDataKeyResponse
     -- * Response Lenses
+    , gdkrsStatus
     , gdkrsKeyId
     , gdkrsPlaintext
     , gdkrsCiphertextBlob
-    , gdkrsStatus
     ) where
 
 import           Network.AWS.KMS.Types
@@ -161,9 +161,9 @@
           = receiveJSON
               (\ s h x ->
                  GenerateDataKeyResponse' <$>
-                   (x .?> "KeyId") <*> (x .?> "Plaintext") <*>
-                     (x .?> "CiphertextBlob")
-                     <*> (pure (fromEnum s)))
+                   (pure (fromEnum s)) <*> (x .:> "KeyId") <*>
+                     (x .:> "Plaintext")
+                     <*> (x .:> "CiphertextBlob"))
 
 instance ToHeaders GenerateDataKey where
         toHeaders
@@ -191,43 +191,56 @@
 
 -- | /See:/ 'generateDataKeyResponse' smart constructor.
 data GenerateDataKeyResponse = GenerateDataKeyResponse'
-    { _gdkrsKeyId          :: !(Maybe Text)
-    , _gdkrsPlaintext      :: !(Maybe (Sensitive Base64))
-    , _gdkrsCiphertextBlob :: !(Maybe Base64)
-    , _gdkrsStatus         :: !Int
+    { _gdkrsStatus         :: !Int
+    , _gdkrsKeyId          :: !Text
+    , _gdkrsPlaintext      :: !(Sensitive Base64)
+    , _gdkrsCiphertextBlob :: !Base64
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
 
 -- | Creates a value of 'GenerateDataKeyResponse' with the minimum fields required to make a request.
 --
 -- Use one of the following lenses to modify other fields as desired:
 --
+-- * 'gdkrsStatus'
+--
 -- * 'gdkrsKeyId'
 --
 -- * 'gdkrsPlaintext'
 --
 -- * 'gdkrsCiphertextBlob'
---
--- * 'gdkrsStatus'
 generateDataKeyResponse
     :: Int -- ^ 'gdkrsStatus'
+    -> Text -- ^ 'gdkrsKeyId'
+    -> ByteString -- ^ 'gdkrsPlaintext'
+    -> ByteString -- ^ 'gdkrsCiphertextBlob'
     -> GenerateDataKeyResponse
-generateDataKeyResponse pStatus_ =
+generateDataKeyResponse pStatus_ pKeyId_ pPlaintext_ pCiphertextBlob_ =
     GenerateDataKeyResponse'
-    { _gdkrsKeyId = Nothing
-    , _gdkrsPlaintext = Nothing
-    , _gdkrsCiphertextBlob = Nothing
-    , _gdkrsStatus = pStatus_
+    { _gdkrsStatus = pStatus_
+    , _gdkrsKeyId = pKeyId_
+    , _gdkrsPlaintext = _Sensitive . _Base64 # pPlaintext_
+    , _gdkrsCiphertextBlob = _Base64 # pCiphertextBlob_
     }
 
+-- | The response status code.
+gdkrsStatus :: Lens' GenerateDataKeyResponse Int
+gdkrsStatus = lens _gdkrsStatus (\ s a -> s{_gdkrsStatus = a});
+
 -- | System generated unique identifier of the key to be used to decrypt the
 -- encrypted copy of the data key.
-gdkrsKeyId :: Lens' GenerateDataKeyResponse (Maybe Text)
+gdkrsKeyId :: Lens' GenerateDataKeyResponse Text
 gdkrsKeyId = lens _gdkrsKeyId (\ s a -> s{_gdkrsKeyId = a});
 
 -- | Plaintext that contains the data key. Use this for encryption and
 -- decryption and then remove it from memory as soon as possible.
-gdkrsPlaintext :: Lens' GenerateDataKeyResponse (Maybe ByteString)
-gdkrsPlaintext = lens _gdkrsPlaintext (\ s a -> s{_gdkrsPlaintext = a}) . mapping (_Sensitive . _Base64);
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
+gdkrsPlaintext :: Lens' GenerateDataKeyResponse ByteString
+gdkrsPlaintext = lens _gdkrsPlaintext (\ s a -> s{_gdkrsPlaintext = a}) . _Sensitive . _Base64;
 
 -- | Ciphertext that contains the encrypted data key. You must store the blob
 -- and enough information to reconstruct the encryption context so that the
@@ -237,9 +250,11 @@
 --
 -- If you are using the CLI, the value is Base64 encoded. Otherwise, it is
 -- not encoded.
-gdkrsCiphertextBlob :: Lens' GenerateDataKeyResponse (Maybe ByteString)
-gdkrsCiphertextBlob = lens _gdkrsCiphertextBlob (\ s a -> s{_gdkrsCiphertextBlob = a}) . mapping _Base64;
-
--- | The response status code.
-gdkrsStatus :: Lens' GenerateDataKeyResponse Int
-gdkrsStatus = lens _gdkrsStatus (\ s a -> s{_gdkrsStatus = a});
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
+gdkrsCiphertextBlob :: Lens' GenerateDataKeyResponse ByteString
+gdkrsCiphertextBlob = lens _gdkrsCiphertextBlob (\ s a -> s{_gdkrsCiphertextBlob = a}) . _Base64;
diff --git a/gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs b/gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs
--- a/gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs
+++ b/gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs
@@ -198,6 +198,12 @@
 --
 -- If you are using the CLI, the value is Base64 encoded. Otherwise, it is
 -- not encoded.
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
 gdkwprsCiphertextBlob :: Lens' GenerateDataKeyWithoutPlaintextResponse (Maybe ByteString)
 gdkwprsCiphertextBlob = lens _gdkwprsCiphertextBlob (\ s a -> s{_gdkwprsCiphertextBlob = a}) . mapping _Base64;
 
diff --git a/gen/Network/AWS/KMS/GenerateRandom.hs b/gen/Network/AWS/KMS/GenerateRandom.hs
--- a/gen/Network/AWS/KMS/GenerateRandom.hs
+++ b/gen/Network/AWS/KMS/GenerateRandom.hs
@@ -117,6 +117,12 @@
     }
 
 -- | Plaintext that contains the unpredictable byte string.
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
 grrsPlaintext :: Lens' GenerateRandomResponse (Maybe ByteString)
 grrsPlaintext = lens _grrsPlaintext (\ s a -> s{_grrsPlaintext = a}) . mapping (_Sensitive . _Base64);
 
diff --git a/gen/Network/AWS/KMS/ReEncrypt.hs b/gen/Network/AWS/KMS/ReEncrypt.hs
--- a/gen/Network/AWS/KMS/ReEncrypt.hs
+++ b/gen/Network/AWS/KMS/ReEncrypt.hs
@@ -111,6 +111,12 @@
 reGrantTokens = lens _reGrantTokens (\ s a -> s{_reGrantTokens = a}) . _Default . _Coerce;
 
 -- | Ciphertext of the data to re-encrypt.
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
 reCiphertextBlob :: Lens' ReEncrypt ByteString
 reCiphertextBlob = lens _reCiphertextBlob (\ s a -> s{_reCiphertextBlob = a}) . _Base64;
 
@@ -207,6 +213,12 @@
 
 -- | The re-encrypted data. If you are using the CLI, the value is Base64
 -- encoded. Otherwise, it is not encoded.
+--
+-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data,
+-- despite what the AWS documentation might say.
+-- The underlying isomorphism will encode to Base64 representation during
+-- serialisation, and decode from Base64 representation during deserialisation.
+-- This 'Lens' accepts and returns only raw unencoded data.
 rersCiphertextBlob :: Lens' ReEncryptResponse (Maybe ByteString)
 rersCiphertextBlob = lens _rersCiphertextBlob (\ s a -> s{_rersCiphertextBlob = a}) . mapping _Base64;