diff --git a/api/config/cdr_config_local.json b/api/config/cdr_config_local.json
index 3e7c94a1873..83e4282b727 100644
--- a/api/config/cdr_config_local.json
+++ b/api/config/cdr_config_local.json
@@ -145,7 +145,8 @@
       "hasCopeSurveyData": true,
       "hasSurveyConductData": true,
       "accessTier": "registered",
-      "tanagraEnabled": true
+      "tanagraEnabled": true,
+      "vwbTemplateId": "03e0a1e6-ddbc-499f-bdaa-6c0c91dc295a"
     },
     {
       "cdrVersionId": 10,
@@ -168,7 +169,8 @@
       "microarrayVcfSingleSampleStoragePath": "microarray/vcf/single_sample",
       "accessTier": "controlled",
       "tanagraEnabled": true,
-      "needsV8GenomicExtractionWorkflow": true
+      "needsV8GenomicExtractionWorkflow": true,
+      "vwbTemplateId": "03e0a1e6-ddbc-499f-bdaa-6c0c91dc295a"
     }
   ]
 }
diff --git a/api/db/changelog/db.changelog-244-add-lab-column-to-workspace.xml b/api/db/changelog/db.changelog-244-add-lab-column-to-workspace.xml
new file mode 100644
index 00000000000..51a20dc42f0
--- /dev/null
+++ b/api/db/changelog/db.changelog-244-add-lab-column-to-workspace.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                      http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+    <changeSet author="tarekahmed" id="db.changelog-244-add-lab-column-to-workspace">
+        <addColumn tableName="workspace">
+            <column name="lab" type="ENUM('AOU', 'VWB')">
+                <constraints nullable="true"/>
+            </column>
+        </addColumn>
+    </changeSet>
+</databaseChangeLog>
diff --git a/api/db/changelog/db.changelog-245-add-vwb-template-id-cdr-version.xml b/api/db/changelog/db.changelog-245-add-vwb-template-id-cdr-version.xml
new file mode 100644
index 00000000000..b0f7ed37a91
--- /dev/null
+++ b/api/db/changelog/db.changelog-245-add-vwb-template-id-cdr-version.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                      http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+    <changeSet author="tarekahmed" id="db.changelog-245-add-vwb-template-id-cdr-version">
+        <addColumn tableName="cdr_version">
+            <column name="vwb_template_id" type="varchar(100)"/>
+        </addColumn>
+    </changeSet>
+</databaseChangeLog>
+
+
diff --git a/api/db/changelog/db.changelog-master.xml b/api/db/changelog/db.changelog-master.xml
index ab964103e58..25d2f5201d3 100644
--- a/api/db/changelog/db.changelog-master.xml
+++ b/api/db/changelog/db.changelog-master.xml
@@ -251,6 +251,8 @@
   <include file="changelog/db.changelog-241-replace-user-initial-credits-expiration-status.xml"/>
   <include file="changelog/db.changelog-242-remove-old-workspace-columns.xml"/>
   <include file="changelog/db.changelog-243-replace-extension-count.xml"/>
+  <include file="changelog/db.changelog-244-add-lab-column-to-workspace.xml"/>
+  <include file="changelog/db.changelog-245-add-vwb-template-id-cdr-version.xml"/>
   <!--
    Note: to update the DB locally, do the following:
    - Migrate schema changes: `./project.rb run-local-all-migrations`
diff --git a/api/src/main/java/org/pmiops/workbench/db/model/DbCdrVersion.java b/api/src/main/java/org/pmiops/workbench/db/model/DbCdrVersion.java
index 3c2ab360fbf..a62af11c560 100644
--- a/api/src/main/java/org/pmiops/workbench/db/model/DbCdrVersion.java
+++ b/api/src/main/java/org/pmiops/workbench/db/model/DbCdrVersion.java
@@ -63,6 +63,8 @@ public class DbCdrVersion {
 
   private Boolean needsV8GenomicExtractionWorkflow;
 
+  private String vwbTemplateID;
+
   @Id
   @Column(name = "cdr_version_id")
   public long getCdrVersionId() {
@@ -506,6 +508,16 @@ public DbCdrVersion setNeedsV8GenomicExtractionWorkflow(
     return this;
   }
 
+  @Column(name = "vwb_template_id")
+  public String getVwbTemplateID() {
+    return vwbTemplateID;
+  }
+
+  public DbCdrVersion setVwbTemplateID(String vwbTemplateID) {
+    this.vwbTemplateID = vwbTemplateID;
+    return this;
+  }
+
   @Override
   public int hashCode() {
     return Objects.hash(
@@ -550,7 +562,8 @@ public int hashCode() {
         wgsLongReadsHailT2T,
         wgsLongReadsJointVcfGRCh38,
         wgsLongReadsJointVcfT2T,
-        needsV8GenomicExtractionWorkflow);
+        needsV8GenomicExtractionWorkflow,
+        vwbTemplateID);
   }
 
   @Override
@@ -604,6 +617,7 @@ public boolean equals(Object o) {
         && Objects.equals(wgsLongReadsHailT2T, that.wgsLongReadsHailT2T)
         && Objects.equals(wgsLongReadsJointVcfGRCh38, that.wgsLongReadsJointVcfGRCh38)
         && Objects.equals(wgsLongReadsJointVcfT2T, that.wgsLongReadsJointVcfT2T)
-        && Objects.equals(needsV8GenomicExtractionWorkflow, that.needsV8GenomicExtractionWorkflow);
+        && Objects.equals(needsV8GenomicExtractionWorkflow, that.needsV8GenomicExtractionWorkflow)
+        && Objects.equals(vwbTemplateID, that.vwbTemplateID);
   }
 }
diff --git a/api/src/main/java/org/pmiops/workbench/db/model/DbWorkspace.java b/api/src/main/java/org/pmiops/workbench/db/model/DbWorkspace.java
index 7c04b617736..00a9f1d6d73 100644
--- a/api/src/main/java/org/pmiops/workbench/db/model/DbWorkspace.java
+++ b/api/src/main/java/org/pmiops/workbench/db/model/DbWorkspace.java
@@ -27,11 +27,7 @@
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.pmiops.workbench.db.model.DbFeaturedWorkspace.DbFeaturedCategory;
-import org.pmiops.workbench.model.BillingStatus;
-import org.pmiops.workbench.model.DisseminateResearchEnum;
-import org.pmiops.workbench.model.ResearchOutcomeEnum;
-import org.pmiops.workbench.model.SpecificPopulationEnum;
-import org.pmiops.workbench.model.WorkspaceActiveStatus;
+import org.pmiops.workbench.model.*;
 
 @Entity
 @SecondaryTable(
@@ -96,6 +92,8 @@ public class DbWorkspace {
   private DbFeaturedCategory featuredCategory;
   private boolean usesTanagra;
 
+  private Workspace.LabEnum lab;
+
   public DbWorkspace() {
     setWorkspaceActiveStatusEnum(WorkspaceActiveStatus.ACTIVE);
   }
@@ -790,4 +788,14 @@ public DbWorkspace setUsesTanagra(boolean usesTanagra) {
   public boolean isCDRAndWorkspaceTanagraEnabled() {
     return usesTanagra && cdrVersion.getTanagraEnabled();
   }
+
+  @Column(name = "lab")
+  @Enumerated(EnumType.STRING)
+  public Workspace.LabEnum getLab() {
+    return lab;
+  }
+
+  public void setLab(Workspace.LabEnum lab) {
+    this.lab = lab;
+  }
 }
diff --git a/api/src/main/java/org/pmiops/workbench/tools/cdrconfig/CdrVersionVO.java b/api/src/main/java/org/pmiops/workbench/tools/cdrconfig/CdrVersionVO.java
index 144b7f4ea99..0a90a462d9c 100644
--- a/api/src/main/java/org/pmiops/workbench/tools/cdrconfig/CdrVersionVO.java
+++ b/api/src/main/java/org/pmiops/workbench/tools/cdrconfig/CdrVersionVO.java
@@ -55,4 +55,6 @@ public class CdrVersionVO {
   public String wgsLongReadsJointVcfT2T;
 
   public Boolean needsV8GenomicExtractionWorkflow;
+
+  public String vwbTemplateID;
 }
diff --git a/api/src/main/java/org/pmiops/workbench/utils/mappers/WorkspaceMapper.java b/api/src/main/java/org/pmiops/workbench/utils/mappers/WorkspaceMapper.java
index b80e2a2c3a3..030d36f1d9c 100644
--- a/api/src/main/java/org/pmiops/workbench/utils/mappers/WorkspaceMapper.java
+++ b/api/src/main/java/org/pmiops/workbench/utils/mappers/WorkspaceMapper.java
@@ -59,6 +59,7 @@ public interface WorkspaceMapper {
   @Mapping(target = "initialCredits.exhausted", source = "dbWorkspace.initialCreditsExhausted")
   @Mapping(target = "initialCredits.expired", source = "dbWorkspace.initialCreditsExpired")
   @Mapping(target = "usesTanagra", source = "dbWorkspace.usesTanagra")
+  @Mapping(target = "lab", source = "dbWorkspace.lab")
   Workspace toApiWorkspace(
       DbWorkspace dbWorkspace,
       RawlsWorkspaceDetails fcWorkspace,
@@ -139,6 +140,7 @@ default List<WorkspaceResponse> toApiWorkspaceResponseList(
   @Mapping(target = "namespace", source = "workspaceNamespace")
   @Mapping(target = "researchPurpose", source = "dbWorkspace")
   @Mapping(target = "accessTierShortName", source = "dbWorkspace.cdrVersion.accessTier.shortName")
+  @Mapping(target = "lab", source = "dbWorkspace.lab")
   // provides an incomplete workspace!  Only for use by the RecentWorkspace mapper
   Workspace onlyForMappingRecentWorkspace(
       DbWorkspace dbWorkspace, @Context InitialCreditsService initialCreditsService);
@@ -202,6 +204,7 @@ RecentWorkspace toApiRecentWorkspace(
   @Mapping(target = "initialCreditsExpired", ignore = true)
   @Mapping(target = "initialCreditsExhausted", ignore = true)
   @Mapping(target = "usesTanagra", ignore = true)
+  @Mapping(target = "lab", ignore = true)
   void mergeResearchPurposeIntoWorkspace(
       @MappingTarget DbWorkspace workspace, ResearchPurpose researchPurpose);
 
diff --git a/api/src/main/resources/workbench-api.yaml b/api/src/main/resources/workbench-api.yaml
index 058593933c6..0386d46ad38 100644
--- a/api/src/main/resources/workbench-api.yaml
+++ b/api/src/main/resources/workbench-api.yaml
@@ -7321,6 +7321,12 @@ components:
           type: boolean
           description: Whether a workspace uses Tanagra
           default: false
+        lab:
+          type: string
+          description: the lab that owns the workspace (aou or vwb)
+          enum:
+            - AOU
+            - VWB
 
       example:
         billingAccountName: billingAccounts/000000-AAAAAA-111111
diff --git a/api/src/main/resources/ws-manager.yaml b/api/src/main/resources/ws-manager.yaml
index 28cd775cbd7..b6606dd42cb 100644
--- a/api/src/main/resources/ws-manager.yaml
+++ b/api/src/main/resources/ws-manager.yaml
@@ -4,52 +4,39 @@ info:
   description: Workspace Manager REST API to manage workspaces.
   version: 0.0.1
 paths:
-  /api/admin/v1/resources/controlled/backfillRegions/result/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/JobId'
-    get:
-      summary: Get the result of a async job to sync IAM roles.
-      operationId: getBackfillControlledResourcesRegionsResult
+  /api/admin/v1/resources/filtered:
+    post:
+      summary: Filter resources by assigned user
+      operationId: filterUserResources
       tags:
         - Admin
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ResourceFilterByAssignedUser'
       responses:
         '200':
-          $ref: '#/components/responses/JobResultResponse'
-        '202':
-          $ref: '#/components/responses/JobResultResponse'
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ResourceList'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
-        '409':
-          $ref: '#/components/responses/Conflict'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/admin/v1/workspaces/cloudcontexts/syncIamRoles:
-    patch:
-      parameters:
-        - $ref: '#/components/parameters/WetRun'
-      summary: Sync custom IAM roles for all workspaces.
-      operationId: syncIamRoles
-      tags:
-        - Admin
-      responses:
-        '200':
-          $ref: '#/components/responses/JobResultResponse'
-        '202':
-          $ref: '#/components/responses/JobResultResponse'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/admin/v1/workspaces/cloudcontexts/syncIamRoles/result/{jobId}:
+  /api/admin/v1/result/{jobId}:
     parameters:
       - $ref: '#/components/parameters/JobId'
     get:
-      summary: Get the result of a async job to sync IAM roles.
-      operationId: getSyncIamRolesResult
+      summary: Get the result of a async admin job.
+      operationId: getAdminJobResult
       tags:
         - Admin
       responses:
@@ -67,217 +54,159 @@ paths:
           $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/job/v1/jobs/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/JobId'
-    get:
-      tags:
-        - jobs
-      operationId: retrieveJob
-      responses:
-        200:
-          description: Job is complete (succeeded or failed)
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/JobReport'
-        202:
-          description: Job is running
-          headers:
-            Retry-After:
-              description: optional - estimated seconds to wait before polling again.
-                This allows a server to offer a hint as to when the job might be complete.
-              schema:
-                type: integer
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/JobReport'
-        400:
-          $ref: '#/components/responses/BadRequest'
-        403:
-          $ref: '#/components/responses/PermissionDenied'
-        404:
-          $ref: '#/components/responses/NotFound'
-  /api/landingzones/definitions/v1/azure:
-    get:
-      summary: List all Azure landing zones definitions
-      operationId: listAzureLandingZonesDefinitions
-      tags:
-        - LandingZones
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AzureLandingZoneDefinitionList'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/landingzones/v1/azure:
-    post:
-      summary: Starts an async job to create an Azure landing zone
-      operationId: createAzureLandingZone
+  /api/admin/v1/workspaces/backfillApplications:
+    patch:
+      summary: backfill a list of given applications on all workspaces
+      operationId: backfillWorkspaceApplications
       tags:
-        - LandingZones
+        - Admin
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateAzureLandingZoneRequestBody'
+              $ref: '#/components/schemas/BackfillApplicationsRequest'
       responses:
         '200':
-          $ref: '#/components/responses/CreateLandingZoneResponse'
+          $ref: '#/components/responses/JobResultResponse'
         '202':
-          $ref: '#/components/responses/CreateLandingZoneResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
+          $ref: '#/components/responses/JobResultResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-    get:
+  /api/admin/v1/workspaces/backfillRoles:
+    patch:
+      summary: backfill AoD roles
+      operationId: backfillWorkspaceRoles
+      tags:
+        - Admin
       parameters:
-        - $ref: '#/components/parameters/BillingProfileId'
-      summary: List Azure landing zones available to user
-      operationId: listAzureLandingZones
+        - in: query
+          name: email
+          description: AoD support group email
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '202':
+          $ref: '#/components/responses/JobResultResponse'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/admin/v1/workspaces/byUserFacingId/{workspaceUserFacingId}:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceUserFacingId'
+    get:
+      summary: Retrieve the workspace UUID given the UFID with no permission check
+        - only to be used by UM
+      operationId: getWorkspaceByUfid
       tags:
-        - LandingZones
+        - Admin
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/AzureLandingZoneList'
-        '409':
-          $ref: '#/components/responses/Conflict'
+                type: string
+                description: UUID string of the workspace
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/landingzones/v1/azure/create-result/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/JobId'
-    get:
-      summary: Get the status of a async job to create an Azure Landing Zone
-      operationId: getCreateAzureLandingZoneResult
+  /api/admin/v1/workspaces/cloudcontexts/syncIamRoles:
+    patch:
+      parameters:
+        - $ref: '#/components/parameters/WetRun'
+      summary: Sync custom IAM roles for all workspaces.
+      operationId: syncIamRoles
       tags:
-        - LandingZones
+        - Admin
       responses:
         '200':
-          $ref: '#/components/responses/CreateLandingZoneJobResponse'
+          $ref: '#/components/responses/JobResultResponse'
         '202':
-          $ref: '#/components/responses/CreateLandingZoneJobResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
+          $ref: '#/components/responses/JobResultResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/landingzones/v1/azure/{landingZoneId}:
+  /api/admin/v1/workspaces/{workspaceId}/aod:
     parameters:
-      - $ref: '#/components/parameters/LandingZoneId'
+      - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: 'Starts an async job to delete an existing Azure landing zone. OpenAPI
-
-        does not support request body in DELETE, but async state requires it.
-
-        Hence this is a POST.
-
-        '
-      operationId: deleteAzureLandingZone
+      summary: Access on demand grant - only to be used by UM
+      operationId: aodOperation
       tags:
-        - LandingZones
+        - Admin
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/DeleteAzureLandingZoneRequestBody'
-      responses:
-        '200':
-          $ref: '#/components/responses/DeleteAzureLandingZoneResponse'
-        '202':
-          $ref: '#/components/responses/DeleteAzureLandingZoneResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-    get:
-      summary: Get Azure landing zone
-      operationId: getAzureLandingZone
-      tags:
-        - LandingZones
+              $ref: '#/components/schemas/AccessOnDemandRequest'
       responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AzureLandingZone'
+        '204':
+          description: Success
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/landingzones/v1/azure/{landingZoneId}/delete-result/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/LandingZoneId'
-      - $ref: '#/components/parameters/JobId'
-    get:
-      summary: Get the result of a async job to delete the Azure Landing Zone
-      operationId: getDeleteAzureLandingZoneResult
-      tags:
-        - LandingZones
-      responses:
-        '200':
-          $ref: '#/components/responses/DeleteAzureLandingZoneJobResponse'
-        '202':
-          $ref: '#/components/responses/DeleteAzureLandingZoneJobResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/landingzones/v1/azure/{landingZoneId}/resource-quota:
-    parameters:
-      - $ref: '#/components/parameters/LandingZoneId'
-      - $ref: '#/components/parameters/AzureResourceId'
-    get:
-      summary: Get the quota information of a resource an Azure Landing Zone
-      operationId: getResourceQuotaResult
+  /api/admin/v1/workspaces/{workspaceId}/owners:
+    post:
+      parameters:
+        - $ref: '#/components/parameters/WorkspaceId'
+      summary: Add the current user to the workspace as an Owner.
+      operationId: addWorkspaceOwner
       tags:
-        - LandingZones
+        - Admin
       responses:
-        '200':
-          $ref: '#/components/responses/ResourceQuotaResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
+        '204':
+          description: Success
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/landingzones/v1/azure/{landingZoneId}/resources:
+  /api/job/v1/jobs/{jobId}:
     parameters:
-      - $ref: '#/components/parameters/LandingZoneId'
+      - $ref: '#/components/parameters/JobId'
     get:
-      summary: List all Azure landing zones resources
-      operationId: listAzureLandingZoneResources
       tags:
-        - LandingZones
+        - jobs
+      operationId: retrieveJob
       responses:
-        '200':
-          description: OK
+        200:
+          description: Job is complete (succeeded or failed)
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/AzureLandingZoneResourcesList'
-        '500':
-          $ref: '#/components/responses/ServerError'
+                $ref: '#/components/schemas/JobReport'
+        202:
+          description: Job is running
+          headers:
+            Retry-After:
+              description: optional - estimated seconds to wait before polling again.
+                This allows a server to offer a hint as to when the job might be complete.
+              schema:
+                type: integer
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JobReport'
+        400:
+          $ref: '#/components/responses/BadRequest'
+        403:
+          $ref: '#/components/responses/PermissionDenied'
+        404:
+          $ref: '#/components/responses/NotFound'
   /api/policies/v1/getLocationInfo:
     parameters:
       - $ref: '#/components/parameters/Platform'
@@ -385,30 +314,6 @@ paths:
         '500':
           $ref: '#/components/responses/ServerError'
   /api/workspaces/v1:
-    post:
-      summary: Create a new Workspace.
-      operationId: createWorkspace
-      tags:
-        - Workspace
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CreateWorkspaceRequestBody'
-      responses:
-        '200':
-          description: Response to createWorkspace calls
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CreatedWorkspace'
-        '400':
-          $ref: '#/components/responses/BadRequest'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/NotFound'
     get:
       parameters:
         - $ref: '#/components/parameters/Offset'
@@ -427,62 +332,72 @@ paths:
                 $ref: '#/components/schemas/WorkspaceDescriptionList'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/workspaceByUserFacingId/{workspaceUserFacingId}:
+  /api/workspaces/v1/resources:
     parameters:
-      - $ref: '#/components/parameters/WorkspaceUserFacingId'
+      - $ref: '#/components/parameters/Offset'
+      - $ref: '#/components/parameters/Limit'
+      - $ref: '#/components/parameters/ResourceTypes'
       - $ref: '#/components/parameters/MinimumHighestRole'
+      - $ref: '#/components/parameters/StewardshipType'
+      - $ref: '#/components/parameters/ResolveReference'
     get:
-      summary: Get an existing Workspace by userFacingId.
-      operationId: getWorkspaceByUserFacingId
+      summary: 'Enumerate resources. The visible resources depend on the permissions
+        of the caller.
+
+        '
+      operationId: getResourcesForUser
       tags:
-        - Workspace
+        - Resource
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/WorkspaceDescription'
+                $ref: '#/components/schemas/ResourceList'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}:
+  /api/workspaces/v1/resources/{resourceId}:
     parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/ResourceId'
+      - $ref: '#/components/parameters/ResolveReference'
     get:
-      summary: Get an existing Workspace.
-      operationId: getWorkspace
+      summary: 'Retrieve a resource.
+
+        '
+      operationId: getResourceWithoutWorkspaceId
       tags:
-        - Workspace
-      parameters:
-        - $ref: '#/components/parameters/MinimumHighestRole'
+        - Resource
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/WorkspaceDescription'
+                $ref: '#/components/schemas/ResourceDescription'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-    patch:
-      summary: Update an existing Workspace.
-      operationId: updateWorkspace
-      tags:
-        - Workspace
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UpdateWorkspaceRequestBody'
+  /api/workspaces/v1/workspaceByUserFacingId/{workspaceUserFacingId}:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceUserFacingId'
+      - $ref: '#/components/parameters/MinimumHighestRole'
+    get:
+      summary: Get an existing Workspace by userFacingId.
+      operationId: getWorkspaceByUserFacingId
+      tags:
+        - Workspace
       responses:
         '200':
           description: OK
@@ -496,21 +411,47 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-    delete:
-      deprecated: true
-      summary: 'Delete a Workspace.
-
-        Deprecated in favor of the async V2 version.
-
-        '
-      operationId: deleteWorkspace
+  /api/workspaces/v1/{workspaceId}:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+    get:
+      summary: Get an existing Workspace.
+      operationId: getWorkspace
       tags:
         - Workspace
+      parameters:
+        - $ref: '#/components/parameters/MinimumHighestRole'
       responses:
-        '204':
-          description: Success
-        '400':
-          $ref: '#/components/responses/BadRequest'
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WorkspaceDescription'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+    patch:
+      summary: Update an existing Workspace.
+      operationId: updateWorkspace
+      tags:
+        - Workspace
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UpdateWorkspaceRequestBody'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WorkspaceDescription'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
@@ -703,23 +644,21 @@ paths:
           $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/cloudcontexts/{cloudContext}:
+  /api/workspaces/v1/{workspaceId}/describe:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/CloudContext'
-    delete:
-      deprecated: true
-      summary: 'Deletes a cloud context and all of its data from a workspace.
-
-        Deprecated in favor of the async V2 version.
-
-        '
-      operationId: deleteCloudContext
+    get:
+      summary: Get a detailed description of an existing Workspace.
+      operationId: describeWorkspace
       tags:
         - Workspace
       responses:
-        '204':
+        '200':
           description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WorkspaceDescription'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
@@ -935,6 +874,35 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
+  /api/workspaces/v1/{workspaceId}/gcp/natgateway:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+    post:
+      summary: Create a NAT Router in the specified region
+      description: "This endpoint creates a NAT Router for the workspace project network\
+        \ in the specified region to allow access\nto the outside internet. While\
+        \ this is handled automatically for cloud environments, this endpoint allows\
+        \ \ncallers to create these gateways for other sources of compute, like workflows.\n"
+      operationId: createNatGateway
+      tags:
+        - Workspace
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateNatGatewayRequestBody'
+      responses:
+        '204':
+          description: OK
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
   /api/workspaces/v1/{workspaceId}/listValidRegions:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
@@ -1104,6 +1072,7 @@ paths:
       - $ref: '#/components/parameters/Limit'
       - $ref: '#/components/parameters/ResourceType'
       - $ref: '#/components/parameters/StewardshipType'
+      - $ref: '#/components/parameters/ResolveReference'
     get:
       summary: 'Enumerate resources in a workspace. The visible resources depend on
         the permissions of the caller.
@@ -1236,13 +1205,12 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/externalBucket:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: "Create a new controlled AWS SageMaker Notebook instance resource.\
-        \ This \nis async, because the operation can take a few minutes.\n"
-      operationId: createAwsSageMakerNotebook
+      summary: Create a new controlled externally-managed AWS S3 Storage Bucket resource.
+      operationId: createAwsS3ExternalBucket
       tags:
         - ControlledAwsResource
       requestBody:
@@ -1250,71 +1218,37 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateControlledAwsSageMakerNotebookRequestBody'
-      responses:
-        '200':
-          $ref: '#/components/responses/CreateControlledAwsSageMakerNotebookResponse'
-        '202':
-          $ref: '#/components/responses/CreateControlledAwsSageMakerNotebookResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/create-result/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/JobId'
-    get:
-      summary: Retrieve information about an AWS SageMaker Notebook instance resource
-        creation job.
-      operationId: getCreateAwsSageMakerNotebookResult
-      tags:
-        - ControlledAwsResource
+              $ref: '#/components/schemas/CreateControlledAwsS3ExternalBucketRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/CreateControlledAwsSageMakerNotebookResponse'
-        '202':
-          $ref: '#/components/responses/CreateControlledAwsSageMakerNotebookResponse'
+          $ref: '#/components/responses/CreateControlledAwsS3ExternalBucketResponse'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/delete-result/{jobId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/externalBucket/{resourceId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/JobId'
+      - $ref: '#/components/parameters/ResourceId'
     get:
-      summary: Retrieve information about an AWS SageMaker Notebook resource deletion
-        job.
-      operationId: getDeleteAwsSageMakerNotebookResult
+      summary: Get a controlled externally-managed AWS S3 Storage Bucket resource.
+      operationId: getAwsS3ExternalBucket
       tags:
         - ControlledAwsResource
       responses:
         '200':
-          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
-        '202':
-          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
+          $ref: '#/components/responses/GetControlledAwsS3ExternalBucketResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/generateName:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-    post:
-      summary: Generate a cloud native controlled AWS SageMaker Notebook instance
-        name.
-      operationId: generateAwsSageMakerNotebookCloudName
+    patch:
+      summary: Update a controlled externally managed AWS S3 Storage Bucket resource.
+      operationId: updateAwsS3ExternalBucket
       tags:
         - ControlledAwsResource
       requestBody:
@@ -1322,61 +1256,43 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/GenerateAwsResourceCloudNameRequestBody'
-      responses:
-        '200':
-          $ref: '#/components/responses/GenerateAwsResourceCloudNameResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/{resourceId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/ResourceId'
-    get:
-      summary: Get a controlled AWS SageMaker Notebook resource.
-      operationId: getAwsSageMakerNotebook
-      tags:
-        - ControlledAwsResource
+              $ref: '#/components/schemas/UpdateControlledAwsS3ExternalBucketRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/GetControlledAwsSageMakerNotebookResponse'
+          $ref: '#/components/responses/UpdateControlledAwsS3ExternalBucketResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-    patch:
-      summary: Update a controlled AWS SageMaker Notebook resource.
-      operationId: updateAwsSageMakerNotebook
+    delete:
+      summary: Delete a controlled externally managed AWS S3 Storage Bucket resource.
+      operationId: deleteAwsS3ExternalBucket
       tags:
         - ControlledAwsResource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UpdateControlledAwsSageMakerNotebookRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/UpdateControlledAwsSageMakerNotebookResponse'
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '202':
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
-        '409':
-          $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/externalBucket/{resourceId}/clone:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/ResourceId'
     post:
-      summary: "Delete a controlled AWS SageMaker Notebook resource. This is async,\
-        \ because the \noperation can take a few minutes. OpenAPI does not support\
-        \ request body \nin DELETE, but async state requires it. Hence this is a POST.\n"
-      operationId: deleteAwsSageMakerNotebook
+      summary: Clone an externally managed S3 Bucket resource.
+      operationId: cloneAwsS3ExternalBucket
       tags:
         - ControlledAwsResource
       requestBody:
@@ -1384,30 +1300,26 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/DeleteControlledAwsResourceRequestBody'
+              $ref: '#/components/schemas/CloneControlledAwsS3ExternalBucketRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
-        '202':
-          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
+          $ref: '#/components/responses/CloneControlledAwsS3ExternalBucketResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/{resourceId}/credential:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/externalBucket/{resourceId}/credential:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
       - $ref: '#/components/parameters/AwsCredentialAccessScope'
       - $ref: '#/components/parameters/AwsCredentialDurationSeconds'
     get:
-      summary: Get a credential to access this SageMaker Notebook in the AWS CLI or
-        SDK.
-      operationId: getAwsSageMakerNotebookCredential
+      summary: Get a credential to access this externally managed S3 Storage Bucket
+        in the AWS CLI or SDK.
+      operationId: getAwsS3ExternalBucketCredential
       tags:
         - ControlledAwsResource
       responses:
@@ -1421,12 +1333,17 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/instances:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: Create a new controlled AWS S3 Storage Folder resource.
-      operationId: createAwsS3StorageFolder
+      summary: 'Create a new controlled AWS EC2 Virtual Machine instance resource.
+        This
+
+        is async, because the operation can take a few minutes.
+
+        '
+      operationId: createAwsEc2Instance
       tags:
         - ControlledAwsResource
       requestBody:
@@ -1434,31 +1351,33 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateControlledAwsS3StorageFolderRequestBody'
+              $ref: '#/components/schemas/CreateControlledAwsEc2InstanceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/CreateControlledAwsS3StorageFolderResponse'
+          $ref: '#/components/responses/CreateControlledAwsEc2InstanceResponse'
+        '202':
+          $ref: '#/components/responses/CreateControlledAwsEc2InstanceResponse'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/delete-result/{jobId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/instances/create-result/{jobId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/JobId'
     get:
-      summary: Retrieve information about an AWS S3 Storage Folder resource deletion
-        job.
-      operationId: getDeleteAwsS3StorageFolderResult
+      summary: Retrieve information about an AWS EC2 Virtual Machine instance resource
+        creation job.
+      operationId: getCreateAwsEc2InstanceResult
       tags:
         - ControlledAwsResource
       responses:
         '200':
-          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+          $ref: '#/components/responses/CreateControlledAwsEc2InstanceResponse'
         '202':
-          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+          $ref: '#/components/responses/CreateControlledAwsEc2InstanceResponse'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
@@ -1467,50 +1386,57 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/generateName:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/instances/delete-result/{jobId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-    post:
-      summary: Generate a cloud native controlled AWS S3 Storage Folder name.
-      operationId: generateAwsS3StorageFolderCloudName
+      - $ref: '#/components/parameters/JobId'
+    get:
+      summary: Retrieve information about an AWS EC2 Virtual Machine resource deletion
+        job.
+      operationId: getDeleteAwsEc2InstanceResult
       tags:
         - ControlledAwsResource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/GenerateAwsResourceCloudNameRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/GenerateAwsResourceCloudNameResponse'
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '202':
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/{resourceId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/instances/{resourceId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
     get:
-      summary: Get a controlled AWS S3 Storage Folder resource.
-      operationId: getAwsS3StorageFolder
+      summary: Get a controlled AWS EC2 Virtual Machine resource.
+      operationId: getAwsEc2Instance
       tags:
         - ControlledAwsResource
       responses:
         '200':
-          $ref: '#/components/responses/GetControlledAwsS3StorageFolderResponse'
+          $ref: '#/components/responses/GetControlledAwsEc2InstanceResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-    patch:
-      summary: Update a controlled AWS S3 Storage resource.
-      operationId: updateAwsS3StorageFolder
+    post:
+      summary: 'Delete a controlled AWS EC2 Virtual Machine resource. This is async,
+        because the
+
+        operation can take a few minutes. OpenAPI does not support request body
+
+        in DELETE, but async state requires it. Hence this is a POST.
+
+        '
+      operationId: deleteAwsEc2Instance
       tags:
         - ControlledAwsResource
       requestBody:
@@ -1518,23 +1444,23 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/UpdateControlledAwsS3StorageFolderRequestBody'
+              $ref: '#/components/schemas/DeleteControlledAwsResourceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/UpdateControlledAwsS3StorageFolderResponse'
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '202':
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
-        '409':
-          $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-    post:
-      summary: "Delete a controlled AWS S3 Storage resource. This is async, because\
-        \ the \noperation can take a few minutes. OpenAPI does not support request\
-        \ body \nin DELETE, but async state requires it. Hence this is a POST.\n"
-      operationId: deleteAwsS3StorageFolder
+    patch:
+      summary: Update a controlled AWS EC2 Virtual Machine instance resource.
+      operationId: updateAwsEc2Instance
       tags:
         - ControlledAwsResource
       requestBody:
@@ -1542,30 +1468,32 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/DeleteControlledAwsResourceRequestBody'
+              $ref: '#/components/schemas/UpdateControlledAwsEc2InstanceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
-        '202':
-          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
-        '400':
-          $ref: '#/components/responses/BadRequest'
+          description: Response to get AWS EC2 Virtual Machine resource.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AwsEc2InstanceResource'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/{resourceId}/credential:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/instances/{resourceId}/credential:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
       - $ref: '#/components/parameters/AwsCredentialAccessScope'
       - $ref: '#/components/parameters/AwsCredentialDurationSeconds'
     get:
-      summary: Get a credential to access this S3 Storage Folder in the AWS CLI or
-        SDK.
-      operationId: getAwsS3StorageFolderCredential
+      summary: Get a credential to access this EC2 Virtual Machine in the AWS CLI
+        or SDK.
+      operationId: getAwsEc2InstanceCredential
       tags:
         - ControlledAwsResource
       responses:
@@ -1579,43 +1507,22 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/batchpool:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/instances/{resourceId}/describe:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-    post:
-      summary: Create a new controlled Azure Batch Pool
-      operationId: createAzureBatchPool
+      - $ref: '#/components/parameters/ResourceId'
+    get:
+      summary: Get the description of the AWS EC2 Instance cloud resource
+      operationId: describeAwsEc2Instance
       tags:
-        - ControlledAzureResource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CreateControlledAzureBatchPoolRequestBody'
+        - ControlledAwsResource
       responses:
         '200':
-          description: Response to create controlled Azure Batch Pool
+          description: Result of calling ec2:DescribeInstances API
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/CreatedControlledAzureBatchPool'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/batchpool/{resourceId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/ResourceId'
-    delete:
-      summary: Delete an Azure Batch Pool
-      operationId: deleteAzureBatchPool
-      tags:
-        - ControlledAzureResource
-      responses:
-        '204':
-          description: Success
+                $ref: '#/components/schemas/AwsResourceDescription'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
@@ -1624,560 +1531,383 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/databases:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: Create a new controlled Azure Database
-      operationId: createAzureDatabase
+      summary: 'Create a new controlled AWS SageMaker Notebook instance resource.
+        This
+
+        is async, because the operation can take a few minutes.
+
+        '
+      operationId: createAwsSageMakerNotebook
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateControlledAzureDatabaseRequestBody'
+              $ref: '#/components/schemas/CreateControlledAwsSageMakerNotebookRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/CreateControlledAzureDatabaseResponse'
+          $ref: '#/components/responses/CreateControlledAwsSageMakerNotebookResponse'
+        '202':
+          $ref: '#/components/responses/CreateControlledAwsSageMakerNotebookResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/databases/create-result/{jobId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/create-result/{jobId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/JobId'
     get:
-      summary: Retrieve information about an Azure Database create job.
-      operationId: getCreateAzureDatabaseResult
+      summary: Retrieve information about an AWS SageMaker Notebook instance resource
+        creation job.
+      operationId: getCreateAwsSageMakerNotebookResult
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       responses:
         '200':
-          $ref: '#/components/responses/CreateControlledAzureDatabaseResponse'
+          $ref: '#/components/responses/CreateControlledAwsSageMakerNotebookResponse'
         '202':
-          $ref: '#/components/responses/CreateControlledAzureDatabaseResponse'
+          $ref: '#/components/responses/CreateControlledAwsSageMakerNotebookResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/databases/{resourceId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/delete-result/{jobId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/ResourceId'
+      - $ref: '#/components/parameters/JobId'
     get:
-      summary: Get a controlled Azure Database resource
-      operationId: getAzureDatabase
+      summary: Retrieve information about an AWS SageMaker Notebook resource deletion
+        job.
+      operationId: getDeleteAwsSageMakerNotebookResult
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       responses:
         '200':
-          description: Response to get database
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AzureDatabaseResource'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
-    delete:
-      summary: Delete a controlled Azure Database resource.
-      operationId: deleteAzureDatabase
-      tags:
-        - ControlledAzureResource
-      responses:
-        '204':
-          description: Success
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '202':
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/disks:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/generateName:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: Create a new controlled Azure Disk
-      operationId: createAzureDisk
+      summary: Generate a cloud native controlled AWS SageMaker Notebook instance
+        name.
+      operationId: generateAwsSageMakerNotebookCloudName
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateControlledAzureDiskRequestBody'
+              $ref: '#/components/schemas/GenerateAwsResourceCloudNameRequestBody'
       responses:
         '200':
-          description: Response to create controlled Azure disk
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CreatedControlledAzureDisk'
+          $ref: '#/components/responses/GenerateAwsResourceCloudNameResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/disks/delete-result/{jobId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/{resourceId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/JobId'
+      - $ref: '#/components/parameters/ResourceId'
     get:
-      summary: Retrieve information about an azure disk deletion job.
-      operationId: getDeleteAzureDiskResult
+      summary: Get a controlled AWS SageMaker Notebook resource.
+      operationId: getAwsSageMakerNotebook
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       responses:
         '200':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
-        '202':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
+          $ref: '#/components/responses/GetControlledAwsSageMakerNotebookResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/disks/{resourceId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/ResourceId'
-    get:
-      summary: Get a controlled Azure Disk resource
-      operationId: getAzureDisk
+    patch:
+      summary: Update a controlled AWS SageMaker Notebook resource.
+      operationId: updateAwsSageMakerNotebook
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UpdateControlledAwsSageMakerNotebookRequestBody'
       responses:
         '200':
-          description: Response to get disk
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AzureDiskResource'
+          $ref: '#/components/responses/UpdateControlledAwsSageMakerNotebookResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
     post:
-      summary: "Delete a controlled Azure Disk resource. This is async, because the\
-        \ \noperation can take a few minutes. OpenAPI does not support request body\
-        \ \nin DELETE, but async state requires it. Hence this is a POST.\n"
-      operationId: deleteAzureDisk
+      summary: 'Delete a controlled AWS SageMaker Notebook resource. This is async,
+        because the
+
+        operation can take a few minutes. OpenAPI does not support request body
+
+        in DELETE, but async state requires it. Hence this is a POST.
+
+        '
+      operationId: deleteAwsSageMakerNotebook
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/DeleteControlledAzureResourceRequest'
+              $ref: '#/components/schemas/DeleteControlledAwsResourceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
         '202':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/notebook/{resourceId}/credential:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/ResourceId'
+      - $ref: '#/components/parameters/AwsCredentialAccessScope'
+      - $ref: '#/components/parameters/AwsCredentialDurationSeconds'
+    get:
+      summary: Get a credential to access this SageMaker Notebook in the AWS CLI or
+        SDK.
+      operationId: getAwsSageMakerNotebookCredential
+      tags:
+        - ControlledAwsResource
+      responses:
+        '200':
+          $ref: '#/components/responses/GetControlledAwsResourceCredentialResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/kubernetesNamespaces:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: Create a new controlled Azure KubernetesNamespace
-      operationId: createAzureKubernetesNamespace
+      summary: Create a new controlled AWS S3 Storage Folder resource.
+      operationId: createAwsS3StorageFolder
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateControlledAzureKubernetesNamespaceRequestBody'
+              $ref: '#/components/schemas/CreateControlledAwsS3StorageFolderRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/CreateControlledAzureKubernetesNamespaceResponse'
+          $ref: '#/components/responses/CreateControlledAwsS3StorageFolderResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/kubernetesNamespaces/create-result/{jobId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/delete-result/{jobId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/JobId'
     get:
-      summary: Retrieve information about an Azure KubernetesNamespace create job.
-      operationId: getCreateAzureKubernetesNamespaceResult
+      summary: Retrieve information about an AWS S3 Storage Folder resource deletion
+        job.
+      operationId: getDeleteAwsS3StorageFolderResult
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       responses:
         '200':
-          $ref: '#/components/responses/CreateControlledAzureKubernetesNamespaceResponse'
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
         '202':
-          $ref: '#/components/responses/CreateControlledAzureKubernetesNamespaceResponse'
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/kubernetesNamespaces/delete-result/{jobId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/generateName:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/JobId'
-    get:
-      summary: Retrieve information about an azure KubernetesNamespace deletion job.
-      operationId: getDeleteAzureKubernetesNamespaceResult
+    post:
+      summary: Generate a cloud native controlled AWS S3 Storage Folder name.
+      operationId: generateAwsS3StorageFolderCloudName
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GenerateAwsResourceCloudNameRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
-        '202':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
+          $ref: '#/components/responses/GenerateAwsResourceCloudNameResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/kubernetesNamespaces/{resourceId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/{resourceId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
     get:
-      summary: Get a controlled Azure KubernetesNamespace resource
-      operationId: getAzureKubernetesNamespace
+      summary: Get a controlled AWS S3 Storage Folder resource.
+      operationId: getAwsS3StorageFolder
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       responses:
         '200':
-          description: Response to get kubernetesNamespace
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AzureKubernetesNamespaceResource'
+          $ref: '#/components/responses/GetControlledAwsS3StorageFolderResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-    post:
-      summary: "Delete a controlled Azure KubernetesNamespace resource. This is async,\
-        \ because the \noperation can take a few minutes. OpenAPI does not support\
-        \ request body \nin DELETE, but async state requires it. Hence this is a POST.\n"
-      operationId: deleteAzureKubernetesNamespace
+    patch:
+      summary: Update a controlled AWS S3 Storage resource.
+      operationId: updateAwsS3StorageFolder
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/DeleteControlledAzureResourceRequest'
+              $ref: '#/components/schemas/UpdateControlledAwsS3StorageFolderRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
-        '202':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
+          $ref: '#/components/responses/UpdateControlledAwsS3StorageFolderResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/managedIdentities:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: Create a new controlled Azure ManagedIdentity
-      operationId: createAzureManagedIdentity
+      summary: 'Delete a controlled AWS S3 Storage resource. This is async, because
+        the
+
+        operation can take a few minutes. OpenAPI does not support request body
+
+        in DELETE, but async state requires it. Hence this is a POST.
+
+        '
+      operationId: deleteAwsS3StorageFolder
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateControlledAzureManagedIdentityRequestBody'
+              $ref: '#/components/schemas/DeleteControlledAwsResourceRequestBody'
       responses:
         '200':
-          description: Response to create controlled Azure managedIdentity
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CreatedControlledAzureManagedIdentity'
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '202':
+          $ref: '#/components/responses/DeleteControlledAwsResourceResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/managedIdentities/{resourceId}:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/{resourceId}/clone:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
-    get:
-      summary: Get a controlled Azure ManagedIdentity resource
-      operationId: getAzureManagedIdentity
+    post:
+      summary: Clone an S3 Storage Folder resource.
+      operationId: cloneAwsS3StorageFolder
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CloneControlledAwsS3StorageFolderRequestBody'
       responses:
         '200':
-          description: Response to get managedIdentity
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AzureManagedIdentityResource'
+          $ref: '#/components/responses/CloneControlledAwsS3StorageFolderResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-    delete:
-      summary: Delete a controlled Azure ManagedIdentity resource.
-      operationId: deleteAzureManagedIdentity
-      tags:
-        - ControlledAzureResource
-      responses:
-        '204':
-          description: Success
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/storageContainer:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-    post:
-      summary: Create a new controlled Azure Storage Container with private access
-      operationId: createAzureStorageContainer
-      tags:
-        - ControlledAzureResource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CreateControlledAzureStorageContainerRequestBody'
-      responses:
-        '200':
-          description: Response to create controlled azure storage
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CreatedControlledAzureStorageContainer'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/storageContainer/clone-result/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/JobId'
-    get:
-      summary: Retrieve information about an Azure storage container clone job.
-      operationId: getCloneAzureStorageContainerResult
-      tags:
-        - ControlledAzureResource
-      responses:
-        '200':
-          $ref: '#/components/responses/ClonedControlledAzureStorageContainerResponse'
-        '202':
-          $ref: '#/components/responses/ClonedControlledAzureStorageContainerResponse'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/storageContainer/{resourceId}:
-    post:
-      parameters:
-        - $ref: '#/components/parameters/WorkspaceId'
-        - $ref: '#/components/parameters/ResourceId'
-      summary: "Delete a controlled Azure Storage Container resource. This is async,\
-        \ \nbecause the operation can take a few minutes. OpenAPI does not support\
-        \ \nrequest body in DELETE, but async state requires it. Hence this is a POST.\n"
-      operationId: deleteAzureStorageContainer
-      tags:
-        - ControlledAzureResource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/DeleteControlledAzureResourceRequest'
-      responses:
-        '200':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/storageContainer/{resourceId}/clone:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/ResourceId'
-    post:
-      summary: Clone an Azure Storage Container
-      operationId: cloneAzureStorageContainer
-      tags:
-        - ControlledAzureResource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CloneControlledAzureStorageContainerRequest'
-      responses:
-        '200':
-          $ref: '#/components/responses/ClonedControlledAzureStorageContainerResponse'
-        '202':
-          $ref: '#/components/responses/ClonedControlledAzureStorageContainerResponse'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/storageContainer/{resourceId}/getSasToken:
+  /api/workspaces/v1/{workspaceId}/resources/controlled/aws/storageFolder/{resourceId}/credential:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
-      - $ref: '#/components/parameters/SasIpRange'
-      - $ref: '#/components/parameters/SasExpirationDuration'
-      - $ref: '#/components/parameters/SasPermissions'
-      - $ref: '#/components/parameters/SasBlobName'
-    post:
-      summary: Create a SAS token to access the storage container
-      operationId: createAzureStorageContainerSasToken
+      - $ref: '#/components/parameters/AwsCredentialAccessScope'
+      - $ref: '#/components/parameters/AwsCredentialDurationSeconds'
+    get:
+      summary: Get a credential to access this S3 Storage Folder in the AWS CLI or
+        SDK.
+      operationId: getAwsS3StorageFolderCredential
       tags:
-        - ControlledAzureResource
+        - ControlledAwsResource
       responses:
         '200':
-          description: Response to create SAS token
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CreatedAzureStorageContainerSasToken'
+          $ref: '#/components/responses/GetControlledAwsResourceCredentialResponse'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/vm:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-    post:
-      summary: Asynchronoulsy create a new controlled Azure VM
-      operationId: createAzureVm
-      tags:
-        - ControlledAzureResource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CreateControlledAzureVmRequestBody'
-      responses:
-        '200':
-          $ref: '#/components/responses/CreateControlledAzureVmResponse'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/vm/create-result/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/JobId'
-    get:
-      summary: Retrieve information about an Azure Vm create job.
-      operationId: getCreateAzureVmResult
-      tags:
-        - ControlledAzureResource
-      responses:
-        '200':
-          $ref: '#/components/responses/CreateControlledAzureVmResponse'
-        '202':
-          $ref: '#/components/responses/CreateControlledAzureVmResponse'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/vm/delete-result/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/JobId'
-    get:
-      summary: Retrieve information about an azure vm deletion job.
-      operationId: getDeleteAzureVmResult
-      tags:
-        - ControlledAzureResource
-      responses:
-        '200':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
-        '202':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/controlled/azure/vm/{resourceId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/ResourceId'
-    get:
-      summary: Get a controlled Azure VM resource
-      operationId: getAzureVm
-      tags:
-        - ControlledAzureResource
-      responses:
-        '200':
-          description: Response to get vm
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AzureVmResource'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
-    post:
-      summary: "Delete a controlled Azure VM resource. This is async, because the\
-        \ \noperation can take a few minutes. OpenAPI does not support request body\
-        \ \nin DELETE, but async state requires it. Hence this is a POST.\n"
-      operationId: deleteAzureVm
-      tags:
-        - ControlledAzureResource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/DeleteControlledAzureResourceRequest'
-      responses:
-        '200':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
-        '202':
-          $ref: '#/components/responses/DeleteControlledAzureResourceResponse'
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
@@ -2289,9 +2019,13 @@ paths:
         '500':
           $ref: '#/components/responses/ServerError'
     post:
-      summary: "Delete a controlled GCP AI Notebook instance resource. This is async,\
-        \ \nbecause the operation can take ~5 minutes. OpenAPI does not support \n\
-        request body in DELETE, but async state requires it. Hence this is a POST.\n"
+      summary: 'Delete a controlled GCP AI Notebook instance resource. This is async,
+
+        because the operation can take ~5 minutes. OpenAPI does not support
+
+        request body in DELETE, but async state requires it. Hence this is a POST.
+
+        '
       operationId: deleteAiNotebookInstance
       tags:
         - ControlledGcpResource
@@ -2601,9 +2335,13 @@ paths:
         '500':
           $ref: '#/components/responses/ServerError'
     post:
-      summary: "Delete a controlled GCS bucket resource. This is async, because the\
-        \ \noperation can take a few minutes. OpenAPI does not support request body\
-        \ \nin DELETE, but async state requires it. Hence this is a POST.\n"
+      summary: 'Delete a controlled GCS bucket resource. This is async, because the
+
+        operation can take a few minutes. OpenAPI does not support request body
+
+        in DELETE, but async state requires it. Hence this is a POST.
+
+        '
       operationId: deleteBucket
       tags:
         - ControlledGcpResource
@@ -2958,23 +2696,23 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/datarepo/snapshots:
+  /api/workspaces/v1/{workspaceId}/resources/referenced/aws/externalBucket:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: Create a new data repo snapshot reference in a workspace.
-      operationId: createDataRepoSnapshotReference
+      summary: Create a new AWS S3 external bucket reference in a workspace.
+      operationId: createS3ExternalBucketReference
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateDataRepoSnapshotReferenceRequestBody'
+              $ref: '#/components/schemas/CreateAwsS3ExternalBucketReferenceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/DataRepoSnapshotReferenceResponse'
+          $ref: '#/components/responses/AwsS3ExternalBucketReferenceResponse'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
@@ -2983,36 +2721,32 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/datarepo/snapshots/name/{name}:
+  /api/workspaces/v1/{workspaceId}/resources/referenced/aws/externalBucket/{resourceId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/Name'
+      - $ref: '#/components/parameters/ResourceId'
     get:
-      summary: Gets a reference to a snapshot by name.
-      operationId: getDataRepoSnapshotReferenceByName
+      summary: Gets a reference to an AWS S3 external bucket from a workspace.
+      operationId: getS3ExternalBucketReference
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       responses:
         '200':
-          $ref: '#/components/responses/DataRepoSnapshotReferenceResponse'
+          $ref: '#/components/responses/AwsS3ExternalBucketReferenceResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/datarepo/snapshots/{resourceId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/ResourceId'
-    get:
-      summary: Gets a reference to a snapshot from a workspace.
-      operationId: getDataRepoSnapshotReference
+    delete:
+      summary: Delete S3 External Bucket Reference
+      operationId: deleteS3ExternalBucketReference
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       responses:
-        '200':
-          $ref: '#/components/responses/DataRepoSnapshotReferenceResponse'
+        '204':
+          description: OK
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
@@ -3020,20 +2754,20 @@ paths:
         '500':
           $ref: '#/components/responses/ServerError'
     post:
-      summary: Update name, description or referencing target of a snapshot reference
-        in a workspace.
-      operationId: updateDataRepoSnapshotReferenceResource
+      summary: Update name, description or folder of an S3 external bucket reference
+        in a workspace
+      operationId: updateS3ExternalBucketReferenceResource
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/UpdateDataRepoSnapshotReferenceRequestBody'
+              $ref: '#/components/schemas/UpdateS3ExternalBucketReferenceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/DataRepoSnapshotReferenceResponse'
+          $ref: '#/components/responses/AwsS3ExternalBucketReferenceResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
@@ -3042,29 +2776,15 @@ paths:
           $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-    delete:
-      summary: Delete datarepo snapshot reference
-      operationId: deleteDataRepoSnapshotReference
-      tags:
-        - ReferencedGcpResource
-      responses:
-        '204':
-          description: OK
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/datarepo/snapshots/{resourceId}/clone:
+  /api/workspaces/v1/{workspaceId}/resources/referenced/aws/externalBucket/{resourceId}/clone:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
     post:
-      summary: Clone a referenced Data Repo Snapshot resource
-      operationId: cloneGcpDataRepoSnapshotReference
+      summary: Clone an s3 external bucket reference
+      operationId: cloneAwsS3ExternalBucketReference
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       requestBody:
         required: true
         content:
@@ -3073,36 +2793,30 @@ paths:
               $ref: '#/components/schemas/CloneReferencedResourceRequestBody'
       responses:
         '200':
-          description: Response for successful Data Repo Snapshot reference clone
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CloneReferencedGcpDataRepoSnapshotResourceResult'
-        '400':
-          $ref: '#/components/responses/BadRequest'
+          $ref: '#/components/responses/CloneReferencedAwsS3ExternalBucketResourceResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatasets:
+  /api/workspaces/v1/{workspaceId}/resources/referenced/aws/storageFolder:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
     post:
-      summary: Create a new BigQuery dataset reference in a workspace.
-      operationId: createBigQueryDatasetReference
+      summary: Create a new AWS S3 folder reference in a workspace.
+      operationId: createS3FolderReference
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreateGcpBigQueryDatasetReferenceRequestBody'
+              $ref: '#/components/schemas/CreateAwsS3FolderReferenceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/GcpBigQueryDatasetReferenceResponse'
+          $ref: '#/components/responses/AwsS3FolderReferenceResponse'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
@@ -3111,36 +2825,32 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatasets/name/{name}:
+  /api/workspaces/v1/{workspaceId}/resources/referenced/aws/storageFolder/{resourceId}:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/Name'
+      - $ref: '#/components/parameters/ResourceId'
     get:
-      summary: Gets a reference to a BigQuery dataset by name.
-      operationId: getBigQueryDatasetReferenceByName
+      summary: Gets a reference to a bucket from a workspace.
+      operationId: getS3FolderReference
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       responses:
         '200':
-          $ref: '#/components/responses/GcpBigQueryDatasetReferenceResponse'
+          $ref: '#/components/responses/AwsS3FolderReferenceResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatasets/{resourceId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/ResourceId'
-    get:
-      summary: Gets a reference to a BigQuery dataset from a workspace.
-      operationId: getBigQueryDatasetReference
+    delete:
+      summary: Delete S3 Folder Reference
+      operationId: deleteS3FolderReference
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       responses:
-        '200':
-          $ref: '#/components/responses/GcpBigQueryDatasetReferenceResponse'
+        '204':
+          description: OK
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
@@ -3148,20 +2858,20 @@ paths:
         '500':
           $ref: '#/components/responses/ServerError'
     post:
-      summary: Update name, description or referencing target of a BigQuery dataset
-        reference in a workspace.
-      operationId: updateBigQueryDatasetReferenceResource
+      summary: Update name, description or the referencing target of a s3 folder reference
+        in a workspace
+      operationId: updateS3FolderReferenceResource
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/UpdateBigQueryDatasetReferenceRequestBody'
+              $ref: '#/components/schemas/UpdateS3FolderReferenceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/GcpBigQueryDatasetReferenceResponse'
+          $ref: '#/components/responses/AwsS3FolderReferenceResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
@@ -3170,29 +2880,15 @@ paths:
           $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-    delete:
-      summary: Delete BigQuery dataset reference
-      operationId: deleteBigQueryDatasetReference
-      tags:
-        - ReferencedGcpResource
-      responses:
-        '204':
-          description: OK
-        '403':
-          $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatasets/{resourceId}/clone:
+  /api/workspaces/v1/{workspaceId}/resources/referenced/aws/storageFolder/{resourceId}/clone:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
     post:
-      summary: Clone a BigQuery Dataset
-      operationId: cloneGcpBigQueryDatasetReference
+      summary: Clone an s3 storage folder reference
+      operationId: cloneAwsS3StorageFolderReference
       tags:
-        - ReferencedGcpResource
+        - ReferencedAwsResource
       requestBody:
         required: true
         content:
@@ -3201,23 +2897,168 @@ paths:
               $ref: '#/components/schemas/CloneReferencedResourceRequestBody'
       responses:
         '200':
-          $ref: '#/components/responses/CloneReferencedGcpBigQueryDatasetResourceResponse'
-        '202':
-          $ref: '#/components/responses/CloneReferencedGcpBigQueryDatasetResourceResponse'
+          $ref: '#/components/responses/CloneReferencedAwsS3FolderResourceResponse'
         '403':
           $ref: '#/components/responses/PermissionDenied'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatatables:
+  /api/workspaces/v1/{workspaceId}/resources/referenced/aws/storageFolder/{resourceId}/credential:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
-    post:
-      summary: Create a new BigQuery data table reference in a workspace.
-      operationId: createBigQueryDataTableReference
-      tags:
-        - ReferencedGcpResource
+      - $ref: '#/components/parameters/ResourceId'
+      - $ref: '#/components/parameters/AwsCredentialAccessScope'
+      - $ref: '#/components/parameters/AwsCredentialDurationSeconds'
+    get:
+      summary: Get a credential to access this S3 Storage Folder in the AWS CLI or
+        SDK.
+      operationId: getS3FolderReferenceCredential
+      tags:
+        - ReferencedAwsResource
+      responses:
+        '200':
+          $ref: '#/components/responses/AwsS3FolderCredentialsResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatasets:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+    post:
+      summary: Create a new BigQuery dataset reference in a workspace.
+      operationId: createBigQueryDatasetReference
+      tags:
+        - ReferencedGcpResource
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateGcpBigQueryDatasetReferenceRequestBody'
+      responses:
+        '200':
+          $ref: '#/components/responses/GcpBigQueryDatasetReferenceResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatasets/name/{name}:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/Name'
+    get:
+      summary: Gets a reference to a BigQuery dataset by name.
+      operationId: getBigQueryDatasetReferenceByName
+      tags:
+        - ReferencedGcpResource
+      responses:
+        '200':
+          $ref: '#/components/responses/GcpBigQueryDatasetReferenceResponse'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatasets/{resourceId}:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/ResourceId'
+    get:
+      summary: Gets a reference to a BigQuery dataset from a workspace.
+      operationId: getBigQueryDatasetReference
+      tags:
+        - ReferencedGcpResource
+      responses:
+        '200':
+          $ref: '#/components/responses/GcpBigQueryDatasetReferenceResponse'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+    post:
+      summary: Update name, description or referencing target of a BigQuery dataset
+        reference in a workspace.
+      operationId: updateBigQueryDatasetReferenceResource
+      tags:
+        - ReferencedGcpResource
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UpdateBigQueryDatasetReferenceRequestBody'
+      responses:
+        '200':
+          $ref: '#/components/responses/GcpBigQueryDatasetReferenceResponse'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/ServerError'
+    delete:
+      summary: Delete BigQuery dataset reference
+      operationId: deleteBigQueryDatasetReference
+      tags:
+        - ReferencedGcpResource
+      responses:
+        '204':
+          description: OK
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatasets/{resourceId}/clone:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/ResourceId'
+    post:
+      summary: Clone a BigQuery Dataset
+      operationId: cloneGcpBigQueryDatasetReference
+      tags:
+        - ReferencedGcpResource
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CloneReferencedResourceRequestBody'
+      responses:
+        '200':
+          $ref: '#/components/responses/CloneReferencedGcpBigQueryDatasetResourceResponse'
+        '202':
+          $ref: '#/components/responses/CloneReferencedGcpBigQueryDatasetResourceResponse'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v1/{workspaceId}/resources/referenced/gcp/bigquerydatatables:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+    post:
+      summary: Create a new BigQuery data table reference in a workspace.
+      operationId: createBigQueryDataTableReference
+      tags:
+        - ReferencedGcpResource
       requestBody:
         required: true
         content:
@@ -3787,22 +3628,25 @@ paths:
           $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v1/{workspaceId}/resources/referenced/{resourceId}/access:
+  /api/workspaces/v1/{workspaceId}/resources/referenced/{resourceId}/resolve:
     parameters:
       - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/ResourceId'
     get:
-      summary: Check a user's access to a referenced resource
-      operationId: checkReferenceAccess
+      summary: 'Resolve a referenced resource to its underlying resource. If the resource
+        is not a reference to a WSM resource, then resourceAttributes will be null.
+
+        '
+      operationId: resolve
       tags:
         - Resource
       responses:
         '200':
-          description: Whether the specified reference is accessible or not
+          description: OK
           content:
             application/json:
               schema:
-                type: boolean
+                $ref: '#/components/schemas/ResolvedResource'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
@@ -3822,6 +3666,36 @@ paths:
       operationId: getResource
       tags:
         - Resource
+      parameters:
+        - $ref: '#/components/parameters/ResolveReference'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ResourceDescription'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+    patch:
+      summary: 'Update the common metadata fields of a resource in a workspace.
+
+        '
+      operationId: updateResource
+      tags:
+        - Resource
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UpdateCommonResourceMetadataBody'
       responses:
         '200':
           description: OK
@@ -3843,6 +3717,7 @@ paths:
       - $ref: '#/components/parameters/ResourceId'
     post:
       operationId: updateResourceProperties
+      deprecated: true
       summary: 'Update resource properties. Only properties with keys in request are
 
         updated. Properties with keys not in request are not updated.
@@ -3867,6 +3742,7 @@ paths:
           $ref: '#/components/responses/ServerError'
     patch:
       operationId: deleteResourceProperties
+      deprecated: true
       tags:
         - Resource
       summary: 'Delete resource properties. Only properties with keys in request are
@@ -3976,19 +3852,19 @@ paths:
           $ref: '#/components/responses/PermissionDenied'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v2/result/{jobId}:
+  /api/workspaces/v2/crg/update-result/{jobId}:
     parameters:
       - $ref: '#/components/parameters/JobId'
     get:
-      summary: Get the result of a async job to create a workspace.
-      operationId: getCreateWorkspaceV2Result
+      summary: Get the result of a async job to update CRG workspaces
+      operationId: getUpdateWorkspacesByCrgResult
       tags:
         - Workspace
       responses:
         '200':
-          $ref: '#/components/responses/CreateWorkspaceV2Response'
+          $ref: '#/components/responses/JobResultResponse'
         '202':
-          $ref: '#/components/responses/CreateWorkspaceV2Response'
+          $ref: '#/components/responses/JobResultResponse'
         '400':
           $ref: '#/components/responses/BadRequest'
         '403':
@@ -3999,72 +3875,53 @@ paths:
           $ref: '#/components/responses/Conflict'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v2/{workspaceId}/cloudcontexts/delete-result/{jobId}:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/JobId'
+  /api/workspaces/v2/crg/{crgId}:
     get:
-      summary: 'Gets the result of an async cloud context delete.
-
-        '
-      operationId: getDeleteCloudContextV2Result
+      summary: Admin operation to list workspaces in a CRG
+      operationId: getWorkspacesByCrg
       tags:
         - Workspace
+      parameters:
+        - $ref: '#/components/parameters/CloudResourceGroupId'
       responses:
         '200':
-          $ref: '#/components/responses/JobResultResponse'
-        '202':
-          $ref: '#/components/responses/JobResultResponse'
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WorkspaceInfoList'
         '403':
           $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v2/{workspaceId}/cloudcontexts/{cloudContext}/delete:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
-      - $ref: '#/components/parameters/CloudContext'
-    post:
-      summary: 'Deletes a cloud context and all of its data from a workspace.
-
-        This async delete requires a body, but that is not allowed on standard
-
-        delete method, so this is done as a POST and labeled as delete in the path.
-
-        '
-      operationId: deleteCloudContextV2
+    patch:
+      summary: Async admin operation to update workspaces in a CRG
+      operationId: updateWorkspacesByCrg
       tags:
         - Workspace
+      parameters:
+        - $ref: '#/components/parameters/CloudResourceGroupId'
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/DeleteCloudContextV2Request'
+              $ref: '#/components/schemas/UpdateWorkspacesByCrgRequest'
       responses:
         '200':
           $ref: '#/components/responses/JobResultResponse'
         '202':
           $ref: '#/components/responses/JobResultResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v2/{workspaceId}/delete:
-    parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
+  /api/workspaces/v2/filtered:
     post:
-      summary: 'Deletes a workspace and all of its cloud contexts and data.
-
-        This async delete requires a body, but that is not allowed on standard
-
-        delete method, so this is done as a POST and labeled as delete in the path.
-
-        '
-      operationId: deleteWorkspaceV2
+      summary: Filter workspaces
+      operationId: filterWorkspaces
       tags:
         - Workspace
       requestBody:
@@ -4072,27 +3929,194 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/DeleteWorkspaceV2Request'
+              $ref: '#/components/schemas/WorkspaceFilter'
       responses:
         '200':
-          $ref: '#/components/responses/JobResultResponse'
-        '202':
-          $ref: '#/components/responses/JobResultResponse'
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WorkspaceDescriptionList'
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '403':
           $ref: '#/components/responses/PermissionDenied'
-        '404':
-          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/ServerError'
-  /api/workspaces/v2/{workspaceId}/delete-result/{jobId}:
+  /api/workspaces/v2/result/{jobId}:
     parameters:
-      - $ref: '#/components/parameters/WorkspaceId'
       - $ref: '#/components/parameters/JobId'
     get:
-      summary: 'Gets the result of an async workspace delete.
-
-        '
-      operationId: getDeleteWorkspaceV2Result
+      summary: Get the result of a async job to create a workspace.
+      operationId: getCreateWorkspaceV2Result
+      tags:
+        - Workspace
+      responses:
+        '200':
+          $ref: '#/components/responses/CreateWorkspaceV2Response'
+        '202':
+          $ref: '#/components/responses/CreateWorkspaceV2Response'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v2/{workspaceId}/clone:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+    post:
+      summary: Clone a CRG workspace and its eligible resources
+      description: 'Use the v1 endpoints and schema for polling for completion and
+
+        collecting the results.
+
+        '
+      operationId: cloneWorkspaceV2
+      tags:
+        - Workspace
+      requestBody:
+        description: Details of workspace clone operation
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CloneWorkspaceV2Request'
+      responses:
+        '200':
+          $ref: '#/components/responses/CloneWorkspaceV2Response'
+        '202':
+          $ref: '#/components/responses/CloneWorkspaceV2Response'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v2/{workspaceId}/clone-result/{jobId}:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/JobId'
+    get:
+      summary: 'Gets the result of an async workspace clone.
+
+        Note: the workspaceId is the SOURCE workspace id
+
+        '
+      operationId: getCloneWorkspaceV2Result
+      tags:
+        - Workspace
+      responses:
+        '200':
+          $ref: '#/components/responses/CloneWorkspaceV2Response'
+        '202':
+          $ref: '#/components/responses/CloneWorkspaceV2Response'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v2/{workspaceId}/cloudcontexts/delete-result/{jobId}:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/JobId'
+    get:
+      summary: 'Gets the result of an async cloud context delete.
+
+        '
+      operationId: getDeleteCloudContextV2Result
+      tags:
+        - Workspace
+      responses:
+        '200':
+          $ref: '#/components/responses/JobResultResponse'
+        '202':
+          $ref: '#/components/responses/JobResultResponse'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v2/{workspaceId}/cloudcontexts/{cloudContext}/delete:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/CloudContext'
+    post:
+      summary: 'Deletes a cloud context and all of its data from a workspace.
+
+        This async delete requires a body, but that is not allowed on standard
+
+        delete method, so this is done as a POST and labeled as delete in the path.
+
+        '
+      operationId: deleteCloudContextV2
+      tags:
+        - Workspace
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DeleteCloudContextV2Request'
+      responses:
+        '200':
+          $ref: '#/components/responses/JobResultResponse'
+        '202':
+          $ref: '#/components/responses/JobResultResponse'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v2/{workspaceId}/delete:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+    post:
+      summary: 'Deletes a workspace and all of its cloud contexts and data.
+
+        This async delete requires a body, but that is not allowed on standard
+
+        delete method, so this is done as a POST and labeled as delete in the path.
+
+        '
+      operationId: deleteWorkspaceV2
+      tags:
+        - Workspace
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DeleteWorkspaceV2Request'
+      responses:
+        '200':
+          $ref: '#/components/responses/JobResultResponse'
+        '202':
+          $ref: '#/components/responses/JobResultResponse'
+        '403':
+          $ref: '#/components/responses/PermissionDenied'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /api/workspaces/v2/{workspaceId}/delete-result/{jobId}:
+    parameters:
+      - $ref: '#/components/parameters/WorkspaceId'
+      - $ref: '#/components/parameters/JobId'
+    get:
+      summary: 'Gets the result of an async workspace delete.
+
+        '
+      operationId: getDeleteWorkspaceV2Result
       tags:
         - Workspace
       responses:
@@ -4160,22 +4184,6 @@ components:
       required: true
       schema:
         $ref: '#/components/schemas/AwsCredentialDurationSeconds'
-    AzureResourceId:
-      name: azureResourceId
-      in: query
-      description: The fully qualified ID of the Azure resource, including the resource
-        name and resource type. Use the format, /subscriptions/{guid}/resourceGroups/{resource-group-name}/{resource-provider-namespace}/{resource-type}/{resource-name}.
-      required: true
-      schema:
-        type: string
-    BillingProfileId:
-      name: billingProfileId
-      in: query
-      description: A string to identify an Azure billing profile.
-      required: false
-      schema:
-        type: string
-        format: uuid
     CloudContext:
       name: cloudContext
       in: path
@@ -4183,10 +4191,18 @@ components:
       required: true
       schema:
         $ref: '#/components/schemas/CloudPlatform'
+    CloudResourceGroupId:
+      name: crgId
+      in: path
+      description: A UUID used to identify a pod in a workspace.
+      required: true
+      schema:
+        type: string
+        format: uuid
     FolderId:
       name: folderId
       in: path
-      description: An UUID to identify a folder in a workspace.
+      description: An UUID used to identify a folder in a workspace.
       required: true
       schema:
         type: string
@@ -4205,14 +4221,6 @@ components:
       required: false
       schema:
         $ref: '#/components/schemas/JobStateFilter'
-    LandingZoneId:
-      name: landingZoneId
-      in: path
-      description: A string to identify an Azure landing zone.
-      required: true
-      schema:
-        type: string
-        format: uuid
     Limit:
       name: limit
       in: query
@@ -4274,6 +4282,15 @@ components:
       required: true
       schema:
         $ref: '#/components/schemas/CloudPlatform'
+    ResolveReference:
+      name: resolveReference
+      in: query
+      description: Optionally request that referenced resources be resolved against
+        their sources
+      required: false
+      schema:
+        type: boolean
+        default: false
     ResourceId:
       name: resourceId
       in: path
@@ -4296,6 +4313,17 @@ components:
       required: false
       schema:
         $ref: '#/components/schemas/ResourceType'
+    ResourceTypes:
+      name: resourceTypes
+      in: query
+      required: false
+      description: 'A list of resource types to filter on.
+
+        '
+      schema:
+        type: array
+        items:
+          type: string
     Role:
       name: role
       in: path
@@ -4303,52 +4331,6 @@ components:
       required: true
       schema:
         $ref: '#/components/schemas/IamRole'
-    SasBlobName:
-      name: sasBlobName
-      in: query
-      description: Requests access to a single blob in a container
-      required: false
-      schema:
-        type: string
-    SasExpirationDuration:
-      name: sasExpirationDuration
-      in: query
-      description: 'The number of seconds until the SAS token should expire (optional).
-        Default and maximum allowed values are
-
-        set in configuration.
-
-        '
-      required: false
-      schema:
-        type: integer
-        format: int64
-    SasIpRange:
-      name: sasIpRange
-      in: query
-      description: A single IP address or range of addresses separated by a dash to
-        restrict a SAS token to
-      required: false
-      schema:
-        type: string
-    SasPermissions:
-      name: sasPermissions
-      in: query
-      required: false
-      description: "Permissions associated with the SAS indicating what operations\
-        \ a client may perform on the resource. Must be a \nstring consisting of some\
-        \ combination following available permissions:\n\n| Permission | Description\
-        \ |\n|------------|-------------|\n|`r`         | Read        |\n|`a`    \
-        \     | Add         |\n|`c`         | Create      |\n|`w`         | Write\
-        \       |\n|`d`         | Delete      |\n|`l`         | List        |\n|`t`\
-        \         | Tags        |\n\nFor example:\n  * To construct a SAS with permissions\
-        \ limited to read, write and list the caller would supply the string\n`rwl`.\n\
-        \  * To construct a SAS with permissions limited to add, create, write and\
-        \ delete, the caller would supply the \nstring `acwd`.\n\nIf the calling user\
-        \ does not have the requisite role against the workspace for the requested\
-        \ permissions, this\noperation will return a 403 Forbidden error.\n"
-      schema:
-        type: string
     StewardshipType:
       name: stewardship
       in: query
@@ -4366,11 +4348,10 @@ components:
     WorkspaceId:
       name: workspaceId
       in: path
-      description: A UUID to used to identify a workspace in the workspace manager
+      description: A UUID or UFID used to identify a workspace in the workspace manager
       required: true
       schema:
         type: string
-        format: uuid
     WorkspaceUserFacingId:
       name: workspaceUserFacingId
       in: path
@@ -4399,6 +4380,24 @@ components:
       schema:
         type: string
   responses:
+    AwsS3ExternalBucketReferenceResponse:
+      description: Response containing the referenced S3 External Bucket.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/AwsS3ExternalBucketReferenceResource'
+    AwsS3FolderCredentialsResponse:
+      description: AWS credentials for an s3 folder
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/AwsCredential'
+    AwsS3FolderReferenceResponse:
+      description: Response containing a reference to a S3 Folder.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/AwsS3StorageFolderResource'
     BadRequest:
       description: Bad request
       content:
@@ -4411,6 +4410,18 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/BqDatasetCloudId'
+    CloneControlledAwsS3ExternalBucketResponse:
+      description: Response for an externally-managed AWS S3 Storage Bucket clone.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/CloneControlledAwsS3ExternalBucketResult'
+    CloneControlledAwsS3StorageFolderResponse:
+      description: Response for an AWS S3 Storage Folder clone.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/CloneControlledAwsS3StorageFolderResult'
     CloneControlledFlexibleResourceResponse:
       description: Response for successful flexible resource clone.
       content:
@@ -4424,6 +4435,18 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/CloneControlledGcpBigQueryDatasetResult'
+    CloneReferencedAwsS3ExternalBucketResourceResponse:
+      description: Response for successful AWS S3 external bucket reference clone
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/CloneReferencedAwsS3ExternalBucketReferencedResourceResult'
+    CloneReferencedAwsS3FolderResourceResponse:
+      description: Response for successful AWS S3 bucket reference clone
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/CloneReferencedAwsS3FolderReferencedResourceResult'
     CloneReferencedGcpBigQueryDataTableResourceResponse:
       description: Response for successful BigQuery data table reference clone
       content:
@@ -4454,12 +4477,12 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/CloneWorkspaceResult'
-    ClonedControlledAzureStorageContainerResponse:
-      description: Response object for clone of an Azure storage container
+    CloneWorkspaceV2Response:
+      description: Response to clone workspace V2 request
       content:
         application/json:
           schema:
-            $ref: '#/components/schemas/CloneControlledAzureStorageContainerResult'
+            $ref: '#/components/schemas/CloneWorkspaceV2Result'
     ClonedControlledGcpGcsBucketResponse:
       description: Response to GCS bucket clone operation where source bucket is controlled.
         (Destination bucket may be controlled or referenced.)
@@ -4497,49 +4520,32 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/CreateCloudContextResult'
-    CreateControlledAwsS3StorageFolderResponse:
-      description: Response to create controlled AWS S3 Storage Folder resource.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/CreatedControlledAwsS3StorageFolder'
-    CreateControlledAwsSageMakerNotebookResponse:
-      description: Response to create controlled AWS SageMaker Notebook instance resource.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/CreateControlledAwsSageMakerNotebookResult'
-    CreateControlledAzureDatabaseResponse:
-      description: Response to create controlled Azure Database
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/CreatedControlledAzureDatabaseResult'
-    CreateControlledAzureKubernetesNamespaceResponse:
-      description: Response to create controlled Azure KubernetesNamespace
+    CreateControlledAwsEc2InstanceResponse:
+      description: Response to create controlled AWS EC2 Virtual Machine instance
+        resource.
       content:
         application/json:
           schema:
-            $ref: '#/components/schemas/CreatedControlledAzureKubernetesNamespaceResult'
-    CreateControlledAzureVmResponse:
-      description: Response to create controlled Azure Vm
+            $ref: '#/components/schemas/CreateControlledAwsEc2InstanceResult'
+    CreateControlledAwsS3ExternalBucketResponse:
+      description: Response to create controlled externally-managed AWS S3 Storage
+        Bucket resource.
       content:
         application/json:
           schema:
-            $ref: '#/components/schemas/CreatedControlledAzureVmResult'
-    CreateLandingZoneJobResponse:
-      description: Response to get the status of an async job to create an Azure landing
-        zone.
+            $ref: '#/components/schemas/CreatedControlledAwsS3ExternalBucket'
+    CreateControlledAwsS3StorageFolderResponse:
+      description: Response to create controlled AWS S3 Storage Folder resource.
       content:
         application/json:
           schema:
-            $ref: '#/components/schemas/AzureLandingZoneResult'
-    CreateLandingZoneResponse:
-      description: Response to starting an async job to create an Azure landing zone.
+            $ref: '#/components/schemas/CreatedControlledAwsS3StorageFolder'
+    CreateControlledAwsSageMakerNotebookResponse:
+      description: Response to create controlled AWS SageMaker Notebook instance resource.
       content:
         application/json:
           schema:
-            $ref: '#/components/schemas/CreateLandingZoneResult'
+            $ref: '#/components/schemas/CreateControlledAwsSageMakerNotebookResult'
     CreateWorkspaceV2Response:
       description: Description of a workspace
       content:
@@ -4570,43 +4576,18 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/CreatedControlledGcpGcsBucket'
-    DataRepoSnapshotReferenceResponse:
-      description: Response containing a reference to a Data Repo snapshot.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/DataRepoSnapshotResource'
     DataprocClusterCloudIdResponse:
       description: A valid Dataproc cluster name per https://cloud.google.com/dataproc/docs/guides/create-cluster.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/DataprocClusterCloudId'
-    DeleteAzureLandingZoneJobResponse:
-      description: Response to get the status of an async job to delete an Azure landing
-        zone.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/DeleteAzureLandingZoneJobResult'
-    DeleteAzureLandingZoneResponse:
-      description: Response to starting an async job to delete an Azure landing zone.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/DeleteAzureLandingZoneResult'
-    DeleteControlledAwsResourceResponse:
-      description: Response Payload for deleting AWS controlled resources.
+    DeleteControlledAwsResourceResponse:
+      description: Response Payload for deleting AWS controlled resources.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/DeleteControlledAwsResourceResult'
-    DeleteControlledAzureResourceResponse:
-      description: Response Payload for deleting an Azure controlled resource
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/DeleteControlledAzureResourceResult'
     DeleteControlledGcpAiNotebookInstanceResponse:
       description: Response Payload for deleting a GCP AI Notebook
       content:
@@ -4673,12 +4654,24 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/AwsResourceCloudName'
+    GetControlledAwsEc2InstanceResponse:
+      description: Response to get AWS EC2 Virtual Machine resource.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/AwsEc2InstanceResource'
     GetControlledAwsResourceCredentialResponse:
       description: Response to get a AWS resource credential.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/AwsCredential'
+    GetControlledAwsS3ExternalBucketResponse:
+      description: Response to get externally-managed AWS S3 Storage Bucket resource.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/AwsS3ExternalBucketResource'
     GetControlledAwsS3StorageFolderResponse:
       description: Response to get AWS S3 Storage Folder resource.
       content:
@@ -4728,13 +4721,6 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/ErrorReport'
-    ResourceQuotaResponse:
-      description: Response to get the quota information of an Azure landing zone
-        resource.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ResourceQuota'
     ServerError:
       description: Server error
       content:
@@ -4747,6 +4733,12 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/TerraWorkspaceResource'
+    UpdateControlledAwsS3ExternalBucketResponse:
+      description: Response for an externally-managed AWS S3 Storage Bucket update.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/AwsS3ExternalBucketResource'
     UpdateControlledAwsS3StorageFolderResponse:
       description: Response for an AWS S3 Storage Folder update.
       content:
@@ -4766,6 +4758,28 @@ components:
           schema:
             $ref: '#/components/schemas/GcpGcsBucketResource'
   schemas:
+    AccessOnDemandOperation:
+      type: string
+      description: Enum of requested AoD operations
+      enum:
+        - GRANT_SUPPORT
+        - REVOKE_SUPPORT
+    AccessOnDemandRequest:
+      type: object
+      description: UM Access on demand request
+      required:
+        - email
+        - reason
+        - operation
+      properties:
+        email:
+          description: email to grant/revoke
+          type: string
+        reason:
+          description: required reason for access demand
+          type: string
+        operation:
+          $ref: '#/components/schemas/AccessOnDemandOperation'
     AccessScope:
       type: string
       description: Specifies the resource as shared or private
@@ -4809,7 +4823,7 @@ components:
         applicationSecurityGroups:
           type: object
           additionalProperties:
-            type: string
+            type: object
           description: 'Map of AWS Regions to Security Groups allowing connectivity
             between Workspace Application
 
@@ -4842,41 +4856,56 @@ components:
       type: integer
       minimum: 900
       maximum: 3600
-    AwsResourceCloudName:
-      description: A valid cloud name for resource.
+    AwsEc2InstanceAttributes:
+      description: AWS EC2 Virtual Machine instance resource properties included in
+        post-creation get.
       type: object
-      required:
-        - awsResourceCloudName
       properties:
-        awsResourceCloudName:
+        instanceId:
+          description: The ID of the EC2 Virtual Machine instance
           type: string
-    AwsS3StorageFolderAttributes:
-      description: AWS S3 Storage Folder resource properties included in post-creation
-        get.
+    AwsEc2InstanceCreationParameters:
+      description: EC2 Virtual Machine specific properties to be set on creation.
+        These are a subset of the values accepted by the AWS EC2 Virtual Machine API.
       type: object
       properties:
-        bucketName:
-          description: The name of the S3 bucket in which the Terra Storage Folder
-            was allocated.
+        instanceType:
+          description: A valid EC2 instance type per https://aws.amazon.com/ec2/instance-types/
           type: string
-        prefix:
-          description: The prefix within the S3 bucket.
+          default: t3.medium
+        rootDiskSizeGiB:
+          description: Size in GiB of instance root volume
+          type: integer
+          default: 100
+        diskType:
+          description: Data volume EBS disk type.  Must be a valid EBS disk type per
+            https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html
+          type: string
+          default: gp3
+        diskSizeGiB:
+          description: Size in GiB of data volume to attach to the instance
+          type: integer
+          default: 16
+        diskDeviceName:
+          description: Device filename to map to the data volume
           type: string
-    AwsS3StorageFolderCreationParameters:
-      description: S3 Storage Folder specific properties to be set on creation. These
-        are a subset of the values accepted by the AWS S3 Storage API.
-      type: object
-      properties:
-        folderName:
-          description: A valid folder name per https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html.
+          default: /dev/sdh
+        userData:
+          description: User data to pass when creating the EC2 instance.  See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-add-user-data.html
           type: string
+          default: ''
         region:
-          description: A valid S3 Storage Folder region per https://docs.aws.amazon.com/general/latest/gr/s3.html.
+          description: A valid EC2 Virtual Machine region
           type: string
-          default: us-east-1
-    AwsS3StorageFolderResource:
+        tags:
+          description: key-value pair tags on the VM. User defined tags must have
+            vwbusr prefix
+          type: object
+          additionalProperties:
+            type: string
+    AwsEc2InstanceResource:
       type: object
-      description: Description of an AWS S3 Storage Folder resource.
+      description: Description of an AWS EC2 Virtual Machine instance resource.
       required:
         - metadata
         - attributes
@@ -4885,392 +4914,128 @@ components:
           description: the resource metadata common to all resources
           $ref: '#/components/schemas/ResourceMetadata'
         attributes:
-          $ref: '#/components/schemas/AwsS3StorageFolderAttributes'
-    AwsSageMakerNotebookAttributes:
-      description: AWS SageMaker Notebook instance resource properties included in
-        post-creation get.
+          $ref: '#/components/schemas/AwsEc2InstanceAttributes'
+    AwsReferencedS3ExternalBucketCreationParameters:
+      description: Identifiers for a Controlled S3 External Bucket resource to reference.
       type: object
+      required:
+        - sourceWorkspaceId
+        - sourceResourceId
       properties:
-        instanceName:
-          description: The name of the SageMaker Notebook instance
+        sourceWorkspaceId:
+          description: Workspace ID in which the S3 External Bucket controlled resource
+            to be referenced exists.
           type: string
-        instanceType:
-          description: The type of the SageMaker Notebook instance
+          format: uuid
+        sourceResourceId:
+          description: Resource ID of the S3 External Bucket controlled resource to
+            be referenced
           type: string
-    AwsSageMakerNotebookCreationParameters:
-      description: SageMaker Notebook specific properties to be set on creation. These
-        are a subset of the values accepted by the AWS SageMaker Notebook API.
+          format: uuid
+    AwsReferencedS3FolderCreationParameters:
+      description: S3 Storage Folder specific properties to be set on creation. These
+        are a subset of the values accepted by the AWS S3 Storage API.
       type: object
+      required:
+        - s3Uri
       properties:
-        instanceName:
-          description: A valid instance name per https://docs.aws.amazon.com/sageMaker/latest/APIReference/API_CreateNotebookInstance.html#sageMaker-CreateNotebookInstance-request-NotebookInstanceName
-          type: string
-        instanceType:
-          description: A valid instance type per https://docs.aws.amazon.com/general/latest/gr/sageMaker.html
+        s3Uri:
+          description: s3 uri, e.g. s3://folder/subfolder
           type: string
-          default: ml.t3.medium
         region:
-          description: A valid SageMaker Notebook region per https://docs.aws.amazon.com/general/latest/gr/sageMaker.html.
+          description: region of the s3 folder. Must specified if the s3 folder being
+            referenced is not provisioned by workbench (i.e. external s3 bucket).
           type: string
-          default: us-east-1
-    AwsSageMakerNotebookResource:
-      type: object
-      description: Description of an AWS SageMaker Notebook instance resource.
-      required:
-        - metadata
-        - attributes
-      properties:
-        metadata:
-          description: the resource metadata common to all resources
-          $ref: '#/components/schemas/ResourceMetadata'
-        attributes:
-          $ref: '#/components/schemas/AwsSageMakerNotebookAttributes'
-    AzureBatchPoolApplicationPackageReference:
-      description: 'Link to an application package inside the batch account.
-
-        '
+    AwsResourceCloudName:
+      description: A valid cloud name for resource.
       type: object
-      properties:
-        id:
-          description: The ID of the application package to install.
-          type: string
-        version:
-          description: The version of the application to deploy.
-          type: string
-    AzureBatchPoolAttributes:
-      description: Collection of nodes that an application runs on
       required:
-        - id
-        - vmSize
-        - deploymentConfiguration
-      type: object
-      properties:
-        id:
-          description: A string that uniquely identifies the Pool within the Account.
-          type: string
-        vmSize:
-          description: The size of virtual machines in the Pool. All virtual machines
-            in a Pool are the same size.
-          type: string
-        displayName:
-          description: 'The display name for the pool. The display name need not be
-            unique and can contain any
-
-            Unicode characters up to a maximum length of 1024.
-
-            '
-          type: string
-        deploymentConfiguration:
-          description: Batch pool deployment configuration properties.
-          $ref: '#/components/schemas/AzureBatchPoolDeploymentConfiguration'
-        userAssignedIdentities:
-          description: 'User assigned identities associated with a batch pool. Batch
-            pool supports up to 10 user assigned identities.
-
-            '
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureBatchPoolUserAssignedIdentity'
-        scaleSettings:
-          description: 'Scale settings for the pool Defines the desired size of the
-            pool.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolScaleSettings'
-        startTask:
-          description: 'A task which is run when a compute node joins a pool in the
-            Azure Batch service,
-
-            or when the compute node is rebooted or reimaged.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolStartTask'
-        applicationPackages:
-          description: 'The list of application packages to be installed on each compute
-            node in the pool.
-
-            '
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureBatchPoolApplicationPackageReference'
-        networkConfiguration:
-          description: 'The network configuration for a pool.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolNetworkConfiguration'
-    AzureBatchPoolAutoScaleSettings:
-      description: AutoScale settings for the pool.
-      type: object
+        - awsResourceCloudName
       properties:
-        formula:
-          description: A formula for the desired number of compute nodes in the pool.
+        awsResourceCloudName:
           type: string
-        evaluationInterval:
-          description: 'The time interval (in minutes) at which to automatically adjust
-            the pool size according to the autoscale formula.
-
-            If omitted, the default value is 15 minutes.
-
-            '
-          type: integer
-    AzureBatchPoolAutoUserScope:
-      description: Defines values for AutoUserScope.
-      type: string
-      enum:
-        - Task
-        - Pool
-    AzureBatchPoolAutoUserSpecification:
-      description: 'Specifies the parameters for the auto user that runs a task on
-        the Batch service.
-
-        '
+    AwsResourceDescription:
+      description: Description of an AWS Controlled Resource as Returned by AWS Describe*
+        API calls
       type: object
       properties:
-        scope:
-          description: The scope for the auto user The default value is Pool.
-          $ref: '#/components/schemas/AzureBatchPoolAutoUserScope'
-        elevationLevel:
-          description: The elevation level of the user.
-          $ref: '#/components/schemas/AzureBatchPoolElevationLevel'
-    AzureBatchPoolCloudServiceConfiguration:
+        resourceDescription:
+          type: object
+    AwsS3ExternalBucketAttributes:
+      description: AWS S3 External Bucket resource properties included in post-creation
+        get.
       type: object
-      description: 'The configuration for nodes in a pool based on the Azure Cloud
-        Services platform.
-
-        '
       required:
-        - osFamily
+        - bucketName
+        - prefix
+        - account
+        - region
+        - tagPrefix
       properties:
-        osFamily:
-          description: 'The Azure Guest OS family to be installed on the virtual machines
-            in the pool.
-
-            '
-          type: string
-        osVersion:
-          description: 'The Azure Guest OS version to be installed on the virtual
-            machines in the pool.
-
-            '
+        bucketName:
+          description: The name of the external S3 bucket to which this resource provides
+            access.
           type: string
-    AzureBatchPoolComputeNodeDeallocationOption:
-      description: 'Determines what to do with a node and its running task(s) after
-        it has been selected for deallocation.
-
-        '
-      type: string
-      enum:
-        - Requeue
-        - Terminate
-        - TaskCompletion
-        - RetainedData
-    AzureBatchPoolComputeNodeIdentityReference:
-      description: 'The reference to a user assigned identity associated with the
-        Batch pool which a compute node will use.
-
-        '
-      type: object
-      properties:
-        resourceId:
-          description: The ARM resource id of the user assigned identity.
+        prefix:
+          description: The prefix within the external S3 bucket to limit access to
+            (optional).
           type: string
-    AzureBatchPoolContainerRegistry:
-      description: A private container registry.
-      type: object
-      properties:
-        userName:
-          description: The user name to log into the registry server.
+        account:
+          description: ID of the AWS account that the external S3 bucket resides in.
           type: string
-        password:
-          description: The password to log into the registry server.
+        region:
+          description: AWS region that the external S3 bucket resides in.
           type: string
-        registryServer:
-          description: The registry URL. If omitted, the default is "docker.io".
+        tagPrefix:
+          description: Prefix to apply to tag keys used in IAM policies allowing access
+            to the resource.
           type: string
-        identityReference:
-          description: 'The reference to a user assigned identity associated with
-            the Batch pool
-
-            which a compute node will use.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolComputeNodeIdentityReference'
-    AzureBatchPoolContainerWorkingDirectory:
-      description: Defines values for ContainerWorkingDirectory.
-      type: string
-      enum:
-        - TaskWorkingDirectory
-        - ContainerImageDefault
-    AzureBatchPoolCreationParameters:
-      description: 'Batch Pool-specific properties to be set on creation. These are
-        a subset of the values
-
-        accepted by the azure resource API
-
-        '
+    AwsS3ExternalBucketCreationParameters:
+      description: Properties of the externally managed S3 Bucket that this resource
+        will provide access to.
       type: object
       required:
-        - id
-        - vmSize
-        - deploymentConfiguration
+        - bucketName
+        - accountId
+        - region
       properties:
-        id:
-          description: A string that uniquely identifies the Pool within the Batch
-            Account.
+        bucketName:
+          description: An existing S3 Bucket name to provide access to.
           type: string
-        displayName:
-          description: 'The display name for the pool. The display name need not be
-            unique and can contain any
-
-            Unicode characters up to a maximum length of 1024.
-
-            '
+        accountId:
+          description: Account number of AWS Account that the S3 Bucket exists in.
           type: string
-        vmSize:
-          description: 'The size of virtual machines in the Pool. All virtual machines
-            in a Pool are the same size.
-
-            '
+        prefix:
+          description: Object prefix to limit access to in the external bucket (optional).
           type: string
-        deploymentConfiguration:
-          description: Batch pool deployment configuration properties.
-          $ref: '#/components/schemas/AzureBatchPoolDeploymentConfiguration'
-        userAssignedIdentities:
-          description: 'User assigned identities associated with a batch pool. Batch
-            pool supports up to 10 user assigned identities.
-
-            '
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureBatchPoolUserAssignedIdentity'
-        scaleSettings:
-          description: 'Scale settings for the pool Defines the desired size of the
-            pool.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolScaleSettings'
-        startTask:
-          description: 'A task which is run when a compute node joins a pool in the
-            Azure Batch service, or
-
-            when the compute node is rebooted or reimaged.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolStartTask'
-        applicationPackages:
-          description: 'The list of application packages to be installed on each compute
-            node in the pool.
-
-            '
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureBatchPoolApplicationPackageReference'
-        networkConfiguration:
-          description: 'The network configuration for a pool.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolNetworkConfiguration'
-        metadata:
-          description: 'A list of name-value pairs associated with the pool as metadata.
-            The
-
-            Batch service does not assign any meaning to metadata; it is solely for
-            the use of user code.
-
-            '
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureBatchPoolMetadataItem'
-    AzureBatchPoolDeploymentConfiguration:
-      type: object
-      description: Batch pool deployment configuration properties.
-      properties:
-        virtualMachineConfiguration:
-          description: 'The configuration for compute nodes in a pool based on the
-            Azure Virtual Machines infrastructure.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolVirtualMachineConfiguration'
-        cloudServiceConfiguration:
-          description: 'The configuration for nodes in a pool based on the Azure Cloud
-            Services platform.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolCloudServiceConfiguration'
-    AzureBatchPoolElevationLevel:
-      description: Defines values for ElevationLevel.
-      type: string
-      enum:
-        - NonAdmin
-        - Admin
-    AzureBatchPoolEnvironmentSetting:
-      description: An environment variable to be set on a task process.
-      type: object
-      properties:
-        name:
-          description: The name of the environment variable.
+          default: ''
+        tagPrefix:
+          description: Prefix for Principal tag key to be used in external IAM policies.
           type: string
-        value:
-          description: The value of the environment variable.
+          default: vwb-
+        region:
+          description: The AWS Region that the S3 Bucket exists in.
           type: string
-    AzureBatchPoolFixedScaleSettings:
-      type: object
-      properties:
-        resizeTimeout:
-          description: The timeout (in minutes) for allocation of compute nodes to
-            the pool. The minimum value is 5 minutes.
-          type: integer
-        targetDedicatedNodes:
-          description: The desired number of dedicated compute nodes in the pool.
-          type: integer
-        targetLowPriorityNodes:
-          description: The desired number of Spot/low-priority compute nodes in the
-            pool.
-          type: integer
-        nodeDeallocationOption:
-          $ref: '#/components/schemas/AzureBatchPoolComputeNodeDeallocationOption'
-    AzureBatchPoolMetadataItem:
-      description: 'A list of name-value pairs associated with the pool as metadata.
-        The
-
-        Batch service does not assign any meaning to metadata; it is solely for the
-        use of user code.
-
-        '
+    AwsS3ExternalBucketReferenceAttributes:
+      description: AWS S3 External Bucket reference properties included in post-creation
+        get.
       type: object
       required:
-        - name
-        - value
+        - sourceWorkspaceId
+        - sourceResourceId
       properties:
-        name:
-          description: The name of the metadata item.
-          type: string
-        value:
-          description: The value of the metadata item.
+        sourceWorkspaceId:
+          description: ID of the workspace of the source resource for this clone
           type: string
-    AzureBatchPoolNetworkConfiguration:
-      description: 'The network configuration for a pool.
-
-        '
-      type: object
-      properties:
-        subnetId:
-          description: asdf
+          format: uuid
+        sourceResourceId:
+          description: ID of the source resource
           type: string
-        dynamicVNetAssignmentScope:
-          description: The scope of dynamic vnet assignment.
-          $ref: '#/components/schemas/DynamicVNetAssignmentScope'
-        endpointConfiguration:
-          description: The endpoint configuration for a pool.
-          $ref: '#/components/schemas/PoolEndpointConfiguration'
-        publicIpAddressConfiguration:
-          description: "The public IP Address configuration of the networking configuration\
-            \ of a Pool. This property is \nonly supported on Pools with the virtualMachineConfiguration\
-            \ property.\n"
-          $ref: '#/components/schemas/PublicIpAddressConfiguration'
-    AzureBatchPoolResource:
+          format: uuid
+    AwsS3ExternalBucketReferenceResource:
       type: object
-      description: Description of an Azure Batch Pool
+      description: Description of a reference to an externally managed AWS S3 Storage
+        Bucket resource.
       required:
         - metadata
         - attributes
@@ -5279,388 +5044,10 @@ components:
           description: the resource metadata common to all resources
           $ref: '#/components/schemas/ResourceMetadata'
         attributes:
-          $ref: '#/components/schemas/AzureBatchPoolAttributes'
-    AzureBatchPoolResourceFile:
-      description: 'A single file or multiple files to be downloaded to a compute
-        node.
-
-        '
-      type: object
-      properties:
-        autoStorageContainerName:
-          description: The storage container name in the auto storage account.
-          type: string
-        storageContainerUrl:
-          description: The URL of the blob container within Azure Blob Storage.
-          type: string
-        httpUrl:
-          description: The URL of the file to download.
-          type: string
-        blobPrefix:
-          description: 'The blob prefix to use when downloading blobs from an Azure
-            Storage container.
-
-            '
-          type: string
-        filePath:
-          description: 'The location on the compute node to which to download the
-            file, relative
-
-            to the task''s working directory.
-
-            '
-          type: string
-        fileMode:
-          description: The file permission mode attribute in octal format.
-          type: string
-        identityReference:
-          description: 'The reference to a user assigned identity associated with
-            the Batch pool which a compute node will use.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolComputeNodeIdentityReference'
-    AzureBatchPoolScaleSettings:
-      type: object
-      description: Scale settings for the pool Defines the desired size of the pool.
-      properties:
-        fixedScale:
-          description: "Fixed scale settings for the pool. This property and autoScale\
-            \ are mutually exclusive \nand one of the properties must be specified.\n"
-          $ref: '#/components/schemas/AzureBatchPoolFixedScaleSettings'
-        autoScale:
-          description: 'AutoScale settings for the pool. This property and fixedScale
-            are mutually exclusive
-
-            and one of the properties must be specified.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolAutoScaleSettings'
-    AzureBatchPoolStartTask:
-      description: 'A task which is run when a compute node joins a pool in the Azure
-        Batch service, or
-
-        when the compute node is rebooted or reimaged.
-
-        '
-      type: object
-      properties:
-        commandLine:
-          description: The command line of the start task.
-          type: string
-        resourceFiles:
-          description: 'A list of files that the Batch service will download to the
-            compute node
-
-            before running the command line.
-
-            '
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureBatchPoolResourceFile'
-        environmentSettings:
-          description: 'A list of environment variable settings for the start task.
-
-            '
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureBatchPoolEnvironmentSetting'
-        userIdentity:
-          description: The definition of the user identity under which the task is
-            run.
-          $ref: '#/components/schemas/AzureBatchPoolUserIdentity'
-        maxTaskRetryCount:
-          description: The maximum number of times the task may be retried.
-          type: integer
-        waitForSuccess:
-          description: 'Whether the Batch service should wait for the start task to
-            complete
-
-            successfully (that is, to exit with exit code 0) before scheduling any
-            tasks on the compute node.
-
-            '
-          type: boolean
-        containerSettings:
-          description: The container settings for a task.
-          $ref: '#/components/schemas/AzureBatchPoolTaskContainerSettings'
-    AzureBatchPoolTaskContainerSettings:
-      description: The container settings for a task.
-      type: object
-      properties:
-        containerRunOptions:
-          description: Additional options to the container create command.
-          type: string
-        imageName:
-          description: The image to use to create the container in which the task
-            will run.
-          type: string
-        registry:
-          description: A private container registry.
-          $ref: '#/components/schemas/AzureBatchPoolContainerRegistry'
-        workingDirectory:
-          description: A flag to indicate where the container task working directory
-            is.
-          $ref: '#/components/schemas/AzureBatchPoolContainerWorkingDirectory'
-    AzureBatchPoolUserAssignedIdentity:
-      type: object
-      description: User assigned identity associated with a batch pool.
-      properties:
-        name:
-          description: 'The name of the user assigned identity. This parameter is
-            mutually exclusive with clientId.
-
-            '
-          type: string
-        clientId:
-          description: "The client id of the UAMI. This parameter is mutually exclusive\
-            \ with name. If this parameter \nis set instead of the name WSM will try\
-            \ to locate specific UAMI based on it.\n"
-          type: string
-          format: uuid
-        resourceGroupName:
-          description: 'The resource group name where identity resides. Default value
-            is MRG where Azure Batch account exists.
-
-            '
-          type: string
-    AzureBatchPoolUserIdentity:
-      description: The definition of the user identity under which the task is run.
-      type: object
-      properties:
-        userName:
-          description: The name of the user identity under which the task is run.
-          type: string
-        autoUser:
-          description: 'Specifies the parameters for the auto user that runs a task
-            on the Batch service.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolAutoUserSpecification'
-    AzureBatchPoolVirtualMachineConfiguration:
-      type: object
-      description: 'The configuration for compute nodes in a pool based on the Azure
-        Virtual Machines infrastructure.
-
-        '
-      required:
-        - imageReference
-        - nodeAgentSkuId
-      properties:
-        imageReference:
-          description: 'A reference to an Azure Virtual Machines Marketplace image
-            or the Azure Image resource of a custom Virtual Machine.
-
-            '
-          $ref: '#/components/schemas/AzureBatchPoolVirtualMachineImageReference'
-        nodeAgentSkuId:
-          description: 'The SKU of the Batch node agent to be provisioned on compute
-            nodes in the pool.
-
-            '
-          type: string
-    AzureBatchPoolVirtualMachineImageReference:
-      type: object
-      description: 'A reference to an Azure Virtual Machines Marketplace image or
-        the Azure Image resource of a custom Virtual Machine.
-
-        Id is mutually exclusive with other properties.
-
-        '
-      properties:
-        publisher:
-          description: 'The publisher of the Azure Virtual Machines Marketplace image.
-            For example, Canonical or MicrosoftWindowsServer.
-
-            '
-          type: string
-        offer:
-          description: 'The offer type of the Azure Virtual Machines Marketplace image.
-            For example, UbuntuServer or WindowsServer.
-
-            '
-          type: string
-        sku:
-          description: 'The SKU of the Azure Virtual Machines Marketplace image. For
-            example, 18.04-LTS or 2022-datacenter.
-
-            '
-          type: string
-        version:
-          description: 'The version of the Azure Virtual Machines Marketplace image.
-            A value of
-
-            ''latest'' can be specified to select the latest version of an image.
-            If
-
-            omitted, the default is ''latest''.
-
-            '
-          type: string
-        id:
-          description: "The ARM resource identifier of the Shared Image Gallery Image.\
-            \ Compute Nodes in the Pool will \nbe created using this Image Id. This\
-            \ is of the form\n/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/galleries/{galleryName}/images/{imageDefinitionName}/versions/{versionId}.\n\
-            This property is mutually exclusive with other properties. The Shared\
-            \ Image Gallery image must \nhave replicas in the same region as the Azure\
-            \ Batch account. For information about the firewall \nsettings for the\
-            \ Batch node agent to communicate with the Batch service see\nhttps://docs.microsoft.com/en-us/azure/batch/batch-api-basics#virtual-network-vnet-and-firewall-configuration.\n"
-          type: string
-    AzureContext:
-      type: object
-      description: The Azure cloud context associated with a workspace.
-      properties:
-        tenantId:
-          description: The ID of the Azure tenant associated with the workspace.
-          type: string
-        subscriptionId:
-          description: The ID of the Azure subscription associated with the workspace.
-          type: string
-        resourceGroupId:
-          description: The ID of the Azure resource group associated with the workspace.
-          type: string
-        operationState:
-          $ref: '#/components/schemas/OperationState'
-    AzureDatabaseAttributes:
-      description: Database properties included in post-creation get and update. Others
-        must be retrieved from Azure using the name.
-      type: object
-      properties:
-        databaseName:
-          description: Name of created database (not the resource name).
-          type: string
-        databaseOwner:
-          description: Resource name of database owner.
-          type: string
-        allowAccessForAllWorkspaceUsers:
-          description: Whether all workspace users have access to the database.
-          type: boolean
-    AzureDatabaseCreationParameters:
-      description: Database-specific properties to be set on creation. These are a
-        subset of the values accepted by the azure resource API
-      type: object
-      required:
-        - name
-      properties:
-        name:
-          description: A valid database name
-          type: string
-          pattern: ^[a-zA-Z][a-zA-Z0-9_]{0,31}$
-        owner:
-          description: Resource id or name of an azure managed identity in this workspace
-            to be the owner of the database, required for shared databases. For private
-            databases, the owner will be determined from privateResourceUser.
-          type: string
-        k8sNamespace:
-          description: The kubernetes namespace from which the database will be accessed.
-            A database created with this specified will not be usable with a KubernetesNamespace
-            controlled resource. Will be removed once Leonardo switches to use KubernetesNamespace
-            controlled resources.
-          type: string
-          deprecated: true
-        allowAccessForAllWorkspaceUsers:
-          description: Whether to allow users in the workspace to create kubernetes
-            namespaces that can connect to this database.
-          type: boolean
-          default: false
-    AzureDatabaseResource:
-      type: object
-      description: Description of an Azure database
-      required:
-        - metadata
-        - attributes
-      properties:
-        metadata:
-          description: the resource metadata common to all resources
-          $ref: '#/components/schemas/ResourceMetadata'
-        attributes:
-          $ref: '#/components/schemas/AzureDatabaseAttributes'
-    AzureDiskAttributes:
-      description: Disk properties included in post-creation get and update. Others
-        must be retrieved from Azure using the name.
-      type: object
-      properties:
-        diskName:
-          description: Name of created disk (not the resource name).
-          type: string
-        region:
-          description: Azure region of created disk
-          type: string
-    AzureDiskCreationParameters:
-      description: Disk-specific properties to be set on creation. These are a subset
-        of the values accepted by the azure resource API
-      type: object
-      required:
-        - name
-        - size
-      properties:
-        name:
-          description: A valid disk name per https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules
-          type: string
-        size:
-          description: 'A valid size in GB integer representation
-
-            '
-          type: integer
-    AzureDiskResource:
-      type: object
-      description: Description of an Azure disk
-      required:
-        - metadata
-        - attributes
-      properties:
-        metadata:
-          description: the resource metadata common to all resources
-          $ref: '#/components/schemas/ResourceMetadata'
-        attributes:
-          $ref: '#/components/schemas/AzureDiskAttributes'
-    AzureKubernetesNamespaceAttributes:
-      description: KubernetesNamespace properties included in post-creation get and
-        update. Others must be retrieved from Azure using the name.
-      type: object
-      properties:
-        kubernetesNamespace:
-          description: Name of created kubernetesNamespace (not the resource name).
-          type: string
-        kubernetesServiceAccount:
-          description: Name of the kubernetesServiceAccount created for the kubernetesNamespace.
-            This value doubles as database user name. Null if no service account was
-            created.
-          type: string
-        managedIdentity:
-          description: The resource name of a managed identity to use for the kubernetesNamespace.
-            Null for private namespaces.
-          type: string
-        databases:
-          description: The resource names of databases within the workspace to be
-            used by the kubernetesNamespace.
-          type: array
-          items:
-            type: string
-    AzureKubernetesNamespaceCreationParameters:
-      description: KubernetesNamespace-specific properties to be set on creation.
-        These are a subset of the values accepted by the azure resource API
-      type: object
-      required:
-        - namespacePrefix
-      properties:
-        namespacePrefix:
-          description: The full namespace name will be {namespacePrefix}-{workspaceId}
-          type: string
-          pattern: ^[a-z][a-z0-9-]{0,24}$
-        managedIdentity:
-          description: The resource id or name of a managed identity to use for the
-            kubernetesNamespace. Omit for private namespaces.
-          type: string
-        databases:
-          description: The resource IDs or names of databases within the workspace
-            to be used by the kubernetesNamespace. Some form of identity (managed
-            identity or private namespace) must be used to access databases.
-          type: array
-          items:
-            type: string
-    AzureKubernetesNamespaceResource:
+          $ref: '#/components/schemas/AwsS3ExternalBucketReferenceAttributes'
+    AwsS3ExternalBucketResource:
       type: object
-      description: Description of an Azure kubernetesNamespace
+      description: Description of an externally managed AWS S3 Storage Bucket resource.
       required:
         - metadata
         - attributes
@@ -5669,405 +5056,89 @@ components:
           description: the resource metadata common to all resources
           $ref: '#/components/schemas/ResourceMetadata'
         attributes:
-          $ref: '#/components/schemas/AzureKubernetesNamespaceAttributes'
-    AzureLandingZone:
-      description: 'The landing zone identification information.
-
-        '
-      type: object
-      required:
-        - landingZoneId
-        - billingProfileId
-      properties:
-        landingZoneId:
-          description: An identifier of a Azure landing zone.
-          type: string
-          format: uuid
-        billingProfileId:
-          description: Identifier for the billing profile used for the landing zone.
-          type: string
-          format: uuid
-        definition:
-          description: A definition to create an Azure landing zone from
-          type: string
-        version:
-          description: 'A version of the landing zone. If not set the most recent
-            will be used.
-
-            If two versions available - ''v1'' and ''v2'' then ''v2'' will be selected.
-
-            '
-          type: string
-        createdDate:
-          description: 'A string containing date and time of Landing Zone creation.
-
-            It is set by the Landing Zone service and cannot be updated.
-
-            '
-          type: string
-          format: date-time
-    AzureLandingZoneDefinition:
-      type: object
-      required:
-        - definition
-        - name
-        - description
-        - version
-      properties:
-        definition:
-          description: The name of the corresponding landing zone definition
-          type: string
-        name:
-          description: User friendly name of the definition
-          type: string
-        description:
-          description: Description of the definition
-          type: string
-        version:
-          description: The version of the definition
-          type: string
-    AzureLandingZoneDefinitionList:
-      type: object
-      required:
-        - landingzones
-      properties:
-        landingzones:
-          description: A list of Azure landing zones definitions
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureLandingZoneDefinition'
-    AzureLandingZoneDeployedResource:
-      description: Details of an Azure resource.
-      type: object
-      properties:
-        resourceId:
-          description: Unique Azure resource identifier.
-          type: string
-        resourceType:
-          description: 'The azure deployed resource type; e.g., ''Microsoft.Compute/virtualMachines''.
-
-            The deployed resource type definition is located in ARM template documentation,
-            under the Reference node.
-
-            '
-          type: string
-        resourceName:
-          description: Azure resource name. Present for a subnet resource.
-          type: string
-        resourceParentId:
-          description: Azure resource Id of a resource parent. Present for a subnet
-            resource.
-          type: string
-        region:
-          description: A region where an Azure resource deployed.
-          type: string
-        tags:
-          description: Tags for this Azure resource.
-          type: object
-          additionalProperties:
-            type: string
-    AzureLandingZoneDetails:
-      description: Created Azure Landing Zone details.
-      type: object
-      properties:
-        id:
-          description: An identifier of created Azure landing zone.
-          type: string
-          format: uuid
-        resources:
-          description: List of Azure landing zone deployed resources.
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureLandingZoneDeployedResource'
-    AzureLandingZoneList:
-      type: object
-      required:
-        - landingzones
-      properties:
-        landingzones:
-          description: A list of landing zones.
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureLandingZone'
-    AzureLandingZoneParameter:
-      description: Parameters to set user defined properties for resources in a landing
-        zone
-      type: object
-      required:
-        - key
-        - value
-      properties:
-        key:
-          description: Name of the parameter
-          type: string
-        value:
-          description: Value of the parameter
-          type: string
-    AzureLandingZoneResourcesList:
-      type: object
-      required:
-        - resources
-      properties:
-        id:
-          description: An identifier of a Azure landing zone.
-          type: string
-          format: uuid
-        resources:
-          description: A list of deployed resources in a landing zone, grouped by
-            purpose.
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureLandingZoneResourcesPurposeGroup'
-    AzureLandingZoneResourcesPurposeGroup:
-      description: 'The structure contains one landing zone purpose and a list of
-        Azure deployed resources that
-
-        are tagged with this purpose.
-
-        '
-      type: object
-      required:
-        - purpose
-        - deployedResources
-      properties:
-        purpose:
-          description: Purpose tag value string.
-          type: string
-        deployedResources:
-          description: A list of Azure landing zones deployed resources.
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureLandingZoneDeployedResource'
-    AzureLandingZoneResult:
-      description: Result of creating Azure landing zone
+          $ref: '#/components/schemas/AwsS3ExternalBucketAttributes'
+    AwsS3ExternalBucketUpdateParameters:
+      description: Properties of the externally managed S3 Bucket to update.
       type: object
       properties:
-        landingZone:
-          $ref: '#/components/schemas/AzureLandingZoneDetails'
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
-    AzureManagedIdentityAttributes:
-      description: ManagedIdentity properties included in post-creation get and update.
-        Others must be retrieved from Azure using the name.
-      type: object
-      properties:
-        managedIdentityName:
-          description: Name of created managedIdentity (not the resource name).
+        prefix:
+          description: Optional. Updated object prefix to limit access to in the external
+            bucket. Field will not be updated if this is omitted.
           type: string
-    AzureManagedIdentityCreationParameters:
-      description: ManagedIdentity-specific properties to be set on creation. These
-        are a subset of the values accepted by the azure resource API
-      type: object
-      required:
-        - name
-      properties:
-        name:
-          description: A valid managed identity name
+        tagPrefix:
+          description: Optional. Updated prefix for Principal tag key to be used in
+            external IAM policies. Field will not be updated if this is omitted.
           type: string
-          pattern: ^[a-zA-Z0-9][-a-zA-Z0-9_]{2,127}$
-    AzureManagedIdentityResource:
-      type: object
-      description: Description of an Azure managedIdentity
-      required:
-        - metadata
-        - attributes
-      properties:
-        metadata:
-          description: the resource metadata common to all resources
-          $ref: '#/components/schemas/ResourceMetadata'
-        attributes:
-          $ref: '#/components/schemas/AzureManagedIdentityAttributes'
-    AzureStorageContainerAttributes:
-      description: Storage container properties included in post-creation get.
+    AwsS3StorageFolderAttributes:
+      description: AWS S3 Storage Folder resource properties included in post-creation
+        get.
       type: object
       properties:
-        storageContainerName:
-          description: Name of the storage container.
+        bucketName:
+          description: The name of the S3 bucket in which the Terra Storage Folder
+            was allocated.
           type: string
-    AzureStorageContainerCreationParameters:
-      description: Storage container-specific properties to be set on creation. These
-        are a subset of the values accepted by the azure resource API (note that public
-        access is disabled).
-      type: object
-      required:
-        - storageContainerName
-      properties:
-        storageContainerName:
-          description: A valid storage container name per https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules
+        prefix:
+          description: The prefix within the S3 bucket.
           type: string
-    AzureStorageContainerResource:
-      type: object
-      description: Description of an Azure storage container.
-      required:
-        - metadata
-        - attributes
-      properties:
-        metadata:
-          description: the resource metadata common to all resources
-          $ref: '#/components/schemas/ResourceMetadata'
-        attributes:
-          $ref: '#/components/schemas/AzureStorageContainerAttributes'
-    AzureVmAttributes:
-      description: Vm properties included in post-creation get and update. Others
-        must be retrieved from Azure using the name.
-      type: object
-      properties:
-        vmName:
-          description: Name of created vm (not the resource name).
+        s3Uri:
+          description: s3 URI path of the s3 folder
           type: string
         region:
-          description: Azure region of created vm
-          type: string
-        vmSize:
-          description: A valid image size as per com.azure.resourcemanager.compute.models.VirtualMachineSizeTypes
-          type: string
-        vmImage:
-          description: A valid data which identifies the VM image
-          type: string
-        diskId:
-          description: A valid WSM identifier for an Azure Disk that corresponds to
-            a valid azure resource
+          description: region of the s3 folder
           type: string
-          format: uuid
-    AzureVmCreationParameters:
-      description: Vm-specific properties to be set on creation. These are a subset
-        of the values accepted by the azure resource API
-      type: object
-      required:
-        - name
-        - vmSize
-        - vmImage
-      properties:
-        name:
-          description: A valid vm name per https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules
-          type: string
-        vmSize:
-          description: A valid image size as per https://learn.microsoft.com/en-us/azure/virtual-machines/sizes
-          type: string
-        diskId:
-          description: A valid WSM identifier for an Azure Disk that corresponds to
-            a valid azure resource
-          type: string
-          format: uuid
-        vmImage:
-          description: A valid data which identifies the VM image
-          $ref: '#/components/schemas/AzureVmImage'
-        vmUser:
-          description: A valid VM user data. This data is required only for marketplace
-            VM image.
-          $ref: '#/components/schemas/AzureVmUser'
-        customScriptExtension:
-          description: A custom script extension
-          $ref: '#/components/schemas/AzureVmCustomScriptExtension'
-        ephemeralOSDisk:
-          description: Whether or not to use an ephemeral OS disk and where to place
-            it. https://docs.microsoft.com/en-us/azure/virtual-machines/ephemeral-os-disks
-          type: string
-          enum:
-            - NONE
-            - OS_CACHE
-            - TMP_DISK
-        customData:
-          description: Supply base64 encoded custom data for vm. https://docs.microsoft.com/en-us/azure/virtual-machines/custom-data
-          type: string
-          format: base64
-    AzureVmCustomScriptExtension:
-      description: Azure VM custom script extension definition. Azure documentation
-        https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux
+    AwsS3StorageFolderCreationParameters:
+      description: S3 Storage Folder specific properties to be set on creation. These
+        are a subset of the values accepted by the AWS S3 Storage API.
       type: object
-      required:
-        - name
-        - publisher
       properties:
-        name:
-          description: A name of the extension
-          type: string
-        publisher:
-          description: A publisher of the extension
-          type: string
-        type:
-          description: A type of the extension
+        folderName:
+          description: A valid folder name per https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html.
           type: string
-        version:
-          description: A version of the extension
+        region:
+          description: A valid S3 Storage Folder region per https://docs.aws.amazon.com/general/latest/gr/s3.html.
           type: string
-        minorVersionAutoUpgrade:
-          description: Flag which controls auto upgrade of the extension
-          type: boolean
-        publicSettings:
-          description: List of public settings of the extension
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureVmCustomScriptExtensionSetting'
-        protectedSettings:
-          description: List of protected settings of the extension
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureVmCustomScriptExtensionSetting'
-        tags:
-          description: List of tags of the extension
-          type: array
-          items:
-            $ref: '#/components/schemas/AzureVmCustomScriptExtensionTag'
-    AzureVmCustomScriptExtensionSetting:
-      description: Azure VM extension settings
+    AwsS3StorageFolderResource:
       type: object
+      description: Description of an AWS S3 Storage Folder resource.
       required:
-        - key
-        - value
+        - metadata
+        - attributes
       properties:
-        key:
-          description: Name of the settings entry
-          type: string
-        value:
-          description: Value of the settings entry
-          type: object
-    AzureVmCustomScriptExtensionTag:
-      description: List of tags for VM extension
+        metadata:
+          description: the resource metadata common to all resources
+          $ref: '#/components/schemas/ResourceMetadata'
+        attributes:
+          $ref: '#/components/schemas/AwsS3StorageFolderAttributes'
+    AwsSageMakerNotebookAttributes:
+      description: AWS SageMaker Notebook instance resource properties included in
+        post-creation get.
       type: object
-      required:
-        - key
-        - value
       properties:
-        key:
-          description: Name of the tag
+        instanceName:
+          description: The name of the SageMaker Notebook instance
           type: string
-        value:
-          description: Value of the tag
+        instanceType:
+          description: The type of the SageMaker Notebook instance
           type: string
-    AzureVmImage:
-      description: 'A valid data which identifies the VM image. It supports custom
-        and marketplace images. Properties are mutually exclusive. Either Uri can
-        be defined or publisher, offer, sku and version. Uri should be assigned in
-        order to refer to custom image. Custom image must be in the same region. For
-        instance /subscriptions/3efc5bdf-be0e-44e7-b1d7-c08931e3c16c/resourceGroups/mrg-qi-1-preview-20210517084351/providers/Microsoft.Compute/galleries/msdsvm/images/customized_ms_dsvm/versions/0.1.0
-        In order to use marketplace image following properties should be defined:
-        publisher, offer, sku and version. The allowed formats for version are Major.Minor.Build
-        or ''latest''. For instance publisher=microsoft-dsvm, offer=ubuntu-1804, sku=1804-gen2,
-        version=22.04.27 If all parameters are defined then uri parameter will take
-        precedence and vmUser parameter will be ignored.'
+    AwsSageMakerNotebookCreationParameters:
+      description: SageMaker Notebook specific properties to be set on creation. These
+        are a subset of the values accepted by the AWS SageMaker Notebook API.
       type: object
       properties:
-        uri:
-          description: A valid image Uri
-          type: string
-        publisher:
-          description: A publisher of an image
-          type: string
-        offer:
-          description: An offer of an image
+        instanceName:
+          description: A valid instance name per https://docs.aws.amazon.com/sageMaker/latest/APIReference/API_CreateNotebookInstance.html#sageMaker-CreateNotebookInstance-request-NotebookInstanceName
           type: string
-        sku:
-          description: A sku of an image
+        instanceType:
+          description: A valid instance type per https://docs.aws.amazon.com/general/latest/gr/sageMaker.html
           type: string
-        version:
-          description: A version of an image
+          default: ml.t3.medium
+        region:
+          description: A valid SageMaker Notebook region per https://docs.aws.amazon.com/general/latest/gr/sageMaker.html.
           type: string
-    AzureVmResource:
+    AwsSageMakerNotebookResource:
       type: object
-      description: Description of an Azure vm
+      description: Description of an AWS SageMaker Notebook instance resource.
       required:
         - metadata
         - attributes
@@ -6076,20 +5147,25 @@ components:
           description: the resource metadata common to all resources
           $ref: '#/components/schemas/ResourceMetadata'
         attributes:
-          $ref: '#/components/schemas/AzureVmAttributes'
-    AzureVmUser:
-      description: User credentials which are required for VM creation
+          $ref: '#/components/schemas/AwsSageMakerNotebookAttributes'
+    BackfillApplicationsRequest:
       type: object
+      description: UM Access on demand request
       required:
-        - name
-        - password
+        - applicationAble
+        - applicationIds
       properties:
-        name:
-          description: Specifies an SSH root user name for the Linux virtual machine
-          type: string
-        password:
-          description: Specifies the SSH root password for the Linux virtual machine
+        applicationAble:
+          description: Whether to enable or disable the applications
           type: string
+          enum:
+            - ENABLE
+            - DISABLE
+        applicationIds:
+          description: application ids
+          type: array
+          items:
+            type: string
     BqDatasetCloudId:
       type: object
       required:
@@ -6097,48 +5173,100 @@ components:
       properties:
         generatedDatasetCloudId:
           type: string
-    CloneControlledAzureStorageContainerRequest:
-      description: Values to assign to the cloned storage container for a given source
-        container. Leave name and description null to take the source object's values.
-        Any provided cloning instructions will override those previously set on the
-        source container.
+    CloneControlledAwsS3ExternalBucketRequestBody:
+      description: Values to be assigned with the cloned S3 External Bucket Reference
+        resource for a given source S3 External Bucket controlled resource. Only COPY_REFERENCE
+        and LINK_REFERENCE cloning instructions are defined for External Bucket resources.
+        Set name, displayName, and description null to maintain the original values.
       type: object
       required:
         - destinationWorkspaceId
-        - jobControl
       properties:
         destinationWorkspaceId:
           description: ID of workspace to be cloned into
           type: string
           format: uuid
+        destinationFolderId:
+          $ref: '#/components/schemas/FolderId'
         cloningInstructions:
           $ref: '#/components/schemas/CloningInstructionsEnum'
-        prefixesToClone:
-          description: if a non-empty value is specified, cloning will be limited
-            to the blobs that start with a prefix in this array
-          type: array
-          items:
-            type: string
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
-        jobControl:
-          $ref: '#/components/schemas/JobControl'
-    CloneControlledAzureStorageContainerResult:
-      description: API result class for cloning an Azure Storage Container.
+    CloneControlledAwsS3ExternalBucketResult:
+      description: Result of successful S3 External Bucket resource clone.
       type: object
+      required:
+        - effectiveCloningInstructions
+        - sourceWorkspaceId
+        - sourceResourceId
+        - resource
       properties:
-        container:
-          $ref: '#/components/schemas/ClonedControlledAzureStorageContainer'
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
+        effectiveCloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
+        sourceWorkspaceId:
+          description: Workspace ID of the source resource for this clone.
+          type: string
+          format: uuid
+        sourceResourceId:
+          description: ID of the source resource.
+          type: string
+          format: uuid
+        resource:
+          $ref: '#/components/schemas/AwsS3ExternalBucketReferenceResource'
+    CloneControlledAwsS3StorageFolderRequestBody:
+      description: Values to be assigned with the cloned S3 Storage Folder Reference
+        resource for a given source S3 Storage Folder controlled resource. Only COPY_REFERENCE
+        and LINK_REFERENCE cloning instructions are defined for S3 Storage Folder
+        resources. Set name, displayName, and description null to maintain the original
+        values.
+      type: object
+      required:
+        - destinationWorkspaceId
+      properties:
+        destinationWorkspaceId:
+          description: ID of workspace to be cloned into
+          type: string
+          format: uuid
+        destinationFolderId:
+          $ref: '#/components/schemas/FolderId'
+        cloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
+        name:
+          $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
+        description:
+          type: string
+    CloneControlledAwsS3StorageFolderResult:
+      description: Result of successful S3 Storage Folder resource clone.
+      type: object
+      required:
+        - effectiveCloningInstructions
+        - sourceWorkspaceId
+        - sourceResourceId
+        - resource
+      properties:
+        effectiveCloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
+        sourceWorkspaceId:
+          description: Workspace ID of the source resource for this clone.
+          type: string
+          format: uuid
+        sourceResourceId:
+          description: ID of the source resource.
+          type: string
+          format: uuid
+        resource:
+          $ref: '#/components/schemas/AwsS3StorageFolderResource'
     CloneControlledFlexibleResourceRequest:
       description: Values to be assigned with the cloned flex resource for a given
         source flex resource. Only COPY_RESOURCE and COPY_NOTHING are defined for
-        flex resources. Set name and description null to maintain the original values.
+        flex resources. Set name, displayName, and description null to maintain the
+        original values.
       type: object
       required:
         - destinationWorkspaceId
@@ -6147,10 +5275,14 @@ components:
           description: ID of workspace to be cloned into
           type: string
           format: uuid
+        destinationFolderId:
+          $ref: '#/components/schemas/FolderId'
         cloningInstructions:
           $ref: '#/components/schemas/CloningInstructionsEnum'
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
     CloneControlledFlexibleResourceResult:
@@ -6181,6 +5313,8 @@ components:
           description: ID of workspace to be cloned into
           type: string
           format: uuid
+        destinationFolderId:
+          $ref: '#/components/schemas/FolderId'
         destinationDatasetName:
           description: Name for destination dataset. Must not be set if cloningInstructions
             is COPY_REFERENCE. Letters, numbers and underscores only.
@@ -6193,6 +5327,8 @@ components:
           $ref: '#/components/schemas/CloningInstructionsEnum'
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
         location:
@@ -6214,7 +5350,8 @@ components:
           $ref: '#/components/schemas/ErrorReport'
     CloneControlledGcpGcsBucketRequest:
       description: Values to assign to the cloned bucket for a given source bucket.
-        Leave name and description null to take the source object's values.
+        Leave name, displayName, and description null to take the source object's
+        values.
       type: object
       required:
         - destinationWorkspaceId
@@ -6224,10 +5361,14 @@ components:
           description: ID of workspace to be cloned into
           type: string
           format: uuid
+        destinationFolderId:
+          $ref: '#/components/schemas/FolderId'
         cloningInstructions:
           $ref: '#/components/schemas/CloningInstructionsEnum'
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
         bucketName:
@@ -6255,8 +5396,32 @@ components:
           $ref: '#/components/schemas/JobReport'
         errorReport:
           $ref: '#/components/schemas/ErrorReport'
-    CloneReferencedGcpBigQueryDataTableResourceResult:
-      description: API result class for cloning a referenced BigQuery data table resource.
+    CloneReferencedAwsS3ExternalBucketReferencedResourceResult:
+      description: API result class for cloning a referenced AWS S3 bucket resource.
+        Includes source workspace and resource IDs for provenance. If the effective
+        cloning instructions are not COPY_REFERENCE or LINK_REFERENCE, then no clone
+        is created and the resource is null.
+      type: object
+      required:
+        - effectiveCloningInstructions
+        - sourceWorkspaceId
+        - sourceResourceId
+        - resource
+      properties:
+        effectiveCloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
+        sourceWorkspaceId:
+          description: ID of the workspace of the source resource for this clone
+          type: string
+          format: uuid
+        sourceResourceId:
+          description: ID of the source resource
+          type: string
+          format: uuid
+        resource:
+          $ref: '#/components/schemas/AwsS3ExternalBucketReferenceResource'
+    CloneReferencedAwsS3FolderReferencedResourceResult:
+      description: API result class for cloning a referenced AWS S3 bucket resource.
         Includes source workspace and resource IDs for provenance. If the effective
         cloning instructions are not COPY_REFERENCE, then no clone is created and
         the resource is null.
@@ -6273,9 +5438,9 @@ components:
           type: string
           format: uuid
         resource:
-          $ref: '#/components/schemas/GcpBigQueryDataTableResource'
-    CloneReferencedGcpBigQueryDatasetResourceResult:
-      description: API result class for cloning a referenced BigQuery dataset resource.
+          $ref: '#/components/schemas/AwsS3StorageFolderResource'
+    CloneReferencedGcpBigQueryDataTableResourceResult:
+      description: API result class for cloning a referenced BigQuery data table resource.
         Includes source workspace and resource IDs for provenance. If the effective
         cloning instructions are not COPY_REFERENCE, then no clone is created and
         the resource is null.
@@ -6292,9 +5457,9 @@ components:
           type: string
           format: uuid
         resource:
-          $ref: '#/components/schemas/GcpBigQueryDatasetResource'
-    CloneReferencedGcpDataRepoSnapshotResourceResult:
-      description: API result class for cloning a referenced Data Repo snapshot resource.
+          $ref: '#/components/schemas/GcpBigQueryDataTableResource'
+    CloneReferencedGcpBigQueryDatasetResourceResult:
+      description: API result class for cloning a referenced BigQuery dataset resource.
         Includes source workspace and resource IDs for provenance. If the effective
         cloning instructions are not COPY_REFERENCE, then no clone is created and
         the resource is null.
@@ -6311,7 +5476,7 @@ components:
           type: string
           format: uuid
         resource:
-          $ref: '#/components/schemas/DataRepoSnapshotResource'
+          $ref: '#/components/schemas/GcpBigQueryDatasetResource'
     CloneReferencedGcpGcsBucketResourceResult:
       description: API result class for cloning a referenced GCS Bucket resource.
         Includes source workspace and resource IDs for provenance. If the effective
@@ -6381,6 +5546,10 @@ components:
         destinationWorkspaceId:
           type: string
           format: uuid
+        destinationFolderId:
+          $ref: '#/components/schemas/FolderId'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         name:
           $ref: '#/components/schemas/Name'
         description:
@@ -6401,8 +5570,9 @@ components:
         - spendProfile
       properties:
         destinationWorkspaceId:
-          description: 'Optional identifier for the destination workspace. If not
-            present, a UUID is generated
+          deprecated: true
+          description: 'destinationWorkspaceId cannot be specified on clone workspace
+            request
 
             '
           type: string
@@ -6432,10 +5602,6 @@ components:
 
             '
           $ref: '#/components/schemas/WsmPolicyInputs'
-        projectOwnerGroupId:
-          description: Optional Sam resource group ID which allows the group to be
-            added as project owner on the destination workspace
-          type: string
     CloneWorkspaceResult:
       description: Response for workspace clone, including details on each controlled
         or referenced resource either cloned or attempted to be cloned.
@@ -6447,22 +5613,72 @@ components:
           $ref: '#/components/schemas/ErrorReport'
         workspace:
           $ref: '#/components/schemas/ClonedWorkspace'
-    ClonedControlledAzureStorageContainer:
-      description: Response object for clone of an Azure storage container.
+    CloneWorkspaceV2Request:
+      description: Request body for cloning an entire CRG workspace. Cloning instructions
+        are taken from individual resources.
       type: object
+      required:
+        - organizationId
+        - cloudResourceGroupId
+        - jobControl
       properties:
-        effectiveCloningInstructions:
-          $ref: '#/components/schemas/CloningInstructionsEnum'
-        sourceWorkspaceId:
-          description: ID of the workspace of the source resource for this clone
+        userFacingId:
+          description: Destination workspace user-facing id
+          $ref: '#/components/schemas/UserFacingId'
+        displayName:
+          description: Destination workspace display name
           type: string
-          format: uuid
-        sourceResourceId:
-          description: ID of the source resource
+        description:
+          description: Destination workspace description
           type: string
-          format: uuid
-        storageContainer:
-          $ref: '#/components/schemas/CreatedControlledAzureStorageContainer'
+        organizationId:
+          description: OrganizationId must be provided.
+          $ref: '#/components/schemas/OrganizationUxid'
+        cloudResourceGroupId:
+          description: 'cloudResourceGroupId must be provided. The referenced
+
+            CRG must be contained in the Organization identified by organization id.
+
+            '
+          $ref: '#/components/schemas/CloudResourceGroupUxid'
+        location:
+          description: GCP Location to use for cloud-based resources. If omitted,
+            the location of the source resource will be used.
+          type: string
+        additionalPolicies:
+          description: 'Additional policies to attached to the cloned workspace. If
+            the
+
+            additional policies create a conflict with the existing workspace,
+
+            cloning will fail.
+
+            '
+          $ref: '#/components/schemas/WsmPolicyInputs'
+        additionalProperties:
+          description: 'Additional properties to apply to the cloned workspace. These
+
+            new properties are merged with properties of the source workspace.
+
+            If a new property has the same key as a source property,
+
+            the new property value is used.
+
+            '
+          $ref: '#/components/schemas/Properties'
+        jobControl:
+          $ref: '#/components/schemas/JobControl'
+    CloneWorkspaceV2Result:
+      description: Response for workspace clone, including results for each controlled
+        or referenced resource eligible to be cloned.
+      type: object
+      properties:
+        jobReport:
+          $ref: '#/components/schemas/JobReport'
+        errorReport:
+          $ref: '#/components/schemas/ErrorReport'
+        cloneResult:
+          $ref: '#/components/schemas/ClonedWorkspace'
     ClonedControlledGcpBigQueryDataset:
       description: Response object for clone of a BigQuery dataset. Destination workspace
         and resource IDs are available in the bucket's metadata object.
@@ -6545,6 +5761,13 @@ components:
         - GCP
         - AZURE
         - AWS
+    CloudResourceGroupId:
+      type: string
+      format: uuid
+      description: Unique id of a cloud resource group containing a workspace
+    CloudResourceGroupUxid:
+      type: string
+      description: A UXID representing either a UUID or a UFID
     ControlledDataprocClusterUpdateParameters:
       description: Cluster parameters that can be updated. Cluster lifecycle rules
         can be modified or removed on clusters created with lifecycle rules, though
@@ -6588,15 +5811,22 @@ components:
     ControlledResourceCommonFields:
       type: object
       required:
-        - name
         - cloningInstructions
         - accessScope
         - managedBy
+      description: 'Common information used in all create controlled resource requests.
+        Either displayName or name must be provided.
+
+        '
       properties:
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
+        folderId:
+          $ref: '#/components/schemas/FolderId'
         cloningInstructions:
           $ref: '#/components/schemas/CloningInstructionsEnum'
         accessScope:
@@ -6634,53 +5864,28 @@ components:
 
             '
           type: string
-    CreateAzureLandingZoneRequestBody:
-      description: Payload for requesting a new Azure landing zone.
+    CreateAwsS3ExternalBucketReferenceRequestBody:
       type: object
+      description: A request to create a reference to an AWS S3 External Bucket.
       required:
-        - definition
-        - billingProfileId
+        - metadata
+        - s3ExternalBucket
       properties:
-        landingZoneId:
-          description: The ID of the landing zone (optional). If omitted an ID will
-            be auto-generated.
-          type: string
-          format: uuid
-        definition:
-          description: A definition to create an Azure landing zone from
-          type: string
-        version:
-          description: 'A version of the landing zone. If not set the most recent
-            will be used.
-
-            If two versions available - ''v1'' and ''v2'' then ''v2'' will be selected.
-
-            '
-          type: string
-        parameters:
-          description: List of Azure landing zone parameters
-          type: array
-          items:
-            description: 'Parameters to set user defined properties for resources
-              in a landing zone.
-
-              The parameters vary per landing zone definition.
-
-              Here is a list of some parameters - POSTGRES_SERVER_SKU, POSTGRESQL_SUBNET,
-              VNET_ADDRESS_SPACE.
-
-              These are example of assigned values - POSTGRES_SERVER_SKU=GP_Gen5_2,
-              POSTGRESQL_SUBNET=10.1.0.16/29
-
-              '
-            $ref: '#/components/schemas/AzureLandingZoneParameter'
-        billingProfileId:
-          description: Identifier for the billing profile to be used for this landing
-            zone.
-          type: string
-          format: uuid
-        jobControl:
-          $ref: '#/components/schemas/JobControl'
+        metadata:
+          $ref: '#/components/schemas/ReferenceResourceCommonFields'
+        s3ExternalBucket:
+          $ref: '#/components/schemas/AwsReferencedS3ExternalBucketCreationParameters'
+    CreateAwsS3FolderReferenceRequestBody:
+      type: object
+      description: A request to create a reference to a AWS S3 Folder.
+      required:
+        - metadata
+        - s3folder
+      properties:
+        metadata:
+          $ref: '#/components/schemas/ReferenceResourceCommonFields'
+        s3folder:
+          $ref: '#/components/schemas/AwsReferencedS3FolderCreationParameters'
     CreateCloudContextRequest:
       type: object
       required:
@@ -6693,9 +5898,6 @@ components:
 
         For GCP, a project is created to contain the cloud resources of the context.
 
-        For Azure, a managed resource group (MRG) is created outside of WSM within
-        a tenant
-
         and a subscription obtained from the spend profile linked to the parent workspace.
 
         '
@@ -6709,8 +5911,8 @@ components:
       description: 'The result of a call to create a cloud context for a workspace.
         Contains
 
-        a JobReport detailing the async operation, and either a GcpContext, AzureContext
-        or AwsContext (if operation complete)
+        a JobReport detailing the async operation, and either a GcpContext or AwsContext
+        (if operation complete)
 
         or an ErrorReport detailing an error.
 
@@ -6720,14 +5922,50 @@ components:
       properties:
         jobReport:
           $ref: '#/components/schemas/JobReport'
-        gcpContext:
-          $ref: '#/components/schemas/GcpContext'
-        azureContext:
-          $ref: '#/components/schemas/AzureContext'
-        awsContext:
-          $ref: '#/components/schemas/AwsContext'
+        gcpContext:
+          $ref: '#/components/schemas/GcpContext'
+        awsContext:
+          $ref: '#/components/schemas/AwsContext'
+        errorReport:
+          $ref: '#/components/schemas/ErrorReport'
+    CreateControlledAwsEc2InstanceRequestBody:
+      description: Payload for requesting a new controlled AWS EC2 Virtual Machine
+        instance resource.
+      type: object
+      required:
+        - common
+        - awsEc2Instance
+        - jobControl
+      properties:
+        common:
+          $ref: '#/components/schemas/ControlledResourceCommonFields'
+        awsEc2Instance:
+          $ref: '#/components/schemas/AwsEc2InstanceCreationParameters'
+        jobControl:
+          $ref: '#/components/schemas/JobControl'
+    CreateControlledAwsEc2InstanceResult:
+      description: Response Payload for requesting a new controlled AWS EC2 Virtual
+        Machine instance resource.
+      type: object
+      properties:
+        jobReport:
+          $ref: '#/components/schemas/JobReport'
         errorReport:
           $ref: '#/components/schemas/ErrorReport'
+        awsEc2Instance:
+          $ref: '#/components/schemas/AwsEc2InstanceResource'
+    CreateControlledAwsS3ExternalBucketRequestBody:
+      description: Payload for requesting a new controlled externally-managed AWS
+        S3 Storage Bucket resource.
+      type: object
+      required:
+        - common
+        - awsS3ExternalBucket
+      properties:
+        common:
+          $ref: '#/components/schemas/ControlledResourceCommonFields'
+        awsS3ExternalBucket:
+          $ref: '#/components/schemas/AwsS3ExternalBucketCreationParameters'
     CreateControlledAwsS3StorageFolderRequestBody:
       description: Payload for requesting a new controlled AWS S3 Storage Folder resource.
       type: object
@@ -6765,78 +6003,6 @@ components:
           $ref: '#/components/schemas/ErrorReport'
         awsSageMakerNotebook:
           $ref: '#/components/schemas/AwsSageMakerNotebookResource'
-    CreateControlledAzureBatchPoolRequestBody:
-      description: Payload for requesting a new controlled Azure Batch Pool resource.
-      type: object
-      required:
-        - common
-        - azureBatchPool
-      properties:
-        common:
-          $ref: '#/components/schemas/ControlledResourceCommonFields'
-        azureBatchPool:
-          $ref: '#/components/schemas/AzureBatchPoolCreationParameters'
-    CreateControlledAzureDatabaseRequestBody:
-      description: Payload for requesting a new controlled Azure Database resource.
-      type: object
-      properties:
-        common:
-          $ref: '#/components/schemas/ControlledResourceCommonFields'
-        azureDatabase:
-          $ref: '#/components/schemas/AzureDatabaseCreationParameters'
-        jobControl:
-          $ref: '#/components/schemas/JobControl'
-    CreateControlledAzureDiskRequestBody:
-      description: Payload for requesting a new controlled Azure Disk resource.
-      type: object
-      properties:
-        common:
-          $ref: '#/components/schemas/ControlledResourceCommonFields'
-        azureDisk:
-          $ref: '#/components/schemas/AzureDiskCreationParameters'
-    CreateControlledAzureKubernetesNamespaceRequestBody:
-      description: Payload for requesting a new controlled Azure KubernetesNamespace
-        resource.
-      type: object
-      properties:
-        common:
-          $ref: '#/components/schemas/ControlledResourceCommonFields'
-        azureKubernetesNamespace:
-          $ref: '#/components/schemas/AzureKubernetesNamespaceCreationParameters'
-        jobControl:
-          $ref: '#/components/schemas/JobControl'
-    CreateControlledAzureManagedIdentityRequestBody:
-      description: Payload for requesting a new controlled Azure Managed Identity
-        resource.
-      type: object
-      properties:
-        common:
-          $ref: '#/components/schemas/ControlledResourceCommonFields'
-        azureManagedIdentity:
-          $ref: '#/components/schemas/AzureManagedIdentityCreationParameters'
-    CreateControlledAzureStorageContainerRequestBody:
-      description: Payload for requesting a new controlled Azure storage container
-        resource.
-      type: object
-      properties:
-        common:
-          $ref: '#/components/schemas/ControlledResourceCommonFields'
-        azureStorageContainer:
-          $ref: '#/components/schemas/AzureStorageContainerCreationParameters'
-    CreateControlledAzureVmRequestBody:
-      description: Payload for requesting a new controlled Azure VM resource.
-      type: object
-      required:
-        - common
-        - azureVm
-        - jobControl
-      properties:
-        common:
-          $ref: '#/components/schemas/ControlledResourceCommonFields'
-        azureVm:
-          $ref: '#/components/schemas/AzureVmCreationParameters'
-        jobControl:
-          $ref: '#/components/schemas/JobControl'
     CreateControlledFlexibleResourceRequestBody:
       description: Payload for requesting a new controlled flexible resource.
       type: object
@@ -6912,17 +6078,6 @@ components:
           $ref: '#/components/schemas/ControlledResourceCommonFields'
         gcsBucket:
           $ref: '#/components/schemas/GcpGcsBucketCreationParameters'
-    CreateDataRepoSnapshotReferenceRequestBody:
-      type: object
-      description: A request to create a reference to a Data Repo snapshot.
-      required:
-        - metadata
-        - snapshot
-      properties:
-        metadata:
-          $ref: '#/components/schemas/ReferenceResourceCommonFields'
-        snapshot:
-          $ref: '#/components/schemas/DataRepoSnapshotAttributes'
     CreateFolderRequestBody:
       type: object
       required:
@@ -6998,24 +6153,15 @@ components:
           $ref: '#/components/schemas/ReferenceResourceCommonFields'
         gitrepo:
           $ref: '#/components/schemas/GitRepoAttributes'
-    CreateLandingZoneResult:
-      description: Result of starting an async job to create an Azure landing zone
+    CreateNatGatewayRequestBody:
+      description: Request payload for creating a NAT Gateway.
       type: object
+      required:
+        - region
       properties:
-        landingZoneId:
-          description: An identifier of the Azure landing zone.
-          type: string
-          format: uuid
-        definition:
-          description: Requested landing zone definition.
-          type: string
-        version:
-          description: Requested version of the landing zone definition.
+        region:
+          description: Region to create the NAT Gateway in.
           type: string
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
     CreateTerraWorkspaceReferenceRequestBody:
       type: object
       description: A request to create a reference to a Terra workspace
@@ -7027,41 +6173,6 @@ components:
           $ref: '#/components/schemas/ReferenceResourceCommonFields'
         referencedWorkspace:
           $ref: '#/components/schemas/TerraWorkspaceAttributes'
-    CreateWorkspaceRequestBody:
-      type: object
-      required:
-        - id
-      properties:
-        id:
-          description: The ID of the workspace
-          type: string
-          format: uuid
-        userFacingId:
-          $ref: '#/components/schemas/UserFacingId'
-        displayName:
-          description: The human readable name of the workspace
-          type: string
-        description:
-          description: A description of the workspace
-          type: string
-        spendProfile:
-          description: ID of provided spend profile
-          type: string
-        policies:
-          $ref: '#/components/schemas/WsmPolicyInputs'
-        stage:
-          $ref: '#/components/schemas/WorkspaceStageModel'
-        properties:
-          $ref: '#/components/schemas/Properties'
-        applicationIds:
-          description: List of application ids to enable for this workspace
-          type: array
-          items:
-            type: string
-        projectOwnerGroupId:
-          description: Optional Sam resource group ID which allows the group to be
-            added as project owner on the workspace
-          type: string
     CreateWorkspaceV2Request:
       type: object
       required:
@@ -7091,12 +6202,34 @@ components:
           type: array
           items:
             type: string
+        organizationId:
+          description: If stage is CRG, organizationId must be provided.
+          $ref: '#/components/schemas/OrganizationUxid'
+        cloudResourceGroupId:
+          description: 'If stage is CRG, cloudResourceGroupId must be provided. The
+            referenced
+
+            pod must be contained in the Organization identified by organization id.
+
+            '
+          $ref: '#/components/schemas/CloudResourceGroupUxid'
         cloudPlatform:
-          description: Optional cloud platform for the cloud context to create within
-            the workspace
+          description: 'Optional cloud platform for the cloud context to create within
+            the workspace.
+
+            If stage is CRG, cloudPlatform may not be specified.
+
+            '
           $ref: '#/components/schemas/CloudPlatform'
+        region:
+          description: Optional valid region for the cloud platform
+          type: string
         spendProfile:
-          description: ID of the spend profile for the cloud context, if any
+          description: 'ID of the spend profile for the cloud context, if any.
+
+            If stage is CRG, spendProfile may not be specified.
+
+            '
           type: string
         jobControl:
           $ref: '#/components/schemas/JobControl'
@@ -7111,15 +6244,20 @@ components:
         workspaceId:
           type: string
           format: uuid
-    CreatedAzureStorageContainerSasToken:
-      description: Response payload for requesting a SAS token to access an Azure
-        storage container
+    CreatedControlledAwsS3ExternalBucket:
+      description: Response Payload for requesting a new controlled externally-managed
+        AWS S3 Storage Bucket resource.
       type: object
+      required:
+        - resourceId
+        - awsS3ExternalBucket
       properties:
-        token:
-          type: string
-        url:
+        resourceId:
+          description: UUID of a newly-created resource.
           type: string
+          format: uuid
+        awsS3ExternalBucket:
+          $ref: '#/components/schemas/AwsS3ExternalBucketResource'
     CreatedControlledAwsS3StorageFolder:
       description: Response Payload for requesting a new controlled AWS S3 Storage
         Folder resource.
@@ -7134,84 +6272,6 @@ components:
           format: uuid
         awsS3StorageFolder:
           $ref: '#/components/schemas/AwsS3StorageFolderResource'
-    CreatedControlledAzureBatchPool:
-      description: Response payload for requesting a new Azure Batch Pool
-      type: object
-      properties:
-        resourceId:
-          description: UUID of a newly-created resource.
-          type: string
-          format: uuid
-        azureBatchPool:
-          $ref: '#/components/schemas/AzureBatchPoolResource'
-    CreatedControlledAzureDatabaseResult:
-      description: Response payload for requesting a new Azure database
-      type: object
-      properties:
-        resourceId:
-          description: UUID of a newly-created resource.
-          type: string
-          format: uuid
-        azureDatabase:
-          $ref: '#/components/schemas/AzureDatabaseResource'
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
-    CreatedControlledAzureDisk:
-      description: Response payload for requesting a new Azure disk
-      type: object
-      properties:
-        resourceId:
-          description: UUID of a newly-created resource.
-          type: string
-          format: uuid
-        azureDisk:
-          $ref: '#/components/schemas/AzureDiskResource'
-    CreatedControlledAzureKubernetesNamespaceResult:
-      description: Response payload for requesting a new Azure kubernetesNamespace
-      type: object
-      properties:
-        resourceId:
-          description: UUID of a newly-created resource.
-          type: string
-          format: uuid
-        azureKubernetesNamespace:
-          $ref: '#/components/schemas/AzureKubernetesNamespaceResource'
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
-    CreatedControlledAzureManagedIdentity:
-      description: Response payload for requesting a new Azure Managed Identity
-      type: object
-      properties:
-        resourceId:
-          description: UUID of a newly-created resource.
-          type: string
-          format: uuid
-        azureManagedIdentity:
-          $ref: '#/components/schemas/AzureManagedIdentityResource'
-    CreatedControlledAzureStorageContainer:
-      description: Response payload for requesting a new Azure storage container
-      type: object
-      properties:
-        resourceId:
-          description: UUID of a newly-created resource.
-          type: string
-          format: uuid
-        azureStorageContainer:
-          $ref: '#/components/schemas/AzureStorageContainerResource'
-    CreatedControlledAzureVmResult:
-      description: Api result class for creating an azure vm
-      type: object
-      properties:
-        azureVm:
-          $ref: '#/components/schemas/AzureVmResource'
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
     CreatedControlledFlexibleResource:
       description: Response payload for requesting a new controlled flexible resource.
       type: object
@@ -7287,31 +6347,6 @@ components:
           description: UUID of a newly-created workspace
           type: string
           format: uuid
-    DataRepoSnapshotAttributes:
-      description: Attributes of a data repository snapshot
-      type: object
-      required:
-        - instanceName
-        - snapshot
-      properties:
-        instanceName:
-          description: The name of the Data Repo instance
-          type: string
-        snapshot:
-          description: The ID of the Data Repo snapshot
-          type: string
-    DataRepoSnapshotResource:
-      type: object
-      description: A Data Repo snapshot resource
-      required:
-        - metadata
-        - attributes
-      properties:
-        metadata:
-          description: the resource metadata common to all resources
-          $ref: '#/components/schemas/ResourceMetadata'
-        attributes:
-          $ref: '#/components/schemas/DataRepoSnapshotAttributes'
     DataprocClusterCloudId:
       description: Dataproc cluster cloud native ID
       type: object
@@ -7329,41 +6364,6 @@ components:
       description: Optional. Default lifetime (in seconds) for newly created tables.
       type: integer
       format: int64
-    DeleteAzureLandingZoneJobResult:
-      description: Result of delete job for an Azure landing zone
-      type: object
-      properties:
-        landingZoneId:
-          type: string
-          format: uuid
-        resources:
-          description: A list of resource IDs of the deleted resources.
-          type: array
-          items:
-            type: string
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
-    DeleteAzureLandingZoneRequestBody:
-      description: Payload for deleting an Azure landing zone.
-      type: object
-      required:
-        - jobControl
-      properties:
-        jobControl:
-          $ref: '#/components/schemas/JobControl'
-    DeleteAzureLandingZoneResult:
-      description: Result of starting a job to delete an Azure landing zone
-      type: object
-      properties:
-        landingZoneId:
-          type: string
-          format: uuid
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
     DeleteCloudContextV2Request:
       type: object
       required:
@@ -7382,6 +6382,10 @@ components:
       properties:
         jobControl:
           $ref: '#/components/schemas/JobControl'
+        forceDelete:
+          description: Attempt to force delete the resource
+          type: boolean
+          default: false
     DeleteControlledAwsResourceResult:
       type: object
       properties:
@@ -7389,20 +6393,6 @@ components:
           $ref: '#/components/schemas/JobReport'
         errorReport:
           $ref: '#/components/schemas/ErrorReport'
-    DeleteControlledAzureResourceRequest:
-      type: object
-      required:
-        - jobControl
-      properties:
-        jobControl:
-          $ref: '#/components/schemas/JobControl'
-    DeleteControlledAzureResourceResult:
-      type: object
-      properties:
-        jobReport:
-          $ref: '#/components/schemas/JobReport'
-        errorReport:
-          $ref: '#/components/schemas/ErrorReport'
     DeleteControlledGcpAiNotebookInstanceRequest:
       type: object
       required:
@@ -7469,12 +6459,8 @@ components:
       properties:
         jobControl:
           $ref: '#/components/schemas/JobControl'
-    DynamicVNetAssignmentScope:
-      description: Defines values for AutoUserScope.
+    DisplayName:
       type: string
-      enum:
-        - none
-        - job
     EnumerateJobsResult:
       description: result of an enumerateJobs request
       type: object
@@ -7792,8 +6778,8 @@ components:
         id are fixed upon create.
       properties:
         metadata:
-          description: 'A map of custom metadata to apply to this instance. Some metadata  keys
-            are reserved by Terra and will throw a bad request error if  specified:
+          description: 'A map of custom metadata to apply to this instance. Some metadata
+            keys are reserved by Terra and will throw a bad request error if specified:
             ''proxy-mode'', ''terra-workspace-id'', ''terra-cli-server''.'
           type: object
           additionalProperties:
@@ -7963,12 +6949,6 @@ components:
           additionalProperties:
             type: string
           description: Map of additional properties to set on the cluster. See https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/cluster-properties.
-        softwareFramework:
-          type: string
-          enum:
-            - HAIL
-          description: Software framework to setup the cluster with. Currently supported
-            values are ['hail'].
         configBucket:
           type: string
           format: uuid
@@ -8170,8 +7150,8 @@ components:
       description: Parameters that may be changed by a user.
       properties:
         metadata:
-          description: 'A map of custom metadata to apply to this instance. Some metadata  keys
-            are reserved by Terra and will throw a bad request error if  specified:
+          description: 'A map of custom metadata to apply to this instance. Some metadata
+            keys are reserved by Terra and will throw a bad request error if specified:
             ''terra-workspace-id'', ''terra-cli-server''.'
           type: object
           additionalProperties:
@@ -8429,6 +7409,9 @@ components:
       properties:
         memberEmail:
           type: string
+        notifyMember:
+          type: boolean
+          default: false
     IamRole:
       description: Enum containing all valid IAM roles on a Workspace
       type: string
@@ -8438,55 +7421,8 @@ components:
         - WRITER
         - APPLICATION
         - OWNER
-        - PROJECT_OWNER
-    InboundEndpointProtocol:
-      description: The protocol of the endpoint.
-      type: string
-      enum:
-        - TCP
-        - UDP
-    InboundNatPool:
-      description: 'A list of inbound NAT pools that can be used to address specific
-        ports on an individual compute node externally.
-
-        '
-      properties:
-        name:
-          description: The name of the endpoint.
-          type: string
-        protocol:
-          description: The protocol of the endpoint.
-          $ref: '#/components/schemas/InboundEndpointProtocol'
-        backendPort:
-          description: The port number on the compute node.
-          type: integer
-        frontendPortRangeStart:
-          description: "The first port number in the range of external ports that\
-            \ will be used to provide inbound access \nto the backendPort on individual\
-            \ compute nodes.\n"
-          type: integer
-        frontendPortRangeEnd:
-          description: "The last port number in the range of external ports that will\
-            \ be used to provide inbound access \nto the backendPort on individual\
-            \ compute nodes.\n"
-          type: integer
-        networkSecurityGroupRules:
-          description: 'A list of network security group rules that will be applied
-            to the endpoint.
-
-            '
-          type: array
-          items:
-            $ref: '#/components/schemas/NetworkSecurityGroupRule'
-    IpAddressProvisioningType:
-      description: 'Defines values for IpAddressProvisioningType.
-
-        '
-      type: string
-      enum:
-        - BatchManaged
-        - UserManaged
-        - NoPublicIPAddresses
+        - PROJECT_OWNER
+        - SUPPORT
     JobControl:
       type: object
       required:
@@ -8585,42 +7521,6 @@ components:
     Name:
       type: string
       pattern: ^[a-zA-Z0-9][-_a-zA-Z0-9]{0,1023}$
-    NetworkSecurityGroupRule:
-      description: 'A network security group rule to apply to an inbound endpoint.
-
-        '
-      type: object
-      properties:
-        priority:
-          description: The priority for this rule.
-          type: integer
-        access:
-          description: 'The action that should be taken for a specified IP address,
-            subnet range or tag.
-
-            '
-          $ref: '#/components/schemas/NetworkSecurityGroupRuleAccess'
-        sourceAddressPrefix:
-          description: 'The source address prefix or tag to match for the rule.
-
-            '
-          type: string
-        sourcePortRanges:
-          description: 'The source port ranges to match for the rule.
-
-            '
-          type: array
-          items:
-            type: string
-    NetworkSecurityGroupRuleAccess:
-      description: 'The action that should be taken for a specified IP address, subnet
-        range or tag.
-
-        '
-      type: string
-      enum:
-        - Allow
-        - Deny
     OperationState:
       type: object
       description: Common operation state properties for cloud context and workspaces
@@ -8649,16 +7549,14 @@ components:
         - ADMIN_UPDATE
         - DATA_TRANSFER
         - UNKNOWN
-    PoolEndpointConfiguration:
-      description: The endpoint configuration for a pool.
-      type: object
-      properties:
-        inboundNatPools:
-          description: "A list of inbound NAT pools that can be used to address specific\
-            \ ports \non an individual compute node externally.\n"
-          type: array
-          items:
-            $ref: '#/components/schemas/InboundNatPool'
+    OrganizationId:
+      type: string
+      format: uuid
+      description: Unique id of the organization containing the CRG containing the
+        workspace
+    OrganizationUxid:
+      type: string
+      description: A UXID representing either a UUID or a UFID
     PrivateResourceState:
       description: The possible states of ownership of a private resource. When a
         resource is abandoned, the assigned user loses permission to access it.
@@ -8707,52 +7605,94 @@ components:
           description: Arbitrary string value
           type: string
     PropertyKeys:
-      description: A list of property keys that in the properties
+      description: A list of string keys used for properties
       type: array
       items:
         type: string
-    PublicIpAddressConfiguration:
-      description: 'The public IP Address configuration of the networking configuration
-        of a Pool.
-
-        '
-      type: object
-      properties:
-        provision:
-          description: 'The provisioning type for Public IP Addresses for the Batch
-            Pool.
-
-            '
-          $ref: '#/components/schemas/IpAddressProvisioningType'
-        ipAddressIds:
-          description: 'The list of public IPs which the Batch service will use when
-            provisioning Compute Nodes.
-
-            '
-          type: array
-          items:
-            type: string
     ReferenceResourceCommonFields:
       type: object
       required:
-        - name
         - cloningInstructions
-      description: Common information used in all reference requests
+      description: 'Common information used in all create referenced resource requests.
+        Either displayName or name must be provided.
+
+        '
       properties:
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
+        folderId:
+          $ref: '#/components/schemas/FolderId'
         properties:
           $ref: '#/components/schemas/Properties'
         cloningInstructions:
           $ref: '#/components/schemas/CloningInstructionsEnum'
+    ReferencedResourceMetadata:
+      type: object
+      properties:
+        resolvedAccess:
+          $ref: '#/components/schemas/ResolvedResourceAccessLevel'
+        resolvedAttributes:
+          $ref: '#/components/schemas/ResolvedResourceAttributesUnion'
     Regions:
       type: array
       description: List of regions (e.g. us-central1, us-west1)
       items:
         uniqueItems: true
         type: string
+    ResolvedAwsS3ExternalBucketAttributes:
+      description: Attributes containing the
+      type: object
+      required:
+        - bucketName
+        - tags
+      properties:
+        bucketName:
+          description: The name of the underlying bucket associated with this resource.
+          type: string
+        prefix:
+          description: Optional prefix path within the bucket.
+          type: string
+        tags:
+          description: IAM tags needed for this resource
+          type: object
+          additionalProperties:
+            type: string
+    ResolvedResource:
+      type: object
+      description: 'A description of a referenced resource and the caller''s access
+        on its underlying resource.
+
+        '
+      properties:
+        id:
+          description: The ID of the resource.
+          type: string
+          format: uuid
+        resourceType:
+          $ref: '#/components/schemas/ResourceType'
+        accessLevel:
+          $ref: '#/components/schemas/ResolvedResourceAccessLevel'
+        attributes:
+          $ref: '#/components/schemas/ResolvedResourceAttributesUnion'
+    ResolvedResourceAccessLevel:
+      description: Enum containing valid access levels.
+      type: string
+      enum:
+        - WRITER
+        - READER
+        - NONE
+    ResolvedResourceAttributesUnion:
+      type: object
+      description: 'Union of resolved resource attributes.
+
+        '
+      properties:
+        awsS3ExternalBucket:
+          $ref: '#/components/schemas/ResolvedAwsS3ExternalBucketAttributes'
     ResourceAttributesUnion:
       type: object
       description: 'This object is a union of reference to each resource type''s attributes.
@@ -8767,8 +7707,6 @@ components:
           $ref: '#/components/schemas/GcpBigQueryDatasetAttributes'
         gcpBqDataTable:
           $ref: '#/components/schemas/GcpBigQueryDataTableAttributes'
-        gcpDataRepoSnapshot:
-          $ref: '#/components/schemas/DataRepoSnapshotAttributes'
         gcpDataprocCluster:
           $ref: '#/components/schemas/GcpDataprocClusterAttributes'
         gcpGceInstance:
@@ -8779,24 +7717,16 @@ components:
           $ref: '#/components/schemas/GcpGcsObjectAttributes'
         gcpAiNotebookInstance:
           $ref: '#/components/schemas/GcpAiNotebookInstanceAttributes'
-        azureKubernetesNamespace:
-          $ref: '#/components/schemas/AzureKubernetesNamespaceAttributes'
-        azureManagedIdentity:
-          $ref: '#/components/schemas/AzureManagedIdentityAttributes'
-        azureDatabase:
-          $ref: '#/components/schemas/AzureDatabaseAttributes'
-        azureDisk:
-          $ref: '#/components/schemas/AzureDiskAttributes'
-        azureStorageContainer:
-          $ref: '#/components/schemas/AzureStorageContainerAttributes'
-        azureVm:
-          $ref: '#/components/schemas/AzureVmAttributes'
-        azureBatchPool:
-          $ref: '#/components/schemas/AzureBatchPoolAttributes'
+        awsS3ExternalBucket:
+          $ref: '#/components/schemas/AwsS3ExternalBucketAttributes'
+        awsS3ExternalBucketReference:
+          $ref: '#/components/schemas/AwsS3ExternalBucketReferenceAttributes'
         awsS3StorageFolder:
           $ref: '#/components/schemas/AwsS3StorageFolderAttributes'
         awsSageMakerNotebook:
           $ref: '#/components/schemas/AwsSageMakerNotebookAttributes'
+        awsEc2Instance:
+          $ref: '#/components/schemas/AwsEc2InstanceAttributes'
         gitRepo:
           $ref: '#/components/schemas/GitRepoAttributes'
         terraWorkspace:
@@ -8822,6 +7752,8 @@ components:
           description: resource ID of the cloned resource, or null if failed or skipped
           type: string
           format: uuid
+        destinationFolderId:
+          $ref: '#/components/schemas/FolderId'
         result:
           $ref: '#/components/schemas/CloneResourceResult'
         errorMessage:
@@ -8830,6 +7762,9 @@ components:
         name:
           description: name of the resource (same as source)
           type: string
+        displayName:
+          description: display name of the resource (same as source)
+          type: string
         description:
           description: description of the destination resource (same as source)
           type: string
@@ -8846,6 +7781,25 @@ components:
           description: Data specific to the type of resource and whether it is controlled
             or not
           $ref: '#/components/schemas/ResourceAttributesUnion'
+    ResourceFilterByAssignedUser:
+      type: object
+      required:
+        - userName
+      properties:
+        userName:
+          description: Username of a assigned user to filter resources
+          type: string
+        offset:
+          description: The number of items to skip before starting to collect the
+            result set.
+          type: integer
+          minimum: 0
+          default: 0
+        limit:
+          description: The maximum number of items to return
+          type: integer
+          minimum: 1
+          default: 100
     ResourceLineage:
       type: array
       items:
@@ -8894,8 +7848,12 @@ components:
           format: uuid
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
+        folderId:
+          $ref: '#/components/schemas/FolderId'
         resourceType:
           $ref: '#/components/schemas/ResourceType'
         stewardshipType:
@@ -8907,6 +7865,9 @@ components:
         controlledResourceMetadata:
           description: Present if stewardship type is CONTROLLED
           $ref: '#/components/schemas/ControlledResourceMetadata'
+        referencedResourceMetadata:
+          description: Present if stewardship type is REFERENCED
+          $ref: '#/components/schemas/ReferencedResourceMetadata'
         resourceLineage:
           $ref: '#/components/schemas/ResourceLineage'
         properties:
@@ -8931,24 +7892,6 @@ components:
           $ref: '#/components/schemas/ErrorReport'
         jobId:
           type: string
-    ResourceQuota:
-      description: Resource quota information of an Azure landing zone resource.
-      type: object
-      properties:
-        landingZoneId:
-          description: An identifier of the Azure landing zone.
-          type: string
-          format: uuid
-        azureResourceId:
-          description: The fully qualified ID of the Azure resource.
-          type: string
-        resourceType:
-          description: Azure resource type.
-          type: string
-        quotaValues:
-          description: A key-value pair of quota information values for the resource.
-          type: object
-          additionalProperties: true
     ResourceType:
       description: Enum containing valid resource types. Used for enumeration
       type: string
@@ -8956,20 +7899,15 @@ components:
         - AI_NOTEBOOK
         - BIG_QUERY_DATASET
         - BIG_QUERY_DATA_TABLE
-        - DATA_REPO_SNAPSHOT
         - GCE_INSTANCE
         - GCS_BUCKET
         - GCS_OBJECT
         - DATAPROC_CLUSTER
-        - AZURE_KUBERNETES_NAMESPACE
-        - AZURE_MANAGED_IDENTITY
-        - AZURE_DATABASE
-        - AZURE_DISK
-        - AZURE_VM
-        - AZURE_STORAGE_CONTAINER
-        - AZURE_BATCH_POOL
+        - AWS_S3_EXTERNAL_BUCKET
+        - AWS_S3_EXTERNAL_BUCKET_REFERENCE
         - AWS_S3_STORAGE_FOLDER
         - AWS_SAGEMAKER_NOTEBOOK
+        - AWS_EC2_INSTANCE
         - GIT_REPO
         - TERRA_WORKSPACE
         - FLEXIBLE_RESOURCE
@@ -8988,8 +7926,6 @@ components:
           $ref: '#/components/schemas/GcpBigQueryDatasetResource'
         gcpBqDataTable:
           $ref: '#/components/schemas/GcpBigQueryDataTableResource'
-        gcpDataRepoSnapshot:
-          $ref: '#/components/schemas/DataRepoSnapshotResource'
         gcpDataprocCluster:
           $ref: '#/components/schemas/GcpDataprocClusterResource'
         gcpGceInstance:
@@ -9000,14 +7936,10 @@ components:
           $ref: '#/components/schemas/GcpGcsObjectResource'
         gcpAiNotebookInstance:
           $ref: '#/components/schemas/GcpAiNotebookInstanceResource'
-        azureDisk:
-          $ref: '#/components/schemas/AzureDiskResource'
-        azureVm:
-          $ref: '#/components/schemas/AzureVmResource'
-        azureStorageContainer:
-          $ref: '#/components/schemas/AzureStorageContainerResource'
-        azureBatchPool:
-          $ref: '#/components/schemas/AzureBatchPoolResource'
+        awsS3ExternalBucket:
+          $ref: '#/components/schemas/AwsS3ExternalBucketResource'
+        awsS3ExternalBucketReference:
+          $ref: '#/components/schemas/AwsS3ExternalBucketReferenceResource'
         awsS3StorageFolder:
           $ref: '#/components/schemas/AwsS3StorageFolderResource'
         awsSageMakerNotebook:
@@ -9105,8 +8037,12 @@ components:
       properties:
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
         projectId:
           type: string
         datasetId:
@@ -9120,14 +8056,79 @@ components:
       properties:
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
         projectId:
           type: string
         datasetId:
           type: string
         cloningInstructions:
           $ref: '#/components/schemas/CloningInstructionsEnum'
+    UpdateCommonResourceMetadataBody:
+      type: object
+      properties:
+        name:
+          description: New name to give to this resource. Will not be updated if this
+            is omitted.
+          $ref: '#/components/schemas/Name'
+        displayName:
+          description: New display name to give to this resource. Will not be updated
+            if this is omitted.
+          $ref: '#/components/schemas/DisplayName'
+        description:
+          description: New description to give to this resource. Will not be updated
+            if this is omitted.
+          type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
+        cloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
+        updateProperties:
+          $ref: '#/components/schemas/Properties'
+        deleteProperties:
+          $ref: '#/components/schemas/PropertyKeys'
+    UpdateControlledAwsEc2InstanceRequestBody:
+      type: object
+      description: Update an AWS EC2 Virtual Machine resource's metadata.
+      properties:
+        name:
+          description: Optional. New name to give to this resource. The resource name
+            will not be updated if this is omitted.
+          type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
+        description:
+          description: Optional. New description to give to this resource. The resource
+            description will not be updated if this is omitted.
+          type: string
+    UpdateControlledAwsS3ExternalBucketRequestBody:
+      type: object
+      description: Update an AWS S3 Storage folder's metadata.
+      properties:
+        name:
+          description: Optional. New name to give to this resource. The resource name
+            will not be updated if this is omitted.
+          type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
+        description:
+          description: Optional. New description to give to this resource. The resource
+            description will not be updated if this is omitted.
+          type: string
+        cloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
+        updateParameters:
+          $ref: '#/components/schemas/AwsS3ExternalBucketUpdateParameters'
     UpdateControlledAwsS3StorageFolderRequestBody:
       type: object
       description: Update an AWS S3 Storage folder's metadata.
@@ -9136,10 +8137,18 @@ components:
           description: Optional. New name to give to this resource. The resource name
             will not be updated if this is omitted.
           type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
         description:
           description: Optional. New description to give to this resource. The resource
             description will not be updated if this is omitted.
           type: string
+        cloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
     UpdateControlledAwsSageMakerNotebookRequestBody:
       type: object
       description: Update an AWS SageMaker Notebook resource's metadata.
@@ -9148,6 +8157,10 @@ components:
           description: Optional. New name to give to this resource. The resource name
             will not be updated if this is omitted.
           type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
         description:
           description: Optional. New description to give to this resource. The resource
             description will not be updated if this is omitted.
@@ -9162,10 +8175,16 @@ components:
           description: Optional. New name to give to this resource. The resource name
             will not be updated if this is omitted.
           type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
         description:
           description: Optional. New description to give to this resource. The resource
             description will not be updated if this is omitted.
           type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
         updateParameters:
           $ref: '#/components/schemas/FlexibleResourceUpdateParameters'
     UpdateControlledGcpAiNotebookInstanceRequestBody:
@@ -9176,6 +8195,10 @@ components:
           description: Optional. New name to give to this resource. The resource name
             will not be updated if this is omitted.
           type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
         description:
           description: Optional. New description to give to this resource. The resource
             description will not be updated if this is omitted.
@@ -9190,10 +8213,16 @@ components:
           description: Optional. New name to give to this resource. The resource name
             will not be updated if this is omitted.
           type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
         description:
           description: Optional. New description to give to this resource. The resource
             description will not be updated if this is omitted.
           type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
         updateParameters:
           $ref: '#/components/schemas/GcpBigQueryDatasetUpdateParameters'
     UpdateControlledGcpDataprocClusterRequestBody:
@@ -9204,6 +8233,10 @@ components:
           description: Optional. New name to give to this resource. The resource name
             will not be updated if this is omitted.
           type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
         description:
           description: Optional. New description to give to this resource. The resource
             description will not be updated if this is omitted.
@@ -9218,6 +8251,10 @@ components:
           description: Optional. New name to give to this resource. The resource name
             will not be updated if this is omitted.
           type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
         description:
           description: Optional. New description to give to this resource. The resource
             description will not be updated if this is omitted.
@@ -9232,27 +8269,30 @@ components:
           description: Optional. New name to give to this resource. The resource name
             will not be updated if this is omitted.
           type: string
+        displayName:
+          description: Optional. New display name to give to this resource. The display
+            name will not be updated if this is omitted.
+          type: string
         description:
           description: Optional. New description to give to this resource. The resource
             description will not be updated if this is omitted.
           type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
         updateParameters:
           $ref: '#/components/schemas/GcpGcsBucketUpdateParameters'
-    UpdateDataRepoSnapshotReferenceRequestBody:
+    UpdateFolderId:
       type: object
+      description: 'Whether to update the folderId. If omitted, the folderId will
+        not be updated,
+
+        if defined but child property folderId is not provided, then the request is
+        to unset the folderId.
+
+        '
       properties:
-        name:
-          $ref: '#/components/schemas/Name'
-        description:
-          type: string
-        instanceName:
-          description: The name of the Data Repo instance
-          type: string
-        snapshot:
-          description: The ID of the Data Repo snapshot
-          type: string
-        cloningInstructions:
-          $ref: '#/components/schemas/CloningInstructionsEnum'
+        folderId:
+          $ref: '#/components/schemas/FolderId'
     UpdateFolderRequestBody:
       type: object
       properties:
@@ -9278,8 +8318,12 @@ components:
       properties:
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
         bucketName:
           description: Name of created bucket (not the resource name).
           type: string
@@ -9295,8 +8339,12 @@ components:
       properties:
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
         bucketName:
           description: Name of created bucket (not the resource name).
           type: string
@@ -9307,6 +8355,8 @@ components:
       properties:
         name:
           $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
         description:
           type: string
         gitRepoUrl:
@@ -9314,6 +8364,42 @@ components:
           type: string
         cloningInstructions:
           $ref: '#/components/schemas/CloningInstructionsEnum'
+    UpdateS3ExternalBucketReferenceRequestBody:
+      type: object
+      description: Fields updatable on an S3 folder. Leave properties null to keep
+        them the same.
+      properties:
+        name:
+          $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
+        description:
+          type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
+        cloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
+    UpdateS3FolderReferenceRequestBody:
+      type: object
+      description: Fields updatable on an S3 folder. Leave properties null to keep
+        them the same.
+      properties:
+        name:
+          $ref: '#/components/schemas/Name'
+        displayName:
+          $ref: '#/components/schemas/DisplayName'
+        description:
+          type: string
+        updateFolderId:
+          $ref: '#/components/schemas/UpdateFolderId'
+        s3Uri:
+          description: s3 URI path.
+          type: string
+        region:
+          description: region of the updated s3 bucket
+          type: string
+        cloningInstructions:
+          $ref: '#/components/schemas/CloningInstructionsEnum'
     UpdateWorkspaceRequestBody:
       type: object
       properties:
@@ -9325,6 +8411,23 @@ components:
         description:
           description: A description of the workspace
           type: string
+    UpdateWorkspacesByCrgRequest:
+      description: 'Provide the new billing account of the CRG. If we allow additional
+        changes, they can be
+
+        added to the request and we can make billing account optional.
+
+        '
+      type: object
+      required:
+        - gcpBillingAccount
+        - jobControl
+      properties:
+        gcpBillingAccount:
+          description: The new billing account for workspaces in a CRG
+          type: string
+        jobControl:
+          $ref: '#/components/schemas/JobControl'
     UserFacingId:
       description: 'Human-settable, mutable id. Must have 3-63 characters, contain
         lowercase letters, numbers, dashes, or
@@ -9417,12 +8520,13 @@ components:
         gcpContext:
           description: GCP context, if one exists
           $ref: '#/components/schemas/GcpContext'
-        azureContext:
-          description: Azure context, if one exists
-          $ref: '#/components/schemas/AzureContext'
         awsContext:
           description: AWS context, if one exists
           $ref: '#/components/schemas/AwsContext'
+        orgId:
+          $ref: '#/components/schemas/OrganizationId'
+        crgId:
+          $ref: '#/components/schemas/CloudResourceGroupId'
         properties:
           $ref: '#/components/schemas/Properties'
         createdDate:
@@ -9450,6 +8554,10 @@ components:
             type: string
         operationState:
           $ref: '#/components/schemas/OperationState'
+        cloneJobId:
+          description: Job id of the workspace clone operation when this is the target
+            workspace; null otherwise
+          type: string
     WorkspaceDescriptionList:
       type: object
       required:
@@ -9460,13 +8568,85 @@ components:
           type: array
           items:
             $ref: '#/components/schemas/WorkspaceDescription'
+    WorkspaceFilter:
+      type: object
+      properties:
+        gcpProjectIds:
+          description: GCP project ids of the workspaces
+          type: array
+          items:
+            type: string
+        podIds:
+          description: pod ids of the workspaces
+          type: array
+          items:
+            type: string
+            format: uuid
+        orgIds:
+          description: org ids of the workspaces
+          type: array
+          items:
+            type: string
+            format: uuid
+        offset:
+          description: The number of items to skip before starting to collect the
+            result set.
+          type: integer
+          minimum: 0
+          default: 0
+        limit:
+          description: The maximum number of items to return
+          type: integer
+          minimum: 1
+          default: 100
+    WorkspaceInfo:
+      description: Reduced set of information about a workspace. Does not include
+        Sam info (policies, auth domains, etc.) from WorkspaceDescription.
+      type: object
+      required:
+        - id
+        - userFacingId
+        - createdBy
+        - createdDate
+      properties:
+        id:
+          description: The ID of the workspace. Immutable.
+          type: string
+          format: uuid
+        userFacingId:
+          $ref: '#/components/schemas/UserFacingId'
+        displayName:
+          description: The human readable name of the workspace
+          type: string
+        description:
+          description: A description of the workspace
+          type: string
+        crgId:
+          $ref: '#/components/schemas/CloudResourceGroupId'
+        createdDate:
+          description: Timestamp when the workspace is created
+          type: string
+          format: date-time
+        createdBy:
+          description: User email of whom created the workspace
+          type: string
+    WorkspaceInfoList:
+      type: object
+      required:
+        - workspaces
+      properties:
+        workspaces:
+          description: A list of workspaces
+          type: array
+          items:
+            $ref: '#/components/schemas/WorkspaceInfo'
     WorkspaceStageModel:
-      description: Enum for possible stages of a workspace along the Rawls migration
-        path
+      description: Enum for possible different types of workspaces; CRG is supported
+        as a synonym for POD.
       type: string
       enum:
-        - RAWLS_WORKSPACE
-        - MC_WORKSPACE
+        - POD_WORKSPACE
+        - CRG_WORKSPACE
     WsmPolicy:
       type: object
       required:
@@ -9769,12 +8949,8 @@ components:
             openid: open id authorization
             email: email authorization
             profile: profile authorization
-    bearerAuth:
-      type: http
-      scheme: bearer
 security:
-  - bearerAuth: []
   - authorization:
       - openid
       - email
-      - profile
+      - profile
\ No newline at end of file