diff --git a/generated/src/aws-cpp-sdk-dynamodb/include/aws/dynamodb/DynamoDBClient.h b/generated/src/aws-cpp-sdk-dynamodb/include/aws/dynamodb/DynamoDBClient.h
index d57368c460a..19f50e4c26c 100644
--- a/generated/src/aws-cpp-sdk-dynamodb/include/aws/dynamodb/DynamoDBClient.h
+++ b/generated/src/aws-cpp-sdk-dynamodb/include/aws/dynamodb/DynamoDBClient.h
@@ -11,8 +11,8 @@
 #include <aws/dynamodb/DynamoDB_EXPORTS.h>
 #include <smithy/client/AwsSmithyClient.h>
 #include <smithy/client/serializer/JsonOutcomeSerializer.h>
+#include <smithy/identity/auth/built-in/GenericAuthSchemeResolver.h>
 #include <smithy/identity/auth/built-in/SigV4AuthScheme.h>
-#include <smithy/identity/auth/built-in/SigV4AuthSchemeResolver.h>
 
 namespace Aws {
 namespace DynamoDB {
@@ -38,7 +38,7 @@ AWS_DYNAMODB_API extern const char SERVICE_NAME[];
 class AWS_DYNAMODB_API DynamoDBClient
     : Aws::Client::ClientWithAsyncTemplateMethods<DynamoDBClient>,
       smithy::client::AwsSmithyClientT<Aws::DynamoDB::SERVICE_NAME, Aws::DynamoDB::DynamoDBClientConfiguration,
-                                       smithy::SigV4AuthSchemeResolver<>, Aws::Crt::Variant<smithy::SigV4AuthScheme>,
+                                       smithy::AuthSchemeResolverBase<>, Aws::Crt::Variant<smithy::SigV4AuthScheme>,
                                        DynamoDBEndpointProviderBase, smithy::client::JsonOutcomeSerializer, smithy::client::JsonOutcome,
                                        Aws::Client::DynamoDBErrorMarshaller> {
  public:
diff --git a/generated/src/aws-cpp-sdk-dynamodb/source/DynamoDBClient.cpp b/generated/src/aws-cpp-sdk-dynamodb/source/DynamoDBClient.cpp
index 6fae7149558..1dce2d7dc4b 100644
--- a/generated/src/aws-cpp-sdk-dynamodb/source/DynamoDBClient.cpp
+++ b/generated/src/aws-cpp-sdk-dynamodb/source/DynamoDBClient.cpp
@@ -104,7 +104,8 @@ DynamoDBClient::DynamoDBClient(const DynamoDB::DynamoDBClientConfiguration& clie
     : AwsSmithyClientT(clientConfiguration, GetServiceName(), "DynamoDB", Aws::Http::CreateHttpClient(clientConfiguration),
                        Aws::MakeShared<DynamoDBErrorMarshaller>(ALLOCATION_TAG),
                        endpointProvider ? endpointProvider : Aws::MakeShared<DynamoDBEndpointProvider>(ALLOCATION_TAG),
-                       Aws::MakeShared<smithy::SigV4AuthSchemeResolver<>>(ALLOCATION_TAG),
+                       Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(
+                           ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption})),
                        {
                            {smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
                             smithy::SigV4AuthScheme{GetServiceName(), clientConfiguration.region}},
@@ -116,7 +117,8 @@ DynamoDBClient::DynamoDBClient(const AWSCredentials& credentials, std::shared_pt
           clientConfiguration, GetServiceName(), "DynamoDB", Aws::Http::CreateHttpClient(clientConfiguration),
           Aws::MakeShared<DynamoDBErrorMarshaller>(ALLOCATION_TAG),
           endpointProvider ? endpointProvider : Aws::MakeShared<DynamoDBEndpointProvider>(ALLOCATION_TAG),
-          Aws::MakeShared<smithy::SigV4AuthSchemeResolver<>>(ALLOCATION_TAG),
+          Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(
+              ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption})),
           {
               {smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
                smithy::SigV4AuthScheme{Aws::MakeShared<smithy::SimpleAwsCredentialIdentityResolver>(ALLOCATION_TAG, credentials),
@@ -130,37 +132,50 @@ DynamoDBClient::DynamoDBClient(const std::shared_ptr<AWSCredentialsProvider>& cr
           clientConfiguration, GetServiceName(), "DynamoDB", Aws::Http::CreateHttpClient(clientConfiguration),
           Aws::MakeShared<DynamoDBErrorMarshaller>(ALLOCATION_TAG),
           endpointProvider ? endpointProvider : Aws::MakeShared<DynamoDBEndpointProvider>(ALLOCATION_TAG),
-          Aws::MakeShared<smithy::SigV4AuthSchemeResolver<>>(ALLOCATION_TAG),
-          {{smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
-            smithy::SigV4AuthScheme{Aws::MakeShared<smithy::AwsCredentialsProviderIdentityResolver>(ALLOCATION_TAG, credentialsProvider),
-                                    GetServiceName(), clientConfiguration.region}}}) {}
+          Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(
+              ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption})),
+          {
+              {smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
+               smithy::SigV4AuthScheme{Aws::MakeShared<smithy::AwsCredentialsProviderIdentityResolver>(ALLOCATION_TAG, credentialsProvider),
+                                       GetServiceName(), clientConfiguration.region}},
+          }) {}
 
 /* Legacy constructors due deprecation */
 DynamoDBClient::DynamoDBClient(const Client::ClientConfiguration& clientConfiguration)
     : AwsSmithyClientT(clientConfiguration, GetServiceName(), "DynamoDB", Aws::Http::CreateHttpClient(clientConfiguration),
                        Aws::MakeShared<DynamoDBErrorMarshaller>(ALLOCATION_TAG), Aws::MakeShared<DynamoDBEndpointProvider>(ALLOCATION_TAG),
-                       Aws::MakeShared<smithy::SigV4AuthSchemeResolver<>>(ALLOCATION_TAG),
-                       {{smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
-                         smithy::SigV4AuthScheme{Aws::MakeShared<smithy::DefaultAwsCredentialIdentityResolver>(ALLOCATION_TAG),
-                                                 GetServiceName(), clientConfiguration.region}}}) {}
+                       Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(
+                           ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption})),
+                       {
+                           {smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
+                            smithy::SigV4AuthScheme{Aws::MakeShared<smithy::DefaultAwsCredentialIdentityResolver>(ALLOCATION_TAG),
+                                                    GetServiceName(), clientConfiguration.region}},
+                       }) {}
 
 DynamoDBClient::DynamoDBClient(const AWSCredentials& credentials, const Client::ClientConfiguration& clientConfiguration)
-    : AwsSmithyClientT(clientConfiguration, GetServiceName(), "DynamoDB", Aws::Http::CreateHttpClient(clientConfiguration),
-                       Aws::MakeShared<DynamoDBErrorMarshaller>(ALLOCATION_TAG), Aws::MakeShared<DynamoDBEndpointProvider>(ALLOCATION_TAG),
-                       Aws::MakeShared<smithy::SigV4AuthSchemeResolver<>>(ALLOCATION_TAG),
-                       {{smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
-                         smithy::SigV4AuthScheme{Aws::MakeShared<smithy::SimpleAwsCredentialIdentityResolver>(ALLOCATION_TAG, credentials),
-                                                 GetServiceName(), clientConfiguration.region}}}) {}
+    : AwsSmithyClientT(
+          clientConfiguration, GetServiceName(), "DynamoDB", Aws::Http::CreateHttpClient(clientConfiguration),
+          Aws::MakeShared<DynamoDBErrorMarshaller>(ALLOCATION_TAG), Aws::MakeShared<DynamoDBEndpointProvider>(ALLOCATION_TAG),
+          Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(
+              ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption})),
+          {
+              {smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
+               smithy::SigV4AuthScheme{Aws::MakeShared<smithy::SimpleAwsCredentialIdentityResolver>(ALLOCATION_TAG, credentials),
+                                       GetServiceName(), clientConfiguration.region}},
+          }) {}
 
 DynamoDBClient::DynamoDBClient(const std::shared_ptr<AWSCredentialsProvider>& credentialsProvider,
                                const Client::ClientConfiguration& clientConfiguration)
     : AwsSmithyClientT(
           clientConfiguration, GetServiceName(), "DynamoDB", Aws::Http::CreateHttpClient(clientConfiguration),
           Aws::MakeShared<DynamoDBErrorMarshaller>(ALLOCATION_TAG), Aws::MakeShared<DynamoDBEndpointProvider>(ALLOCATION_TAG),
-          Aws::MakeShared<smithy::SigV4AuthSchemeResolver<>>(ALLOCATION_TAG),
-          {{smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
-            smithy::SigV4AuthScheme{Aws::MakeShared<smithy::AwsCredentialsProviderIdentityResolver>(ALLOCATION_TAG, credentialsProvider),
-                                    GetServiceName(), clientConfiguration.region}}}) {}
+          Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(
+              ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption})),
+          {
+              {smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId,
+               smithy::SigV4AuthScheme{Aws::MakeShared<smithy::AwsCredentialsProviderIdentityResolver>(ALLOCATION_TAG, credentialsProvider),
+                                       GetServiceName(), clientConfiguration.region}},
+          }) {}
 /* End of legacy constructors due deprecation */
 
 DynamoDBClient::~DynamoDBClient() { ShutdownSdkClient(this, -1); }
diff --git a/src/aws-cpp-sdk-core/include/aws/core/client/ClientConfiguration.h b/src/aws-cpp-sdk-core/include/aws/core/client/ClientConfiguration.h
index a72809b240e..75e2ba5fac8 100644
--- a/src/aws-cpp-sdk-core/include/aws/core/client/ClientConfiguration.h
+++ b/src/aws-cpp-sdk-core/include/aws/core/client/ClientConfiguration.h
@@ -563,6 +563,12 @@ namespace Aws
               std::chrono::milliseconds credentialCacheCacheTTL = std::chrono::minutes(50);
             } stsCredentialsProviderConfig;
           } credentialProviderConfig;
+
+          /**
+           * Authentication scheme preferences in order of preference.
+           * First available auth scheme will be used for each operation.
+           */
+          Aws::Vector<Aws::String> authPreferences;
         };
 
         /**
diff --git a/src/aws-cpp-sdk-core/include/smithy/client/AwsSmithyClient.h b/src/aws-cpp-sdk-core/include/smithy/client/AwsSmithyClient.h
index 21c8341d80c..b5eeb8f7d12 100644
--- a/src/aws-cpp-sdk-core/include/smithy/client/AwsSmithyClient.h
+++ b/src/aws-cpp-sdk-core/include/smithy/client/AwsSmithyClient.h
@@ -163,6 +163,7 @@ namespace client
             identityParams.serviceName = m_serviceName;
             identityParams.operation = ctx.m_requestName;
             identityParams.region = m_clientConfiguration.region;
+            identityParams.authPreferences = m_clientConfiguration.authPreferences;
 
             if (ctx.m_pRequest) {
                 // refactor once auth scheme resolver will use it's own rule set
diff --git a/src/aws-cpp-sdk-core/include/smithy/identity/auth/AuthSchemeResolverBase.h b/src/aws-cpp-sdk-core/include/smithy/identity/auth/AuthSchemeResolverBase.h
index 4ab79935e4c..39c81b3897b 100644
--- a/src/aws-cpp-sdk-core/include/smithy/identity/auth/AuthSchemeResolverBase.h
+++ b/src/aws-cpp-sdk-core/include/smithy/identity/auth/AuthSchemeResolverBase.h
@@ -8,10 +8,23 @@
 #include <smithy/identity/signer/AwsSignerBase.h>
 
 #include <aws/crt/Variant.h>
-#include <aws/core/utils/memory/stl/AWSMap.h>
-
+#include <aws/core/utils/memory/stl/AWSVector.h>
 
 namespace smithy {
+
+static const char SIGV4_PREFERENCE[] = "sigv4";
+static const char SIGV4A_PREFERENCE[] = "sigv4a";
+static const char BEARER_PREFERENCE[] = "bearer";
+static const char NO_AUTH_PREFERENCE[] = "noauth";
+
+// Global map from auth scheme name (trimmed ID) to full ID for case insensitive lookup
+static const Aws::Array<std::pair<const char*, const char*>, 4> AUTH_SCHEME_NAME_TO_ID = {
+    std::make_pair(SIGV4_PREFERENCE, "aws.auth#sigv4"),
+    std::make_pair(SIGV4A_PREFERENCE, "aws.auth#sigv4a"),
+    std::make_pair(BEARER_PREFERENCE, "smithy.api#HTTPBearerAuth"),
+    std::make_pair(NO_AUTH_PREFERENCE, "smithy.api#noAuth")
+};
+
 /**
 * A base interface for code-generated interfaces for passing in the data required for determining the
 * authentication scheme. By default, this only includes the operation name.
@@ -22,6 +35,7 @@ class DefaultAuthSchemeResolverParameters
   Aws::String serviceName;
   Aws::String operation;
   Aws::Crt::Optional<Aws::String> region;
+  Aws::Vector<Aws::String> authPreferences;
 
   Aws::UnorderedMap<Aws::String, Aws::Crt::Variant<Aws::String,
           bool,
@@ -43,7 +57,31 @@ class AuthSchemeResolverBase
   using ServiceAuthSchemeParameters = ServiceAuthSchemeParametersT;
 
   virtual ~AuthSchemeResolverBase() = default;
-  // AuthScheme Resolver returns a list of AuthSchemeOptions for some reason, according to the SRA...
-  virtual Aws::Vector<AuthSchemeOption> resolveAuthScheme(const ServiceAuthSchemeParameters& identityProperties) = 0;
+  
+  virtual Aws::Vector<AuthSchemeOption> resolveAuthScheme(const ServiceAuthSchemeParameters& identityProperties) {
+    auto options = resolveAuthSchemeImpl(identityProperties);
+    return filterByPreferences(options, identityProperties.authPreferences);
+  }
+
+protected:
+  virtual Aws::Vector<AuthSchemeOption> resolveAuthSchemeImpl(const ServiceAuthSchemeParameters& identityProperties) = 0;
+  
+  virtual Aws::Vector<AuthSchemeOption> filterByPreferences(const Aws::Vector<AuthSchemeOption>& options, 
+                                                           const Aws::Vector<Aws::String>& preferences) {
+    if (preferences.empty()) return options;
+    
+    Aws::Vector<AuthSchemeOption> filtered;
+    for (const auto& pref : preferences) {
+      auto prefSchemeIt = find_if(AUTH_SCHEME_NAME_TO_ID.begin(), AUTH_SCHEME_NAME_TO_ID.end(), [&](const std::pair<const char*, const char*> &pair) { return Aws::Utils::StringUtils::ToLower(pref.c_str()) == pair.first; });
+      if (prefSchemeIt == AUTH_SCHEME_NAME_TO_ID.end()) continue;
+      for (const auto& option : options) {
+        if (strcmp(option.schemeId, prefSchemeIt->second) == 0) {
+          filtered.push_back(option);
+          break;
+        }
+      }
+    }
+    return filtered.empty() ? options : filtered;
+  }
 };
 }
\ No newline at end of file
diff --git a/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/BearerTokenAuthScheme.h b/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/BearerTokenAuthScheme.h
index 4e6e450621d..38800b01190 100644
--- a/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/BearerTokenAuthScheme.h
+++ b/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/BearerTokenAuthScheme.h
@@ -11,6 +11,8 @@
 #include <smithy/identity/signer/built-in/BearerTokenSigner.h>
 namespace smithy
 {
+constexpr char BEARER[] = "smithy.api#HTTPBearerAuth";
+
 class BearerTokenAuthScheme : public AuthScheme<AwsBearerTokenIdentityBase>
 {
   public:
@@ -22,7 +24,7 @@ class BearerTokenAuthScheme : public AuthScheme<AwsBearerTokenIdentityBase>
     explicit BearerTokenAuthScheme(
         std::shared_ptr<AwsCredentialIdentityResolverT> identityResolver,
         const Aws::String &serviceName, const Aws::String &region)
-        : AuthScheme("smithy.api#HTTPBearerAuth"),
+        : AuthScheme(BEARER),
           m_identityResolver{identityResolver},
           m_signer{Aws::MakeShared<smithy::BearerTokenSigner>(
               "BearerTokenAuthScheme", serviceName, region)}
diff --git a/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/GenericAuthSchemeResolver.h b/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/GenericAuthSchemeResolver.h
new file mode 100644
index 00000000000..7fc600d5d11
--- /dev/null
+++ b/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/GenericAuthSchemeResolver.h
@@ -0,0 +1,30 @@
+/**
+* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0.
+ */
+#pragma once
+
+#include <smithy/identity/auth/AuthSchemeResolverBase.h>
+
+
+namespace smithy {
+    template<typename ServiceAuthSchemeParametersT = DefaultAuthSchemeResolverParameters>
+    class GenericAuthSchemeResolver : public AuthSchemeResolverBase<ServiceAuthSchemeParametersT>
+    {
+    public:
+        using ServiceAuthSchemeParameters = ServiceAuthSchemeParametersT;
+        GenericAuthSchemeResolver(const Aws::Vector<AuthSchemeOption>& allowedAuth) : m_allowedAuth(allowedAuth) {}
+        GenericAuthSchemeResolver() = default;
+        virtual ~GenericAuthSchemeResolver() = default;
+
+    private:
+      Aws::Vector<AuthSchemeOption> m_allowedAuth;
+
+    protected:
+        Aws::Vector<AuthSchemeOption> resolveAuthSchemeImpl(const ServiceAuthSchemeParameters& identityProperties) override
+        {
+          AWS_UNREFERENCED_PARAM(identityProperties);
+          return m_allowedAuth;
+        }
+    };
+}
\ No newline at end of file
diff --git a/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/SigV4MultiAuthResolver.h b/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/SigV4MultiAuthResolver.h
index 5cd1b372a81..5bf5b7ba11c 100644
--- a/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/SigV4MultiAuthResolver.h
+++ b/src/aws-cpp-sdk-core/include/smithy/identity/auth/built-in/SigV4MultiAuthResolver.h
@@ -12,12 +12,18 @@
 #include <smithy/identity/auth/built-in/SigV4aAuthSchemeOption.h>
 #include <smithy/identity/auth/built-in/SigV4AuthScheme.h>
 
+/**
+ * This is an auth scheme resolver prioritizing endpoints2.0 auth resolution
+ * used for s3 which supersedes the model based auth resolution we do in GenericAuthResolver.
+ */
+
 namespace smithy {
     template<typename EndPointProviderType, typename ClientConfigType,typename ServiceAuthSchemeParametersT = DefaultAuthSchemeResolverParameters>
     class SigV4MultiAuthSchemeResolver : public AuthSchemeResolverBase<ServiceAuthSchemeParametersT, ClientConfigType>
     {
-    private:
     public:
+        SigV4MultiAuthSchemeResolver(const Aws::Vector<AuthSchemeOption>& allowedAuth) : m_allowedAuth(allowedAuth) {}
+        SigV4MultiAuthSchemeResolver() = default;
 
         void Init(const ClientConfigType& config) override{
             m_endpointProviderForAuth = Aws::MakeShared<EndPointProviderType>("SigV4MultiAuthSchemeResolver");
@@ -27,8 +33,12 @@ namespace smithy {
         using ServiceAuthSchemeParameters = ServiceAuthSchemeParametersT;
         virtual ~SigV4MultiAuthSchemeResolver() = default;
 
-        Aws::Vector<AuthSchemeOption> resolveAuthScheme(const ServiceAuthSchemeParameters& identityProperties) override
+        Aws::Vector<AuthSchemeOption> resolveAuthSchemeImpl(const ServiceAuthSchemeParameters& identityProperties) override
         {
+            if (!m_allowedAuth.empty()) {
+              // This code path will not currently be taken, but we should enable a way for the user to disable preference for endpoints2.0 resolution and use the preference list
+              return m_allowedAuth;
+            }
             //pack endpoint params from identityProperties
             Aws::Endpoint::EndpointParameters epParams;
 
@@ -66,6 +76,10 @@ namespace smithy {
 
             return {SigV4AuthSchemeOption::sigV4AuthSchemeOption};
         }
+
+    private:
+      Aws::Vector<AuthSchemeOption> m_allowedAuth;
+
     protected:
         std::shared_ptr<EndPointProviderType> m_endpointProviderForAuth;
     };
diff --git a/src/aws-cpp-sdk-core/source/client/ClientConfiguration.cpp b/src/aws-cpp-sdk-core/source/client/ClientConfiguration.cpp
index 3b427fb7ae4..289552f1ddf 100644
--- a/src/aws-cpp-sdk-core/source/client/ClientConfiguration.cpp
+++ b/src/aws-cpp-sdk-core/source/client/ClientConfiguration.cpp
@@ -188,6 +188,18 @@ Aws::String calculateRegion() {
   return "";
 }
 
+
+Aws::Vector<Aws::String> calculateAuthPreferences() {
+  // Automatically determine the AWS region from environment variables, configuration file and EC2 metadata.
+  Aws::Vector<Aws::String> res;
+  auto prefs = Aws::Environment::GetEnv("AWS_AUTH_SCHEME_PREFERENCE");
+  Aws::Vector<Aws::String> prefsList  = Aws::Utils::StringUtils::Split(prefs, ',');
+  for (auto& pref : prefsList) {
+    res.push_back(Aws::Utils::StringUtils::Trim(pref.c_str()));
+  }
+  return res;
+}
+
 void setLegacyClientConfigurationParameters(ClientConfiguration& clientConfig)
 {
     clientConfig.scheme = Aws::Http::Scheme::HTTPS;
@@ -251,6 +263,7 @@ void setLegacyClientConfigurationParameters(ClientConfiguration& clientConfig)
 
     clientConfig.region = calculateRegion();
     clientConfig.credentialProviderConfig.region = clientConfig.region;
+    clientConfig.authPreferences = calculateAuthPreferences();
 
     // Set the endpoint to interact with EC2 instance's metadata service
     Aws::String ec2MetadataServiceEndpoint = Aws::Environment::GetEnv("AWS_EC2_METADATA_SERVICE_ENDPOINT");
diff --git a/tests/aws-cpp-sdk-core-tests/smithy/client/SmithyClientTest.cpp b/tests/aws-cpp-sdk-core-tests/smithy/client/SmithyClientTest.cpp
index 18ef6e124f7..4b14cfd5418 100644
--- a/tests/aws-cpp-sdk-core-tests/smithy/client/SmithyClientTest.cpp
+++ b/tests/aws-cpp-sdk-core-tests/smithy/client/SmithyClientTest.cpp
@@ -17,12 +17,10 @@
 #include <smithy/client/serializer/JsonOutcomeSerializer.h>
 #include <smithy/identity/auth/AuthSchemeOption.h>
 #include <smithy/identity/auth/built-in/BearerTokenAuthScheme.h>
-#include <smithy/identity/auth/built-in/BearerTokenAuthSchemeResolver.h>
 #include <smithy/identity/auth/built-in/SigV4AuthScheme.h>
-#include <smithy/identity/auth/built-in/SigV4AuthSchemeResolver.h>
 #include <smithy/identity/auth/built-in/SigV4aAuthScheme.h>
-#include <smithy/identity/auth/built-in/SigV4aAuthSchemeResolver.h>
 #include <smithy/identity/resolver/AwsBearerTokenIdentityResolver.h>
+#include <smithy/identity/auth/built-in/GenericAuthSchemeResolver.h>
 
 namespace {
   const char* ALLOC_TAG = "SmithyClientTest";
@@ -232,7 +230,7 @@ class TestClient : public MySmithyClient
 
 TEST_F(SmithyClientTest, testSigV4) {
 
-    std::shared_ptr<MyServiceAuthSchemeResolver> authSchemeResolver = Aws::MakeShared<smithy::SigV4AuthSchemeResolver<> >(ALLOCATION_TAG);
+    std::shared_ptr<MyServiceAuthSchemeResolver> authSchemeResolver = Aws::MakeShared<smithy::GenericAuthSchemeResolver<> >(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption}));
 
     Aws::UnorderedMap<Aws::String, SigVariant> authSchemesMap;
 
@@ -279,7 +277,7 @@ TEST_F(SmithyClientTest, testSigV4) {
 
 TEST_F(SmithyClientTest, testSigV4a) {
 
-    std::shared_ptr<MyServiceAuthSchemeResolver> authSchemeResolver = Aws::MakeShared<smithy::SigV4aAuthSchemeResolver<>>(ALLOCATION_TAG);
+    std::shared_ptr<MyServiceAuthSchemeResolver> authSchemeResolver = Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4aAuthSchemeOption::sigV4aAuthSchemeOption}));
 
     Aws::UnorderedMap<Aws::String, SigVariant> authSchemesMap;
 
@@ -328,8 +326,8 @@ TEST_F(SmithyClientTest, bearer)
 {
 
     std::shared_ptr<MyServiceAuthSchemeResolver> authSchemeResolver =
-        Aws::MakeShared<smithy::BearerTokenAuthSchemeResolver<>>(
-            ALLOCATION_TAG);
+        Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(
+            ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::BearerTokenAuthSchemeOption::bearerTokenAuthSchemeOption}));
 
     Aws::UnorderedMap<Aws::String, SigVariant> authSchemesMap;
 
@@ -375,6 +373,183 @@ TEST_F(SmithyClientTest, bearer)
               "Bearer testBearerToken");
 }
 
+TEST_F(SmithyClientTest, testSigV4aPreference) {
+
+    std::shared_ptr<MyServiceAuthSchemeResolver> authSchemeResolver = Aws::MakeShared<smithy::GenericAuthSchemeResolver<> >(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4aAuthSchemeOption::sigV4aAuthSchemeOption, smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption, smithy::BearerTokenAuthSchemeOption::bearerTokenAuthSchemeOption}));
+
+    Aws::UnorderedMap<Aws::String, SigVariant> authSchemesMap;
+
+    //add mock credentials provider for the test to the credentials provider chain
+    AddCredentialsProvider(Aws::MakeShared<TestCredentialsProvider>("TestCredentialsProviderChain"));
+
+    //create resolver with the credentials provider chain
+    auto credentialsResolver = Aws::MakeShared<smithy::DefaultAwsCredentialIdentityResolver>(ALLOCATION_TAG, credsProviderChain);
+
+    Aws::String key{smithy::SigV4aAuthSchemeOption::sigV4aAuthSchemeOption.schemeId};
+    SigVariant val{smithy::SigV4aAuthScheme( credentialsResolver, "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key, val);
+
+    Aws::String key2{smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId};
+    SigVariant val2{smithy::SigV4AuthScheme( credentialsResolver, "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key2, val2);
+
+    Aws::String key3{smithy::BearerTokenAuthSchemeOption::bearerTokenAuthSchemeOption.schemeId};
+    SigVariant val3{smithy::BearerTokenAuthScheme( Aws::MakeShared<TestAwsBearerTokenIdentityResolver>(ALLOCATION_TAG), "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key3, val3);
+
+    clientConfig.authPreferences = {smithy::SIGV4A_PREFERENCE};
+    std::shared_ptr<TestClient> ptr = Aws::MakeShared<TestClient>(
+        ALLOCATION_TAG,
+        clientConfig,
+        "MyService",
+        httpClient,
+        errorMarshaller,
+        endPointProvider,
+        authSchemeResolver,
+        authSchemesMap);
+    smithy::client::AwsSmithyClientAsyncRequestContext ctx;
+    ctx.m_pRequest = nullptr;
+
+    auto res = ptr->SelectAuthSchemeOption(ctx);
+    EXPECT_EQ(res.IsSuccess(), true);
+    EXPECT_EQ(res.GetResult().schemeId, key);
+    ctx.m_authSchemeOption = res.GetResultWithOwnership();
+    ctx.m_awsIdentity = ptr->ResolveIdentity(ctx).GetResultWithOwnership();
+
+    Aws::String uri{"https://treasureisland-cb93079d-24a0-4862-8es2-88456ead.xyz.amazonaws.com"};
+
+    std::shared_ptr<Aws::Http::HttpRequest> httpRequest(Aws::Http::CreateHttpRequest(uri, Aws::Http::HttpMethod::HTTP_GET, Aws::Utils::Stream::DefaultResponseStreamFactoryMethod));
+
+    auto res2 = ptr->SignRequest(httpRequest, ctx);
+
+    EXPECT_EQ(res2.IsSuccess(), true);
+    EXPECT_TRUE(!res2.GetResult()->GetSigningAccessKey().empty());
+    EXPECT_FALSE(res2.GetResult()->GetUri().GetURIString(true).empty());
+}
+
+TEST_F(SmithyClientTest, testSigV4Preference) {
+
+    std::shared_ptr<MyServiceAuthSchemeResolver> authSchemeResolver = Aws::MakeShared<smithy::GenericAuthSchemeResolver<> >(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4aAuthSchemeOption::sigV4aAuthSchemeOption, smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption, smithy::BearerTokenAuthSchemeOption::bearerTokenAuthSchemeOption}));
+
+    Aws::UnorderedMap<Aws::String, SigVariant> authSchemesMap;
+
+    //add mock credentials provider for the test to the credentials provider chain
+    AddCredentialsProvider(Aws::MakeShared<TestCredentialsProvider>("TestCredentialsProviderChain"));
+
+    //create resolver with the credentials provider chain
+    auto credentialsResolver = Aws::MakeShared<smithy::DefaultAwsCredentialIdentityResolver>(ALLOCATION_TAG, credsProviderChain);
+
+    Aws::String key{smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId};
+    SigVariant val{smithy::SigV4AuthScheme( credentialsResolver, "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key, val);
+
+    Aws::String key2{smithy::SigV4aAuthSchemeOption::sigV4aAuthSchemeOption.schemeId};
+    SigVariant val2{smithy::SigV4aAuthScheme( credentialsResolver, "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key2, val2);
+
+    Aws::String key3{smithy::BearerTokenAuthSchemeOption::bearerTokenAuthSchemeOption.schemeId};
+    SigVariant val3{smithy::BearerTokenAuthScheme( Aws::MakeShared<TestAwsBearerTokenIdentityResolver>(ALLOCATION_TAG), "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key3, val3);
+
+    clientConfig.authPreferences = {smithy::SIGV4_PREFERENCE};
+    std::shared_ptr<TestClient> ptr = Aws::MakeShared<TestClient>(
+        ALLOCATION_TAG,
+        clientConfig,
+        "MyService",
+        httpClient,
+        errorMarshaller,
+        endPointProvider,
+        authSchemeResolver,
+        authSchemesMap);
+    smithy::client::AwsSmithyClientAsyncRequestContext ctx;
+    ctx.m_pRequest = nullptr;
+
+    auto res = ptr->SelectAuthSchemeOption(ctx);
+    EXPECT_EQ(res.IsSuccess(), true);
+    EXPECT_EQ(res.GetResult().schemeId, key);
+    ctx.m_authSchemeOption = res.GetResultWithOwnership();
+    ctx.m_awsIdentity = ptr->ResolveIdentity(ctx).GetResultWithOwnership();
+
+    Aws::String uri{"https://treasureisland-cb93079d-24a0-4862-8es2-88456ead.xyz.amazonaws.com"};
+
+    std::shared_ptr<Aws::Http::HttpRequest> httpRequest(Aws::Http::CreateHttpRequest(uri, Aws::Http::HttpMethod::HTTP_GET, Aws::Utils::Stream::DefaultResponseStreamFactoryMethod));
+
+    auto res2 = ptr->SignRequest(httpRequest, ctx);
+
+    EXPECT_EQ(res2.IsSuccess(), true);
+    EXPECT_EQ(res2.GetResult()->GetSigningAccessKey(), "dummyAccessId");
+}
+
+TEST_F(SmithyClientTest, testBearerPreference) {
+
+    std::shared_ptr<MyServiceAuthSchemeResolver> authSchemeResolver = Aws::MakeShared<smithy::GenericAuthSchemeResolver<> >(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({smithy::SigV4aAuthSchemeOption::sigV4aAuthSchemeOption, smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption, smithy::BearerTokenAuthSchemeOption::bearerTokenAuthSchemeOption}));
+
+    Aws::UnorderedMap<Aws::String, SigVariant> authSchemesMap;
+
+    //add mock credentials provider for the test to the credentials provider chain
+    AddCredentialsProvider(Aws::MakeShared<TestCredentialsProvider>("TestCredentialsProviderChain"));
+
+    //create resolver with the credentials provider chain
+    auto credentialsResolver = Aws::MakeShared<smithy::DefaultAwsCredentialIdentityResolver>(ALLOCATION_TAG, credsProviderChain);
+
+    Aws::String key{smithy::BearerTokenAuthSchemeOption::bearerTokenAuthSchemeOption.schemeId};
+    SigVariant val{smithy::BearerTokenAuthScheme( Aws::MakeShared<TestAwsBearerTokenIdentityResolver>(ALLOCATION_TAG), "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key, val);
+
+    Aws::String key2{smithy::SigV4aAuthSchemeOption::sigV4aAuthSchemeOption.schemeId};
+    SigVariant val2{smithy::SigV4aAuthScheme( credentialsResolver, "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key2, val2);
+
+    Aws::String key3{smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption.schemeId};
+    SigVariant val3{smithy::SigV4AuthScheme( credentialsResolver, "MyService", "us-west-2")};
+
+    authSchemesMap.emplace(key3, val3);
+
+    clientConfig.authPreferences = {smithy::BEARER_PREFERENCE};
+    std::shared_ptr<TestClient> ptr = Aws::MakeShared<TestClient>(
+        ALLOCATION_TAG,
+        clientConfig,
+        "MyService",
+        httpClient,
+        errorMarshaller,
+        endPointProvider,
+        authSchemeResolver,
+        authSchemesMap);
+    smithy::client::AwsSmithyClientAsyncRequestContext ctx;
+    ctx.m_pRequest = nullptr;
+
+    auto res = ptr->SelectAuthSchemeOption(ctx);
+    EXPECT_EQ(res.IsSuccess(), true);
+    EXPECT_EQ(res.GetResult().schemeId, key);
+    ctx.m_authSchemeOption = res.GetResultWithOwnership();
+    ctx.m_awsIdentity = ptr->ResolveIdentity(ctx).GetResultWithOwnership();
+
+    Aws::String uri{
+      "https://"
+      "treasureisland-cb93079d-24a0-4862-8es2-88456ead.xyz.amazonaws.com"};
+
+    std::shared_ptr<Aws::Http::HttpRequest> httpRequest(
+        Aws::Http::CreateHttpRequest(
+            uri, Aws::Http::HttpMethod::HTTP_GET,
+            Aws::Utils::Stream::DefaultResponseStreamFactoryMethod));
+
+    auto res2 = ptr->SignRequest(httpRequest, ctx);
+
+    EXPECT_EQ(res2.IsSuccess(), true);
+
+    EXPECT_TRUE(!res2.GetResult()->GetHeaderValue("authorization").empty());
+    EXPECT_EQ(res2.GetResult()->GetHeaderValue("authorization"),
+              "Bearer testBearerToken");
+}
+
 struct SampleConfiguration: public Aws::Client::ClientConfiguration {
   Aws::String localToService{"whatever"};
 };
@@ -407,7 +582,7 @@ struct SampleEndpointProvider : public Aws::Endpoint::EndpointProviderBase<>
 static constexpr char SampleServiceName[] = "SampleService";
 class SampleClient: public smithy::client::AwsSmithyClientT<SampleServiceName,
   SampleConfiguration,
-  smithy::SigV4AuthSchemeResolver<>,
+  smithy::GenericAuthSchemeResolver<>,
   Aws::Crt::Variant<smithy::SigV4aAuthScheme>,
   SampleEndpointProvider,
   smithy::client::JsonOutcomeSerializer,
@@ -421,7 +596,7 @@ class SampleClient: public smithy::client::AwsSmithyClientT<SampleServiceName,
     Aws::MakeShared<MockHttpClient>(SampleServiceName),
     Aws::MakeShared<Aws::Client::JsonErrorMarshaller>(SampleServiceName),
     Aws::MakeShared<SampleEndpointProvider>(SampleServiceName),
-    Aws::MakeShared<smithy::SigV4AuthSchemeResolver<>>(SampleServiceName),
+    Aws::MakeShared<smithy::GenericAuthSchemeResolver<>>(SampleServiceName),
     Aws::UnorderedMap<Aws::String, Aws::Crt::Variant<smithy::SigV4aAuthScheme>>())
   {}
 };
@@ -438,7 +613,7 @@ TEST_F(SmithyClientTest, SmithyClientShouldCopyAssignAndMove) {
   AWS_UNREFERENCED_PARAM(assign);
 }
 
-class TestAuthSchemeResolver : public smithy::SigV4AuthSchemeResolver<>
+class TestAuthSchemeResolver : public smithy::GenericAuthSchemeResolver<>
 {
 public:
   virtual Aws::String GetTestId() const { return "BaseClass"; }
diff --git a/tools/code-generation/generator/src/main/java/com/amazonaws/util/awsclientgenerator/domainmodels/codegeneration/ServiceModel.java b/tools/code-generation/generator/src/main/java/com/amazonaws/util/awsclientgenerator/domainmodels/codegeneration/ServiceModel.java
index 705c88b15ee..0a0e00580b4 100644
--- a/tools/code-generation/generator/src/main/java/com/amazonaws/util/awsclientgenerator/domainmodels/codegeneration/ServiceModel.java
+++ b/tools/code-generation/generator/src/main/java/com/amazonaws/util/awsclientgenerator/domainmodels/codegeneration/ServiceModel.java
@@ -54,6 +54,10 @@ public boolean hasSigV4Auth() {
         return operations.values().parallelStream().anyMatch(operation -> operation.getSignerName().equals("Aws::Auth::SIGV4_SIGNER"));
     }
 
+    public boolean hasSigV4aAuth() {
+        return operations.values().parallelStream().anyMatch(operation -> operation.getSignerName().equals("Aws::Auth::ASYMMETRIC_SIGV4_SIGNER"));
+    }
+
     public boolean hasBearerAuth() {
         if(metadata.getSignatureVersion().equals("bearer")) {
             return true;
diff --git a/tools/code-generation/generator/src/main/java/com/amazonaws/util/awsclientgenerator/generators/cpp/CppClientGenerator.java b/tools/code-generation/generator/src/main/java/com/amazonaws/util/awsclientgenerator/generators/cpp/CppClientGenerator.java
index 53119435d23..3e0fb7803a7 100644
--- a/tools/code-generation/generator/src/main/java/com/amazonaws/util/awsclientgenerator/generators/cpp/CppClientGenerator.java
+++ b/tools/code-generation/generator/src/main/java/com/amazonaws/util/awsclientgenerator/generators/cpp/CppClientGenerator.java
@@ -736,24 +736,18 @@ protected SdkFileEntry generateClientSmithyHeaderFile(final ServiceModel service
 
     private void selectAuthschemeResolver(final ServiceModel serviceModel, VelocityContext context)
     {
-        if(serviceModel.getAuthSchemes().size() > 1)
+        //Ensure we support this auth
+        Optional<String> firstAuthScheme = serviceModel.getAuthSchemes().stream().filter(entry->ResolverMapping.containsKey(entry)).findFirst();
+        if(firstAuthScheme.isPresent())
         {
-            context.put("AuthSchemeResolver", "SigV4MultiAuthSchemeResolver");
+            context.put("AuthSchemeResolver", ResolverMapping.get(firstAuthScheme.get()));
         }
         else
         {
-            Optional<String> firstAuthScheme = serviceModel.getAuthSchemes().stream().filter(entry->ResolverMapping.containsKey(entry)).findFirst();
-
-            if(firstAuthScheme.isPresent())
-            {
-                context.put("AuthSchemeResolver", ResolverMapping.get(firstAuthScheme.get()));
-            }
-            else
-            {
-                throw new RuntimeException(String.format("authSchemes '%s'",serviceModel.getAuthSchemes().stream().collect(Collectors.toList())));
-            }
+            throw new RuntimeException(String.format("authSchemes '%s'",serviceModel.getAuthSchemes().stream().collect(Collectors.toList())));
         }
         context.put("AuthSchemeVariants", serviceModel.getAuthSchemes().stream().map(this::mapAuthSchemes).collect(Collectors.joining(",")));
+        context.put("AuthSchemeOptions", serviceModel.getAuthSchemes().stream().map(this::mapAuthSchemeOptions).collect(Collectors.joining(",")));
     }
 
     protected SdkFileEntry GenerateSmithyClientSourceFile(final ServiceModel serviceModel, int i, Optional<String> templateFile) {
@@ -765,6 +759,7 @@ protected SdkFileEntry GenerateSmithyClientSourceFile(final ServiceModel service
         context.put("CppViewHelper", CppViewHelper.class);
         selectAuthschemeResolver(serviceModel, context);
         context.put("AuthSchemeMapEntries", createAuthSchemeMapEntries(serviceModel));
+        context.put("AuthSchemes", getSupportedAuthSchemes(serviceModel));
 
         final String fileName;
         if (i == 0) {
@@ -811,6 +806,13 @@ protected String mapAuthSchemes(final String authSchemeName) {
         throw new RuntimeException(String.format("Unsupported authScheme '%s'", authSchemeName));
     }
 
+    protected String mapAuthSchemeOptions(final String authSchemeName) {
+        if (SchemeIdMapping.containsKey(authSchemeName)) {
+            return SchemeIdMapping.get(authSchemeName);
+        }
+        throw new RuntimeException(String.format("Unsupported authScheme '%s'", authSchemeName));
+    }
+
 
     private static final Map<String, String> SchemeIdMapping = ImmutableMap.of(
             "aws.auth#sigv4", "smithy::SigV4AuthSchemeOption::sigV4AuthSchemeOption",
@@ -822,11 +824,11 @@ protected String mapAuthSchemes(final String authSchemeName) {
     );
 
     protected static final Map<String, String> ResolverMapping = ImmutableMap.of(
-            "aws.auth#sigv4", "SigV4AuthSchemeResolver",
-            "aws.auth#sigv4a", "SigV4aAuthSchemeResolver",
-            "bearer", "BearerTokenAuthSchemeResolver",
-            "v4", "SigV4AuthSchemeResolver",
-            "v2", "SigV4AuthSchemeResolver"
+            "aws.auth#sigv4", "GenericAuthSchemeResolver",
+            "aws.auth#sigv4a", "GenericAuthSchemeResolver",
+            "bearer", "GenericAuthSchemeResolver",
+            "v4", "GenericAuthSchemeResolver",
+            "v2", "GenericAuthSchemeResolver"
     );
 
 
diff --git a/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientHeader.vm b/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientHeader.vm
index af3f00c935e..b10b2c429d9 100644
--- a/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientHeader.vm
+++ b/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientHeader.vm
@@ -18,13 +18,16 @@
 \#include <aws/core/client/AWSClientAsyncCRTP.h>
 \#include <aws/$metadata.projectName/${metadata.classNamePrefix}ServiceClientModel.h>
 \#include <smithy/client/AwsSmithyClient.h>
-#if($serviceModel.hasOnlyBearerAuth())
-\#include <smithy/identity/auth/built-in/BearerTokenAuthSchemeResolver.h>
+#if($serviceModel.hasBearerAuth())
 \#include <smithy/identity/auth/built-in/BearerTokenAuthScheme.h>
-#else
-\#include <smithy/identity/auth/built-in/SigV4AuthSchemeResolver.h>
+#end
+#if($serviceModel.hasSigV4Auth())
 \#include <smithy/identity/auth/built-in/SigV4AuthScheme.h>
 #end
+#if($serviceModel.hasSigV4aAuth())
+\#include <smithy/identity/auth/built-in/SigV4aAuthScheme.h>
+#end
+\#include <smithy/identity/auth/built-in/GenericAuthSchemeResolver.h>
 \#include <smithy/client/serializer/${serializer}.h>
 \#include <aws/${metadata.projectName}/${metadata.classNamePrefix}ErrorMarshaller.h>
 
@@ -45,7 +48,7 @@ namespace ${serviceNamespace}
   class ${CppViewHelper.computeExportValue($metadata.classNamePrefix)} ${className}${finalClass} : Aws::Client::ClientWithAsyncTemplateMethods<${className}>,
     smithy::client::AwsSmithyClientT<${rootNamespace}::${serviceNamespace}::SERVICE_NAME,
       ${serviceConfiguration},
-      smithy::${AuthSchemeResolver}<>,
+      smithy::AuthSchemeResolverBase<>,
       ${rootNamespace}::Crt::Variant<${AuthSchemeVariants}>,
       ${metadata.classNamePrefix}EndpointProviderBase,
       smithy::client::$serializer,
diff --git a/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientSource.vm b/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientSource.vm
index c2f06a27eeb..c1de1ec8788 100644
--- a/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientSource.vm
+++ b/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientSource.vm
@@ -18,10 +18,7 @@
 \#include <aws/core/utils/logging/ErrorMacros.h>
 
 #parse("com/amazonaws/util/awsclientgenerator/velocity/cpp/ServiceClientSourceHeaders.vm")
-#if($serviceModel.hasOnlyBearerAuth())
-\#include <smithy/identity/auth/built-in/BearerTokenAuthSchemeResolver.h>
-\#include <smithy/identity/auth/built-in/BearerTokenAuthScheme.h>
-#else
+#if(!$serviceModel.hasOnlyBearerAuth())
 \#include <smithy/identity/resolver/built-in/SimpleAwsCredentialIdentityResolver.h>
 \#include <smithy/identity/resolver/built-in/DefaultAwsCredentialIdentityResolver.h>
 \#include <smithy/identity/resolver/built-in/AwsCredentialsProviderIdentityResolver.h>
diff --git a/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientSourceInit.vm b/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientSourceInit.vm
index 5bb9367b81b..5be03661570 100644
--- a/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientSourceInit.vm
+++ b/tools/code-generation/generator/src/main/resources/com/amazonaws/util/awsclientgenerator/velocity/cpp/smithy/SmithyClientSourceInit.vm
@@ -11,7 +11,7 @@ ${className}::${className}(const Aws::Auth::BearerTokenAuthSignerProvider& beare
       Aws::Http::CreateHttpClient(clientConfiguration),
       Aws::MakeShared<${metadata.classNamePrefix}ErrorMarshaller>(ALLOCATION_TAG),
       endpointProvider ? endpointProvider : Aws::MakeShared<${metadata.classNamePrefix}EndpointProvider>(ALLOCATION_TAG),
-      Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG),
+      Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({$AuthSchemeOptions})),
       {
 #foreach($entry in $AuthSchemeMapEntries)
           {${entry}{Aws::MakeShared<smithy::AwsBearerTokenIdentityResolver>(ALLOCATION_TAG, bearerTokenProvider), GetServiceName(), clientConfiguration.region}},
@@ -28,7 +28,7 @@ ${className}::${className}(const Aws::Auth::BearerTokenAuthSignerProvider& beare
       Aws::Http::CreateHttpClient(clientConfiguration),
       Aws::MakeShared<${metadata.classNamePrefix}ErrorMarshaller>(ALLOCATION_TAG),
       Aws::MakeShared<${metadata.classNamePrefix}EndpointProvider>(ALLOCATION_TAG),
-      Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG),
+      Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({$AuthSchemeOptions})),
       {
 #foreach($entry in $AuthSchemeMapEntries)
           {${entry}{Aws::MakeShared<smithy::AwsBearerTokenIdentityResolver>(ALLOCATION_TAG, bearerTokenProvider), GetServiceName(), clientConfiguration.region}},
@@ -52,7 +52,7 @@ ${className}::${className}(const ${clientConfiguration}& clientConfiguration,
         Aws::MakeShared<${AuthSchemeResolver}>(ALLOCATION_TAG),
 #else
 #if(!$IsMultiAuth)
-        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG),
+        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({$AuthSchemeOptions})),
 #else
         Aws::MakeShared<smithy::${AuthSchemeResolver}>(ALLOCATION_TAG, ${metadata.classNamePrefix}EndpointProvider, ${clientConfiguration}),
 #end
@@ -92,7 +92,7 @@ ${className}::${className}(const AWSCredentials& credentials,
         Aws::MakeShared<${AuthSchemeResolver}>(ALLOCATION_TAG),
 #else
 #if(!$IsMultiAuth)
-        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG),
+        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({$AuthSchemeOptions})),
 #else
         Aws::MakeShared<smithy::${AuthSchemeResolver}>(ALLOCATION_TAG, ${metadata.classNamePrefix}EndpointProvider, ${clientConfiguration}),
 #end
@@ -132,7 +132,7 @@ ${className}::${className}(const std::shared_ptr<AWSCredentialsProvider>& creden
         Aws::MakeShared<${AuthSchemeResolver}>(ALLOCATION_TAG),
 #else
 #if(!$IsMultiAuth)
-        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG),
+        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({$AuthSchemeOptions})),
 #else
         Aws::MakeShared<smithy::${AuthSchemeResolver}>(ALLOCATION_TAG, ${metadata.classNamePrefix}EndpointProvider, ${clientConfiguration}),
 #end
@@ -153,7 +153,7 @@ ${className}::${className}(const std::shared_ptr<AWSCredentialsProvider>& creden
             }()
 #else
 #foreach($entry in $AuthSchemeMapEntries)
-            {${entry}{ Aws::MakeShared<smithy::AwsCredentialsProviderIdentityResolver>(ALLOCATION_TAG, credentialsProvider), GetServiceName(), clientConfiguration.region}}
+            {${entry}{ Aws::MakeShared<smithy::AwsCredentialsProviderIdentityResolver>(ALLOCATION_TAG, credentialsProvider), GetServiceName(), clientConfiguration.region}},
 #end
 #end
         })
@@ -282,13 +282,13 @@ ${className}::${className}(const Client::ClientConfiguration& clientConfiguratio
       Aws::MakeShared<${metadata.classNamePrefix}ErrorMarshaller>(ALLOCATION_TAG),
       Aws::MakeShared<${metadata.classNamePrefix}EndpointProvider>(ALLOCATION_TAG),
 #if(!$IsMultiAuth)
-      Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG),
+      Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({$AuthSchemeOptions})),
 #else
       Aws::MakeShared<smithy::${AuthSchemeResolver}>(ALLOCATION_TAG, ${metadata.classNamePrefix}EndpointProvider, ${clientConfiguration}),
 #end
       {
 #foreach($entry in $AuthSchemeMapEntries)
-          {$entry{Aws::MakeShared<smithy::DefaultAwsCredentialIdentityResolver>(ALLOCATION_TAG), GetServiceName(), clientConfiguration.region}}
+          {$entry{Aws::MakeShared<smithy::DefaultAwsCredentialIdentityResolver>(ALLOCATION_TAG), GetServiceName(), clientConfiguration.region}},
 #end
       })
 {}
@@ -302,13 +302,13 @@ ${className}::${className}(const AWSCredentials& credentials,
         Aws::MakeShared<${metadata.classNamePrefix}ErrorMarshaller>(ALLOCATION_TAG),
         Aws::MakeShared<${metadata.classNamePrefix}EndpointProvider>(ALLOCATION_TAG),
 #if(!$IsMultiAuth)
-        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG),
+        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({$AuthSchemeOptions})),
 #else
         Aws::MakeShared<smithy::${AuthSchemeResolver}>(ALLOCATION_TAG, ${metadata.classNamePrefix}EndpointProvider, ${clientConfiguration}),
 #end
         {
 #foreach($entry in $AuthSchemeMapEntries)
-          {$entry{Aws::MakeShared<smithy::SimpleAwsCredentialIdentityResolver>(ALLOCATION_TAG, credentials), GetServiceName(), clientConfiguration.region}}
+          {$entry{Aws::MakeShared<smithy::SimpleAwsCredentialIdentityResolver>(ALLOCATION_TAG, credentials), GetServiceName(), clientConfiguration.region}},
 #end
         })
 {}
@@ -322,12 +322,12 @@ ${className}::${className}(const std::shared_ptr<AWSCredentialsProvider>& creden
         Aws::MakeShared<${metadata.classNamePrefix}ErrorMarshaller>(ALLOCATION_TAG),
         Aws::MakeShared<${metadata.classNamePrefix}EndpointProvider>(ALLOCATION_TAG),
 #if(!$IsMultiAuth)
-        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG),
+        Aws::MakeShared<smithy::${AuthSchemeResolver}<>>(ALLOCATION_TAG, Aws::Vector<smithy::AuthSchemeOption>({$AuthSchemeOptions})),
 #else
         Aws::MakeShared<smithy::${AuthSchemeResolver}>(ALLOCATION_TAG, ${metadata.classNamePrefix}EndpointProvider, ${clientConfiguration}),
 #end        {
 #foreach($entry in $AuthSchemeMapEntries)
-          {$entry{Aws::MakeShared<smithy::AwsCredentialsProviderIdentityResolver>(ALLOCATION_TAG, credentialsProvider), GetServiceName(), clientConfiguration.region}}
+          {$entry{Aws::MakeShared<smithy::AwsCredentialsProviderIdentityResolver>(ALLOCATION_TAG, credentialsProvider), GetServiceName(), clientConfiguration.region}},
 #end
         })
 {}