2021-03-22 16:29:47 +00:00
// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
package sts
import (
"fmt"
"time"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/awsutil"
"github.com/aws/aws-sdk-go/aws/credentials"
"github.com/aws/aws-sdk-go/aws/request"
)
const opAssumeRole = "AssumeRole"
// AssumeRoleRequest generates a "aws/request.Request" representing the
// client's request for the AssumeRole operation. The "output" return
// value will be populated with the request's response once the request completes
// successfully.
//
// Use "Send" method on the returned Request to send the API call to the service.
// the "output" return value is not valid until after Send returns without error.
//
// See AssumeRole for more information on using the AssumeRole
// API call, and error handling.
//
// This method is useful when you want to inject custom logic or configuration
// into the SDK's request lifecycle. Such as custom headers, or retry logic.
//
2022-08-22 20:13:17 +00:00
// // Example sending a request using the AssumeRoleRequest method.
// req, resp := client.AssumeRoleRequest(params)
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// err := req.Send()
// if err == nil { // resp is now filled
// fmt.Println(resp)
// }
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole
func ( c * STS ) AssumeRoleRequest ( input * AssumeRoleInput ) ( req * request . Request , output * AssumeRoleOutput ) {
op := & request . Operation {
Name : opAssumeRole ,
HTTPMethod : "POST" ,
HTTPPath : "/" ,
}
if input == nil {
input = & AssumeRoleInput { }
}
output = & AssumeRoleOutput { }
req = c . newRequest ( op , input , output )
return
}
// AssumeRole API operation for AWS Security Token Service.
//
// Returns a set of temporary security credentials that you can use to access
2023-01-31 13:51:00 +00:00
// Amazon Web Services resources. These temporary credentials consist of an
// access key ID, a secret access key, and a security token. Typically, you
/ / use AssumeRole within your account or for cross - account access . For a comparison
// of AssumeRole with other API operations that produce temporary credentials,
// see Requesting Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
2022-01-20 09:43:15 +00:00
// and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # Permissions
2021-03-22 16:29:47 +00:00
//
// The temporary security credentials created by AssumeRole can be used to make
2021-09-01 13:20:44 +00:00
// API calls to any Amazon Web Services service with the following exception:
2022-01-20 09:43:15 +00:00
// You cannot call the Amazon Web Services STS GetFederationToken or GetSessionToken
// API operations.
2021-03-22 16:29:47 +00:00
//
// (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// to this operation. You can pass a single JSON policy document to use as an
2022-11-21 20:13:23 +00:00
// inline session policy. You can also specify up to 10 managed policy Amazon
// Resource Names (ARNs) to use as managed session policies. The plaintext that
// you use for both inline and managed session policies can't exceed 2,048 characters.
// Passing policies to this operation returns new temporary credentials. The
// resulting session's permissions are the intersection of the role's identity-based
// policy and the session policies. You can use the role's temporary credentials
// in subsequent Amazon Web Services API calls to access resources in the account
// that owns the role. You cannot use session policies to grant more permissions
// than those allowed by the identity-based policy of the role that is being
// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2023-05-08 20:59:29 +00:00
// When you create a role, you create two policies: a role trust policy that
// specifies who can assume the role, and a permissions policy that specifies
// what can be done with the role. You specify the trusted principal that is
2022-01-20 09:43:15 +00:00
// allowed to assume the role in the role trust policy.
//
// To assume a role from a different account, your Amazon Web Services account
// must be trusted by the role. The trust relationship is defined in the role's
// trust policy when the role is created. That trust policy states which accounts
// are allowed to delegate that access to users in the account.
2021-03-22 16:29:47 +00:00
//
// A user who wants to access a role in a different account must also have permissions
2023-05-08 20:59:29 +00:00
// that are delegated from the account administrator. The administrator must
// attach a policy that allows the user to call AssumeRole for the ARN of the
// role in the other account.
2021-03-22 16:29:47 +00:00
//
2022-01-20 09:43:15 +00:00
// To allow a user to assume a role in the same account, you can do either of
// the following:
//
2022-08-22 20:13:17 +00:00
// - Attach a policy to the user that allows the user to call AssumeRole
// (as long as the role's trust policy trusts the account).
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - Add the user as a principal directly in the role's trust policy.
2021-03-22 16:29:47 +00:00
//
2022-01-20 09:43:15 +00:00
// You can do either because the role’ s trust policy acts as an IAM resource-based
// policy. When a resource-based policy grants access to a principal in the
// same account, no additional identity-based policy is required. For more information
// about trust policies and resource-based policies, see IAM Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # Tags
2021-03-22 16:29:47 +00:00
//
// (Optional) You can pass tag key-value pairs to your session. These tags are
// called session tags. For more information about session tags, see Passing
// Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
// An administrator must grant you the permissions necessary to pass session
// tags. The administrator can also create granular permissions to allow you
// to pass only specific session tags. For more information, see Tutorial: Using
// Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
// in the IAM User Guide.
//
// You can set the session tags as transitive. Transitive tags persist during
// role chaining. For more information, see Chaining Roles with Session Tags
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # Using MFA with AssumeRole
2021-03-22 16:29:47 +00:00
//
// (Optional) You can include multi-factor authentication (MFA) information
// when you call AssumeRole. This is useful for cross-account scenarios to ensure
2021-09-01 13:20:44 +00:00
// that the user that assumes the role has been authenticated with an Amazon
// Web Services MFA device. In that scenario, the trust policy of the role being
// assumed includes a condition that tests for MFA authentication. If the caller
// does not include valid MFA information, the request to assume the role is
// denied. The condition in a trust policy that tests for MFA authentication
// might look like the following example.
2021-03-22 16:29:47 +00:00
//
// "Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}
//
// For more information, see Configuring MFA-Protected API Access (https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html)
// in the IAM User Guide guide.
//
// To use MFA with AssumeRole, you pass values for the SerialNumber and TokenCode
// parameters. The SerialNumber value identifies the user's hardware or virtual
// MFA device. The TokenCode is the time-based one-time password (TOTP) that
// the MFA device produces.
//
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
// with awserr.Error's Code and Message methods to get detailed information about
// the error.
//
// See the AWS API reference guide for AWS Security Token Service's
// API operation AssumeRole for usage and error information.
//
// Returned Error Codes:
2022-08-22 20:13:17 +00:00
//
// - ErrCodeMalformedPolicyDocumentException "MalformedPolicyDocument"
// The request was rejected because the policy document was malformed. The error
// message describes the specific error.
//
// - ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge"
// The request was rejected because the total packed size of the session policies
// and session tags combined was too large. An Amazon Web Services conversion
// compresses the session policy document, session policy ARNs, and session
// tags into a packed binary format that has a separate limit. The error message
// indicates by percentage how close the policies and tags are to the upper
// size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
// You could receive this error even though you meet other defined session policy
// and session tag limits. For more information, see IAM and STS Entity Character
// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
// - ErrCodeRegionDisabledException "RegionDisabledException"
// STS is not activated in the requested region for the account that is being
// asked to generate credentials. The account administrator must use the IAM
// console to activate STS in that region. For more information, see Activating
// and Deactivating Amazon Web Services STS in an Amazon Web Services Region
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
// in the IAM User Guide.
//
// - ErrCodeExpiredTokenException "ExpiredTokenException"
// The web identity token that was passed is expired or is not valid. Get a
// new identity token from the identity provider and then retry the request.
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole
func ( c * STS ) AssumeRole ( input * AssumeRoleInput ) ( * AssumeRoleOutput , error ) {
req , out := c . AssumeRoleRequest ( input )
return out , req . Send ( )
}
// AssumeRoleWithContext is the same as AssumeRole with the addition of
// the ability to pass a context and additional request options.
//
// See AssumeRole for details on how to use this API operation.
//
// The context must be non-nil and will be used for request cancellation. If
// the context is nil a panic will occur. In the future the SDK may create
// sub-contexts for http.Requests. See https://golang.org/pkg/context/
// for more information on using Contexts.
func ( c * STS ) AssumeRoleWithContext ( ctx aws . Context , input * AssumeRoleInput , opts ... request . Option ) ( * AssumeRoleOutput , error ) {
req , out := c . AssumeRoleRequest ( input )
req . SetContext ( ctx )
req . ApplyOptions ( opts ... )
return out , req . Send ( )
}
const opAssumeRoleWithSAML = "AssumeRoleWithSAML"
// AssumeRoleWithSAMLRequest generates a "aws/request.Request" representing the
// client's request for the AssumeRoleWithSAML operation. The "output" return
// value will be populated with the request's response once the request completes
// successfully.
//
// Use "Send" method on the returned Request to send the API call to the service.
// the "output" return value is not valid until after Send returns without error.
//
// See AssumeRoleWithSAML for more information on using the AssumeRoleWithSAML
// API call, and error handling.
//
// This method is useful when you want to inject custom logic or configuration
// into the SDK's request lifecycle. Such as custom headers, or retry logic.
//
2022-08-22 20:13:17 +00:00
// // Example sending a request using the AssumeRoleWithSAMLRequest method.
// req, resp := client.AssumeRoleWithSAMLRequest(params)
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// err := req.Send()
// if err == nil { // resp is now filled
// fmt.Println(resp)
// }
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML
func ( c * STS ) AssumeRoleWithSAMLRequest ( input * AssumeRoleWithSAMLInput ) ( req * request . Request , output * AssumeRoleWithSAMLOutput ) {
op := & request . Operation {
Name : opAssumeRoleWithSAML ,
HTTPMethod : "POST" ,
HTTPPath : "/" ,
}
if input == nil {
input = & AssumeRoleWithSAMLInput { }
}
output = & AssumeRoleWithSAMLOutput { }
req = c . newRequest ( op , input , output )
req . Config . Credentials = credentials . AnonymousCredentials
return
}
// AssumeRoleWithSAML API operation for AWS Security Token Service.
//
// Returns a set of temporary security credentials for users who have been authenticated
// via a SAML authentication response. This operation provides a mechanism for
2021-09-01 13:20:44 +00:00
// tying an enterprise identity store or directory to role-based Amazon Web
// Services access without user-specific credentials or configuration. For a
// comparison of AssumeRoleWithSAML with the other API operations that produce
// temporary credentials, see Requesting Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
2022-01-20 09:43:15 +00:00
// and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
// The temporary security credentials returned by this operation consist of
// an access key ID, a secret access key, and a security token. Applications
2021-09-01 13:20:44 +00:00
// can use these temporary security credentials to sign calls to Amazon Web
// Services services.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// # Session Duration
2021-03-22 16:29:47 +00:00
//
// By default, the temporary security credentials created by AssumeRoleWithSAML
// last for one hour. However, you can use the optional DurationSeconds parameter
// to specify the duration of your session. Your role session lasts for the
// duration that you specify, or until the time specified in the SAML authentication
// response's SessionNotOnOrAfter value, whichever is shorter. You can provide
// a DurationSeconds value from 900 seconds (15 minutes) up to the maximum session
// duration setting for the role. This setting can have a value from 1 hour
// to 12 hours. To learn how to view the maximum value for your role, see View
// the Maximum Session Duration Setting for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session)
// in the IAM User Guide. The maximum session duration limit applies when you
// use the AssumeRole* API operations or the assume-role* CLI commands. However
// the limit does not apply when you use those operations to create a console
// URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html)
// in the IAM User Guide.
//
2021-06-04 08:59:18 +00:00
// Role chaining (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining)
2021-09-01 13:20:44 +00:00
// limits your CLI or Amazon Web Services API role session to a maximum of one
// hour. When you use the AssumeRole API operation to assume a role, you can
// specify the duration of your role session with the DurationSeconds parameter.
// You can specify a parameter value of up to 43200 seconds (12 hours), depending
// on the maximum session duration setting for your role. However, if you assume
2021-06-04 08:59:18 +00:00
// a role using role chaining and provide a DurationSeconds parameter value
// greater than one hour, the operation fails.
//
2022-08-22 20:13:17 +00:00
// # Permissions
2021-03-22 16:29:47 +00:00
//
// The temporary security credentials created by AssumeRoleWithSAML can be used
2021-09-01 13:20:44 +00:00
// to make API calls to any Amazon Web Services service with the following exception:
// you cannot call the STS GetFederationToken or GetSessionToken API operations.
2021-03-22 16:29:47 +00:00
//
// (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// to this operation. You can pass a single JSON policy document to use as an
2022-11-21 20:13:23 +00:00
// inline session policy. You can also specify up to 10 managed policy Amazon
// Resource Names (ARNs) to use as managed session policies. The plaintext that
// you use for both inline and managed session policies can't exceed 2,048 characters.
// Passing policies to this operation returns new temporary credentials. The
// resulting session's permissions are the intersection of the role's identity-based
// policy and the session policies. You can use the role's temporary credentials
// in subsequent Amazon Web Services API calls to access resources in the account
// that owns the role. You cannot use session policies to grant more permissions
// than those allowed by the identity-based policy of the role that is being
// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2021-09-01 13:20:44 +00:00
// Calling AssumeRoleWithSAML does not require the use of Amazon Web Services
// security credentials. The identity of the caller is validated by using keys
// in the metadata document that is uploaded for the SAML provider entity for
// your identity provider.
2021-03-22 16:29:47 +00:00
//
2021-09-01 13:20:44 +00:00
// Calling AssumeRoleWithSAML can result in an entry in your CloudTrail logs.
// The entry includes the value in the NameID element of the SAML assertion.
2021-03-22 16:29:47 +00:00
// We recommend that you use a NameIDType that is not associated with any personally
// identifiable information (PII). For example, you could instead use the persistent
// identifier (urn:oasis:names:tc:SAML:2.0:nameid-format:persistent).
//
2022-08-22 20:13:17 +00:00
// # Tags
2021-03-22 16:29:47 +00:00
//
// (Optional) You can configure your IdP to pass attributes into your SAML assertion
// as session tags. Each session tag consists of a key name and an associated
// value. For more information about session tags, see Passing Session Tags
// in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
2021-06-04 08:59:18 +00:00
// You can pass up to 50 session tags. The plaintext session tag keys can’ t
2021-03-22 16:29:47 +00:00
// exceed 128 characters and the values can’ t exceed 256 characters. For these
// and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
//
// You can pass a session tag with the same key as a tag that is attached to
// the role. When you do, session tags override the role's tags with the same
// key.
//
// An administrator must grant you the permissions necessary to pass session
// tags. The administrator can also create granular permissions to allow you
// to pass only specific session tags. For more information, see Tutorial: Using
// Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
// in the IAM User Guide.
//
// You can set the session tags as transitive. Transitive tags persist during
// role chaining. For more information, see Chaining Roles with Session Tags
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # SAML Configuration
2021-03-22 16:29:47 +00:00
//
// Before your application can call AssumeRoleWithSAML, you must configure your
2021-09-01 13:20:44 +00:00
// SAML identity provider (IdP) to issue the claims required by Amazon Web Services.
// Additionally, you must use Identity and Access Management (IAM) to create
// a SAML provider entity in your Amazon Web Services account that represents
// your identity provider. You must also create an IAM role that specifies this
// SAML provider in its trust policy.
2021-03-22 16:29:47 +00:00
//
// For more information, see the following resources:
//
2022-08-22 20:13:17 +00:00
// - About SAML 2.0-based Federation (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - Creating SAML Identity Providers (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - Configuring a Relying Party and Claims (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_relying-party.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - Creating a Role for SAML 2.0 Federation (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_saml.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
// with awserr.Error's Code and Message methods to get detailed information about
// the error.
//
// See the AWS API reference guide for AWS Security Token Service's
// API operation AssumeRoleWithSAML for usage and error information.
//
// Returned Error Codes:
2022-08-22 20:13:17 +00:00
//
// - ErrCodeMalformedPolicyDocumentException "MalformedPolicyDocument"
// The request was rejected because the policy document was malformed. The error
// message describes the specific error.
//
// - ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge"
// The request was rejected because the total packed size of the session policies
// and session tags combined was too large. An Amazon Web Services conversion
// compresses the session policy document, session policy ARNs, and session
// tags into a packed binary format that has a separate limit. The error message
// indicates by percentage how close the policies and tags are to the upper
// size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
// You could receive this error even though you meet other defined session policy
// and session tag limits. For more information, see IAM and STS Entity Character
// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
// - ErrCodeIDPRejectedClaimException "IDPRejectedClaim"
// The identity provider (IdP) reported that authentication failed. This might
// be because the claim is invalid.
//
// If this error is returned for the AssumeRoleWithWebIdentity operation, it
// can also mean that the claim has expired or has been explicitly revoked.
//
// - ErrCodeInvalidIdentityTokenException "InvalidIdentityToken"
// The web identity token that was passed could not be validated by Amazon Web
// Services. Get a new identity token from the identity provider and then retry
// the request.
//
// - ErrCodeExpiredTokenException "ExpiredTokenException"
// The web identity token that was passed is expired or is not valid. Get a
// new identity token from the identity provider and then retry the request.
//
// - ErrCodeRegionDisabledException "RegionDisabledException"
// STS is not activated in the requested region for the account that is being
// asked to generate credentials. The account administrator must use the IAM
// console to activate STS in that region. For more information, see Activating
// and Deactivating Amazon Web Services STS in an Amazon Web Services Region
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML
func ( c * STS ) AssumeRoleWithSAML ( input * AssumeRoleWithSAMLInput ) ( * AssumeRoleWithSAMLOutput , error ) {
req , out := c . AssumeRoleWithSAMLRequest ( input )
return out , req . Send ( )
}
// AssumeRoleWithSAMLWithContext is the same as AssumeRoleWithSAML with the addition of
// the ability to pass a context and additional request options.
//
// See AssumeRoleWithSAML for details on how to use this API operation.
//
// The context must be non-nil and will be used for request cancellation. If
// the context is nil a panic will occur. In the future the SDK may create
// sub-contexts for http.Requests. See https://golang.org/pkg/context/
// for more information on using Contexts.
func ( c * STS ) AssumeRoleWithSAMLWithContext ( ctx aws . Context , input * AssumeRoleWithSAMLInput , opts ... request . Option ) ( * AssumeRoleWithSAMLOutput , error ) {
req , out := c . AssumeRoleWithSAMLRequest ( input )
req . SetContext ( ctx )
req . ApplyOptions ( opts ... )
return out , req . Send ( )
}
const opAssumeRoleWithWebIdentity = "AssumeRoleWithWebIdentity"
// AssumeRoleWithWebIdentityRequest generates a "aws/request.Request" representing the
// client's request for the AssumeRoleWithWebIdentity operation. The "output" return
// value will be populated with the request's response once the request completes
// successfully.
//
// Use "Send" method on the returned Request to send the API call to the service.
// the "output" return value is not valid until after Send returns without error.
//
// See AssumeRoleWithWebIdentity for more information on using the AssumeRoleWithWebIdentity
// API call, and error handling.
//
// This method is useful when you want to inject custom logic or configuration
// into the SDK's request lifecycle. Such as custom headers, or retry logic.
//
2022-08-22 20:13:17 +00:00
// // Example sending a request using the AssumeRoleWithWebIdentityRequest method.
// req, resp := client.AssumeRoleWithWebIdentityRequest(params)
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// err := req.Send()
// if err == nil { // resp is now filled
// fmt.Println(resp)
// }
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity
func ( c * STS ) AssumeRoleWithWebIdentityRequest ( input * AssumeRoleWithWebIdentityInput ) ( req * request . Request , output * AssumeRoleWithWebIdentityOutput ) {
op := & request . Operation {
Name : opAssumeRoleWithWebIdentity ,
HTTPMethod : "POST" ,
HTTPPath : "/" ,
}
if input == nil {
input = & AssumeRoleWithWebIdentityInput { }
}
output = & AssumeRoleWithWebIdentityOutput { }
req = c . newRequest ( op , input , output )
req . Config . Credentials = credentials . AnonymousCredentials
return
}
// AssumeRoleWithWebIdentity API operation for AWS Security Token Service.
//
// Returns a set of temporary security credentials for users who have been authenticated
// in a mobile or web application with a web identity provider. Example providers
2022-03-07 20:22:29 +00:00
// include the OAuth 2.0 providers Login with Amazon and Facebook, or any OpenID
// Connect-compatible identity provider such as Google or Amazon Cognito federated
// identities (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html).
2021-03-22 16:29:47 +00:00
//
// For mobile applications, we recommend that you use Amazon Cognito. You can
2021-09-01 13:20:44 +00:00
// use Amazon Cognito with the Amazon Web Services SDK for iOS Developer Guide
// (http://aws.amazon.com/sdkforios/) and the Amazon Web Services SDK for Android
// Developer Guide (http://aws.amazon.com/sdkforandroid/) to uniquely identify
// a user. You can also supply the user with a consistent identity throughout
// the lifetime of an application.
2021-03-22 16:29:47 +00:00
//
2023-05-08 20:59:29 +00:00
// To learn more about Amazon Cognito, see Amazon Cognito identity pools (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html)
// in Amazon Cognito Developer Guide.
2021-09-01 13:20:44 +00:00
//
// Calling AssumeRoleWithWebIdentity does not require the use of Amazon Web
// Services security credentials. Therefore, you can distribute an application
// (for example, on mobile devices) that requests temporary security credentials
// without including long-term Amazon Web Services credentials in the application.
// You also don't need to deploy server-based proxy services that use long-term
// Amazon Web Services credentials. Instead, the identity of the caller is validated
// by using a token from the web identity provider. For a comparison of AssumeRoleWithWebIdentity
// with the other API operations that produce temporary credentials, see Requesting
// Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
2022-01-20 09:43:15 +00:00
// and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
// The temporary security credentials returned by this API consist of an access
// key ID, a secret access key, and a security token. Applications can use these
2021-09-01 13:20:44 +00:00
// temporary security credentials to sign calls to Amazon Web Services service
// API operations.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// # Session Duration
2021-03-22 16:29:47 +00:00
//
// By default, the temporary security credentials created by AssumeRoleWithWebIdentity
// last for one hour. However, you can use the optional DurationSeconds parameter
// to specify the duration of your session. You can provide a value from 900
// seconds (15 minutes) up to the maximum session duration setting for the role.
// This setting can have a value from 1 hour to 12 hours. To learn how to view
// the maximum value for your role, see View the Maximum Session Duration Setting
// for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session)
// in the IAM User Guide. The maximum session duration limit applies when you
// use the AssumeRole* API operations or the assume-role* CLI commands. However
// the limit does not apply when you use those operations to create a console
// URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html)
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # Permissions
2021-03-22 16:29:47 +00:00
//
// The temporary security credentials created by AssumeRoleWithWebIdentity can
2021-09-01 13:20:44 +00:00
// be used to make API calls to any Amazon Web Services service with the following
// exception: you cannot call the STS GetFederationToken or GetSessionToken
// API operations.
2021-03-22 16:29:47 +00:00
//
// (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// to this operation. You can pass a single JSON policy document to use as an
2022-11-21 20:13:23 +00:00
// inline session policy. You can also specify up to 10 managed policy Amazon
// Resource Names (ARNs) to use as managed session policies. The plaintext that
// you use for both inline and managed session policies can't exceed 2,048 characters.
// Passing policies to this operation returns new temporary credentials. The
// resulting session's permissions are the intersection of the role's identity-based
// policy and the session policies. You can use the role's temporary credentials
// in subsequent Amazon Web Services API calls to access resources in the account
// that owns the role. You cannot use session policies to grant more permissions
// than those allowed by the identity-based policy of the role that is being
// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # Tags
2021-03-22 16:29:47 +00:00
//
// (Optional) You can configure your IdP to pass attributes into your web identity
// token as session tags. Each session tag consists of a key name and an associated
// value. For more information about session tags, see Passing Session Tags
// in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
2021-06-04 08:59:18 +00:00
// You can pass up to 50 session tags. The plaintext session tag keys can’ t
2021-03-22 16:29:47 +00:00
// exceed 128 characters and the values can’ t exceed 256 characters. For these
// and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
//
// You can pass a session tag with the same key as a tag that is attached to
// the role. When you do, the session tag overrides the role tag with the same
// key.
//
// An administrator must grant you the permissions necessary to pass session
// tags. The administrator can also create granular permissions to allow you
// to pass only specific session tags. For more information, see Tutorial: Using
// Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
// in the IAM User Guide.
//
// You can set the session tags as transitive. Transitive tags persist during
// role chaining. For more information, see Chaining Roles with Session Tags
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # Identities
2021-03-22 16:29:47 +00:00
//
// Before your application can call AssumeRoleWithWebIdentity, you must have
// an identity token from a supported identity provider and create a role that
// the application can assume. The role that your application assumes must trust
// the identity provider that is associated with the identity token. In other
// words, the identity provider must be specified in the role's trust policy.
//
2021-09-01 13:20:44 +00:00
// Calling AssumeRoleWithWebIdentity can result in an entry in your CloudTrail
2021-03-22 16:29:47 +00:00
// logs. The entry includes the Subject (http://openid.net/specs/openid-connect-core-1_0.html#Claims)
2021-06-04 08:59:18 +00:00
// of the provided web identity token. We recommend that you avoid using any
2021-03-22 16:29:47 +00:00
// personally identifiable information (PII) in this field. For example, you
// could instead use a GUID or a pairwise identifier, as suggested in the OIDC
// specification (http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes).
//
// For more information about how to use web identity federation and the AssumeRoleWithWebIdentity
// API, see the following resources:
//
2022-08-22 20:13:17 +00:00
// - Using Web Identity Federation API Operations for Mobile Apps (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html)
// and Federation Through a Web-based Identity Provider (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity).
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - Web Identity Federation Playground (https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/).
// Walk through the process of authenticating through Login with Amazon,
// Facebook, or Google, getting temporary security credentials, and then
// using those credentials to make a request to Amazon Web Services.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - Amazon Web Services SDK for iOS Developer Guide (http://aws.amazon.com/sdkforios/)
// and Amazon Web Services SDK for Android Developer Guide (http://aws.amazon.com/sdkforandroid/).
// These toolkits contain sample apps that show how to invoke the identity
// providers. The toolkits then show how to use the information from these
// providers to get and use temporary security credentials.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - Web Identity Federation with Mobile Applications (http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications).
// This article discusses web identity federation and shows an example of
// how to use web identity federation to get access to content in Amazon
// S3.
2021-03-22 16:29:47 +00:00
//
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
// with awserr.Error's Code and Message methods to get detailed information about
// the error.
//
// See the AWS API reference guide for AWS Security Token Service's
// API operation AssumeRoleWithWebIdentity for usage and error information.
//
// Returned Error Codes:
2022-08-22 20:13:17 +00:00
//
// - ErrCodeMalformedPolicyDocumentException "MalformedPolicyDocument"
// The request was rejected because the policy document was malformed. The error
// message describes the specific error.
//
// - ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge"
// The request was rejected because the total packed size of the session policies
// and session tags combined was too large. An Amazon Web Services conversion
// compresses the session policy document, session policy ARNs, and session
// tags into a packed binary format that has a separate limit. The error message
// indicates by percentage how close the policies and tags are to the upper
// size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
// You could receive this error even though you meet other defined session policy
// and session tag limits. For more information, see IAM and STS Entity Character
// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
// - ErrCodeIDPRejectedClaimException "IDPRejectedClaim"
// The identity provider (IdP) reported that authentication failed. This might
// be because the claim is invalid.
//
// If this error is returned for the AssumeRoleWithWebIdentity operation, it
// can also mean that the claim has expired or has been explicitly revoked.
//
// - ErrCodeIDPCommunicationErrorException "IDPCommunicationError"
// The request could not be fulfilled because the identity provider (IDP) that
// was asked to verify the incoming identity token could not be reached. This
// is often a transient error caused by network conditions. Retry the request
// a limited number of times so that you don't exceed the request rate. If the
// error persists, the identity provider might be down or not responding.
//
// - ErrCodeInvalidIdentityTokenException "InvalidIdentityToken"
// The web identity token that was passed could not be validated by Amazon Web
// Services. Get a new identity token from the identity provider and then retry
// the request.
//
// - ErrCodeExpiredTokenException "ExpiredTokenException"
// The web identity token that was passed is expired or is not valid. Get a
// new identity token from the identity provider and then retry the request.
//
// - ErrCodeRegionDisabledException "RegionDisabledException"
// STS is not activated in the requested region for the account that is being
// asked to generate credentials. The account administrator must use the IAM
// console to activate STS in that region. For more information, see Activating
// and Deactivating Amazon Web Services STS in an Amazon Web Services Region
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity
func ( c * STS ) AssumeRoleWithWebIdentity ( input * AssumeRoleWithWebIdentityInput ) ( * AssumeRoleWithWebIdentityOutput , error ) {
req , out := c . AssumeRoleWithWebIdentityRequest ( input )
return out , req . Send ( )
}
// AssumeRoleWithWebIdentityWithContext is the same as AssumeRoleWithWebIdentity with the addition of
// the ability to pass a context and additional request options.
//
// See AssumeRoleWithWebIdentity for details on how to use this API operation.
//
// The context must be non-nil and will be used for request cancellation. If
// the context is nil a panic will occur. In the future the SDK may create
// sub-contexts for http.Requests. See https://golang.org/pkg/context/
// for more information on using Contexts.
func ( c * STS ) AssumeRoleWithWebIdentityWithContext ( ctx aws . Context , input * AssumeRoleWithWebIdentityInput , opts ... request . Option ) ( * AssumeRoleWithWebIdentityOutput , error ) {
req , out := c . AssumeRoleWithWebIdentityRequest ( input )
req . SetContext ( ctx )
req . ApplyOptions ( opts ... )
return out , req . Send ( )
}
const opDecodeAuthorizationMessage = "DecodeAuthorizationMessage"
// DecodeAuthorizationMessageRequest generates a "aws/request.Request" representing the
// client's request for the DecodeAuthorizationMessage operation. The "output" return
// value will be populated with the request's response once the request completes
// successfully.
//
// Use "Send" method on the returned Request to send the API call to the service.
// the "output" return value is not valid until after Send returns without error.
//
// See DecodeAuthorizationMessage for more information on using the DecodeAuthorizationMessage
// API call, and error handling.
//
// This method is useful when you want to inject custom logic or configuration
// into the SDK's request lifecycle. Such as custom headers, or retry logic.
//
2022-08-22 20:13:17 +00:00
// // Example sending a request using the DecodeAuthorizationMessageRequest method.
// req, resp := client.DecodeAuthorizationMessageRequest(params)
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// err := req.Send()
// if err == nil { // resp is now filled
// fmt.Println(resp)
// }
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage
func ( c * STS ) DecodeAuthorizationMessageRequest ( input * DecodeAuthorizationMessageInput ) ( req * request . Request , output * DecodeAuthorizationMessageOutput ) {
op := & request . Operation {
Name : opDecodeAuthorizationMessage ,
HTTPMethod : "POST" ,
HTTPPath : "/" ,
}
if input == nil {
input = & DecodeAuthorizationMessageInput { }
}
output = & DecodeAuthorizationMessageOutput { }
req = c . newRequest ( op , input , output )
return
}
// DecodeAuthorizationMessage API operation for AWS Security Token Service.
//
// Decodes additional information about the authorization status of a request
2021-09-01 13:20:44 +00:00
// from an encoded message returned in response to an Amazon Web Services request.
2021-03-22 16:29:47 +00:00
//
// For example, if a user is not authorized to perform an operation that he
// or she has requested, the request returns a Client.UnauthorizedOperation
2021-09-01 13:20:44 +00:00
// response (an HTTP 403 response). Some Amazon Web Services operations additionally
// return an encoded message that can provide details about this authorization
// failure.
2021-03-22 16:29:47 +00:00
//
2021-09-01 13:20:44 +00:00
// Only certain Amazon Web Services operations return an encoded authorization
// message. The documentation for an individual operation indicates whether
// that operation returns an encoded message in addition to returning an HTTP
// code.
2021-03-22 16:29:47 +00:00
//
// The message is encoded because the details of the authorization status can
2022-01-20 09:43:15 +00:00
// contain privileged information that the user who requested the operation
2021-03-22 16:29:47 +00:00
// should not see. To decode an authorization status message, a user must be
2022-01-20 09:43:15 +00:00
// granted permissions through an IAM policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)
// to request the DecodeAuthorizationMessage (sts:DecodeAuthorizationMessage)
// action.
2021-03-22 16:29:47 +00:00
//
// The decoded message includes the following type of information:
//
2022-08-22 20:13:17 +00:00
// - Whether the request was denied due to an explicit deny or due to the
// absence of an explicit allow. For more information, see Determining Whether
// a Request is Allowed or Denied (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - The principal who made the request.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - The requested action.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - The requested resource.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - The values of condition keys in the context of the user's request.
2021-03-22 16:29:47 +00:00
//
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
// with awserr.Error's Code and Message methods to get detailed information about
// the error.
//
// See the AWS API reference guide for AWS Security Token Service's
// API operation DecodeAuthorizationMessage for usage and error information.
//
// Returned Error Codes:
2022-08-22 20:13:17 +00:00
// - ErrCodeInvalidAuthorizationMessageException "InvalidAuthorizationMessageException"
// The error returned if the message passed to DecodeAuthorizationMessage was
// invalid. This can happen if the token contains invalid characters, such as
// linebreaks.
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage
func ( c * STS ) DecodeAuthorizationMessage ( input * DecodeAuthorizationMessageInput ) ( * DecodeAuthorizationMessageOutput , error ) {
req , out := c . DecodeAuthorizationMessageRequest ( input )
return out , req . Send ( )
}
// DecodeAuthorizationMessageWithContext is the same as DecodeAuthorizationMessage with the addition of
// the ability to pass a context and additional request options.
//
// See DecodeAuthorizationMessage for details on how to use this API operation.
//
// The context must be non-nil and will be used for request cancellation. If
// the context is nil a panic will occur. In the future the SDK may create
// sub-contexts for http.Requests. See https://golang.org/pkg/context/
// for more information on using Contexts.
func ( c * STS ) DecodeAuthorizationMessageWithContext ( ctx aws . Context , input * DecodeAuthorizationMessageInput , opts ... request . Option ) ( * DecodeAuthorizationMessageOutput , error ) {
req , out := c . DecodeAuthorizationMessageRequest ( input )
req . SetContext ( ctx )
req . ApplyOptions ( opts ... )
return out , req . Send ( )
}
const opGetAccessKeyInfo = "GetAccessKeyInfo"
// GetAccessKeyInfoRequest generates a "aws/request.Request" representing the
// client's request for the GetAccessKeyInfo operation. The "output" return
// value will be populated with the request's response once the request completes
// successfully.
//
// Use "Send" method on the returned Request to send the API call to the service.
// the "output" return value is not valid until after Send returns without error.
//
// See GetAccessKeyInfo for more information on using the GetAccessKeyInfo
// API call, and error handling.
//
// This method is useful when you want to inject custom logic or configuration
// into the SDK's request lifecycle. Such as custom headers, or retry logic.
//
2022-08-22 20:13:17 +00:00
// // Example sending a request using the GetAccessKeyInfoRequest method.
// req, resp := client.GetAccessKeyInfoRequest(params)
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// err := req.Send()
// if err == nil { // resp is now filled
// fmt.Println(resp)
// }
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo
func ( c * STS ) GetAccessKeyInfoRequest ( input * GetAccessKeyInfoInput ) ( req * request . Request , output * GetAccessKeyInfoOutput ) {
op := & request . Operation {
Name : opGetAccessKeyInfo ,
HTTPMethod : "POST" ,
HTTPPath : "/" ,
}
if input == nil {
input = & GetAccessKeyInfoInput { }
}
output = & GetAccessKeyInfoOutput { }
req = c . newRequest ( op , input , output )
return
}
// GetAccessKeyInfo API operation for AWS Security Token Service.
//
// Returns the account identifier for the specified access key ID.
//
// Access keys consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE)
// and a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY).
// For more information about access keys, see Managing Access Keys for IAM
// Users (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)
// in the IAM User Guide.
//
// When you pass an access key ID to this operation, it returns the ID of the
2021-09-01 13:20:44 +00:00
// Amazon Web Services account to which the keys belong. Access key IDs beginning
// with AKIA are long-term credentials for an IAM user or the Amazon Web Services
// account root user. Access key IDs beginning with ASIA are temporary credentials
// that are created using STS operations. If the account in the response belongs
// to you, you can sign in as the root user and review your root user access
// keys. Then, you can pull a credentials report (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
2021-03-22 16:29:47 +00:00
// to learn which IAM user owns the keys. To learn who requested the temporary
// credentials for an ASIA access key, view the STS events in your CloudTrail
// logs (https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html)
// in the IAM User Guide.
//
// This operation does not indicate the state of the access key. The key might
// be active, inactive, or deleted. Active keys might not have permissions to
// perform an operation. Providing a deleted access key might return an error
// that the key doesn't exist.
//
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
// with awserr.Error's Code and Message methods to get detailed information about
// the error.
//
// See the AWS API reference guide for AWS Security Token Service's
// API operation GetAccessKeyInfo for usage and error information.
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo
func ( c * STS ) GetAccessKeyInfo ( input * GetAccessKeyInfoInput ) ( * GetAccessKeyInfoOutput , error ) {
req , out := c . GetAccessKeyInfoRequest ( input )
return out , req . Send ( )
}
// GetAccessKeyInfoWithContext is the same as GetAccessKeyInfo with the addition of
// the ability to pass a context and additional request options.
//
// See GetAccessKeyInfo for details on how to use this API operation.
//
// The context must be non-nil and will be used for request cancellation. If
// the context is nil a panic will occur. In the future the SDK may create
// sub-contexts for http.Requests. See https://golang.org/pkg/context/
// for more information on using Contexts.
func ( c * STS ) GetAccessKeyInfoWithContext ( ctx aws . Context , input * GetAccessKeyInfoInput , opts ... request . Option ) ( * GetAccessKeyInfoOutput , error ) {
req , out := c . GetAccessKeyInfoRequest ( input )
req . SetContext ( ctx )
req . ApplyOptions ( opts ... )
return out , req . Send ( )
}
const opGetCallerIdentity = "GetCallerIdentity"
// GetCallerIdentityRequest generates a "aws/request.Request" representing the
// client's request for the GetCallerIdentity operation. The "output" return
// value will be populated with the request's response once the request completes
// successfully.
//
// Use "Send" method on the returned Request to send the API call to the service.
// the "output" return value is not valid until after Send returns without error.
//
// See GetCallerIdentity for more information on using the GetCallerIdentity
// API call, and error handling.
//
// This method is useful when you want to inject custom logic or configuration
// into the SDK's request lifecycle. Such as custom headers, or retry logic.
//
2022-08-22 20:13:17 +00:00
// // Example sending a request using the GetCallerIdentityRequest method.
// req, resp := client.GetCallerIdentityRequest(params)
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// err := req.Send()
// if err == nil { // resp is now filled
// fmt.Println(resp)
// }
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity
func ( c * STS ) GetCallerIdentityRequest ( input * GetCallerIdentityInput ) ( req * request . Request , output * GetCallerIdentityOutput ) {
op := & request . Operation {
Name : opGetCallerIdentity ,
HTTPMethod : "POST" ,
HTTPPath : "/" ,
}
if input == nil {
input = & GetCallerIdentityInput { }
}
output = & GetCallerIdentityOutput { }
req = c . newRequest ( op , input , output )
return
}
// GetCallerIdentity API operation for AWS Security Token Service.
//
// Returns details about the IAM user or role whose credentials are used to
// call the operation.
//
// No permissions are required to perform this operation. If an administrator
2023-05-08 20:59:29 +00:00
// attaches a policy to your identity that explicitly denies access to the sts:GetCallerIdentity
// action, you can still perform this operation. Permissions are not required
// because the same information is returned when access is denied. To view an
// example response, see I Am Not Authorized to Perform: iam:DeleteVirtualMFADevice
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
// with awserr.Error's Code and Message methods to get detailed information about
// the error.
//
// See the AWS API reference guide for AWS Security Token Service's
// API operation GetCallerIdentity for usage and error information.
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity
func ( c * STS ) GetCallerIdentity ( input * GetCallerIdentityInput ) ( * GetCallerIdentityOutput , error ) {
req , out := c . GetCallerIdentityRequest ( input )
return out , req . Send ( )
}
// GetCallerIdentityWithContext is the same as GetCallerIdentity with the addition of
// the ability to pass a context and additional request options.
//
// See GetCallerIdentity for details on how to use this API operation.
//
// The context must be non-nil and will be used for request cancellation. If
// the context is nil a panic will occur. In the future the SDK may create
// sub-contexts for http.Requests. See https://golang.org/pkg/context/
// for more information on using Contexts.
func ( c * STS ) GetCallerIdentityWithContext ( ctx aws . Context , input * GetCallerIdentityInput , opts ... request . Option ) ( * GetCallerIdentityOutput , error ) {
req , out := c . GetCallerIdentityRequest ( input )
req . SetContext ( ctx )
req . ApplyOptions ( opts ... )
return out , req . Send ( )
}
const opGetFederationToken = "GetFederationToken"
// GetFederationTokenRequest generates a "aws/request.Request" representing the
// client's request for the GetFederationToken operation. The "output" return
// value will be populated with the request's response once the request completes
// successfully.
//
// Use "Send" method on the returned Request to send the API call to the service.
// the "output" return value is not valid until after Send returns without error.
//
// See GetFederationToken for more information on using the GetFederationToken
// API call, and error handling.
//
// This method is useful when you want to inject custom logic or configuration
// into the SDK's request lifecycle. Such as custom headers, or retry logic.
//
2022-08-22 20:13:17 +00:00
// // Example sending a request using the GetFederationTokenRequest method.
// req, resp := client.GetFederationTokenRequest(params)
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// err := req.Send()
// if err == nil { // resp is now filled
// fmt.Println(resp)
// }
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken
func ( c * STS ) GetFederationTokenRequest ( input * GetFederationTokenInput ) ( req * request . Request , output * GetFederationTokenOutput ) {
op := & request . Operation {
Name : opGetFederationToken ,
HTTPMethod : "POST" ,
HTTPPath : "/" ,
}
if input == nil {
input = & GetFederationTokenInput { }
}
output = & GetFederationTokenOutput { }
req = c . newRequest ( op , input , output )
return
}
// GetFederationToken API operation for AWS Security Token Service.
//
// Returns a set of temporary security credentials (consisting of an access
2023-05-08 20:59:29 +00:00
// key ID, a secret access key, and a security token) for a user. A typical
// use is in a proxy application that gets temporary security credentials on
// behalf of distributed applications inside a corporate network.
//
// You must call the GetFederationToken operation using the long-term security
// credentials of an IAM user. As a result, this call is appropriate in contexts
// where those credentials can be safeguarded, usually in a server-based application.
2021-03-22 16:29:47 +00:00
// For a comparison of GetFederationToken with the other API operations that
// produce temporary credentials, see Requesting Temporary Security Credentials
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
2022-01-20 09:43:15 +00:00
// and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2023-05-08 20:59:29 +00:00
// Although it is possible to call GetFederationToken using the security credentials
// of an Amazon Web Services account root user rather than an IAM user that
// you create for the purpose of a proxy application, we do not recommend it.
// For more information, see Safeguard your root user credentials and don't
// use them for everyday tasks (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials)
// in the IAM User Guide.
//
2021-03-22 16:29:47 +00:00
// You can create a mobile-based or browser-based app that can authenticate
// users using a web identity provider like Login with Amazon, Facebook, Google,
// or an OpenID Connect-compatible identity provider. In this case, we recommend
// that you use Amazon Cognito (http://aws.amazon.com/cognito/) or AssumeRoleWithWebIdentity.
// For more information, see Federation Through a Web-based Identity Provider
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity)
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # Session duration
2021-03-22 16:29:47 +00:00
//
// The temporary credentials are valid for the specified duration, from 900
// seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours). The default
2022-01-20 09:43:15 +00:00
// session duration is 43,200 seconds (12 hours). Temporary credentials obtained
2023-05-08 20:59:29 +00:00
// by using the root user credentials have a maximum duration of 3,600 seconds
// (1 hour).
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// # Permissions
2021-03-22 16:29:47 +00:00
//
// You can use the temporary credentials created by GetFederationToken in any
2023-01-31 13:51:00 +00:00
// Amazon Web Services service with the following exceptions:
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - You cannot call any IAM operations using the CLI or the Amazon Web Services
2023-01-31 13:51:00 +00:00
// API. This limitation does not apply to console sessions.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - You cannot call any STS operations except GetCallerIdentity.
2021-03-22 16:29:47 +00:00
//
2023-01-31 13:51:00 +00:00
// You can use temporary credentials for single sign-on (SSO) to the console.
//
2021-03-22 16:29:47 +00:00
// You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// to this operation. You can pass a single JSON policy document to use as an
2022-11-21 20:13:23 +00:00
// inline session policy. You can also specify up to 10 managed policy Amazon
// Resource Names (ARNs) to use as managed session policies. The plaintext that
// you use for both inline and managed session policies can't exceed 2,048 characters.
2021-06-04 08:59:18 +00:00
//
// Though the session policy parameters are optional, if you do not pass a policy,
// then the resulting federated user session has no permissions. When you pass
// session policies, the session permissions are the intersection of the IAM
// user policies and the session policies that you pass. This gives you a way
// to further restrict the permissions for a federated user. You cannot use
// session policies to grant more permissions than those that are defined in
// the permissions policy of the IAM user. For more information, see Session
// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// in the IAM User Guide. For information about using GetFederationToken to
// create temporary security credentials, see GetFederationToken—Federation
// Through a Custom Identity Broker (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken).
//
// You can use the credentials to access a resource that has a resource-based
// policy. If that policy specifically references the federated user session
// in the Principal element of the policy, the session has the permissions allowed
// by the policy. These permissions are granted in addition to the permissions
// granted by the session policies.
//
2022-08-22 20:13:17 +00:00
// # Tags
2021-06-04 08:59:18 +00:00
//
// (Optional) You can pass tag key-value pairs to your session. These are called
// session tags. For more information about session tags, see Passing Session
// Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
// You can create a mobile-based or browser-based app that can authenticate
// users using a web identity provider like Login with Amazon, Facebook, Google,
// or an OpenID Connect-compatible identity provider. In this case, we recommend
// that you use Amazon Cognito (http://aws.amazon.com/cognito/) or AssumeRoleWithWebIdentity.
// For more information, see Federation Through a Web-based Identity Provider
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity)
// in the IAM User Guide.
//
2021-03-22 16:29:47 +00:00
// An administrator must grant you the permissions necessary to pass session
// tags. The administrator can also create granular permissions to allow you
// to pass only specific session tags. For more information, see Tutorial: Using
// Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
// in the IAM User Guide.
//
// Tag key– value pairs are not case sensitive, but case is preserved. This
// means that you cannot have separate Department and department tag keys. Assume
// that the user that you are federating has the Department=Marketing tag and
// you pass the department=engineering session tag. Department and department
// are not saved as separate tags, and the session tag passed in the request
// takes precedence over the user tag.
//
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
// with awserr.Error's Code and Message methods to get detailed information about
// the error.
//
// See the AWS API reference guide for AWS Security Token Service's
// API operation GetFederationToken for usage and error information.
//
// Returned Error Codes:
2022-08-22 20:13:17 +00:00
//
// - ErrCodeMalformedPolicyDocumentException "MalformedPolicyDocument"
// The request was rejected because the policy document was malformed. The error
// message describes the specific error.
//
// - ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge"
// The request was rejected because the total packed size of the session policies
// and session tags combined was too large. An Amazon Web Services conversion
// compresses the session policy document, session policy ARNs, and session
// tags into a packed binary format that has a separate limit. The error message
// indicates by percentage how close the policies and tags are to the upper
// size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
// You could receive this error even though you meet other defined session policy
// and session tag limits. For more information, see IAM and STS Entity Character
// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
// - ErrCodeRegionDisabledException "RegionDisabledException"
// STS is not activated in the requested region for the account that is being
// asked to generate credentials. The account administrator must use the IAM
// console to activate STS in that region. For more information, see Activating
// and Deactivating Amazon Web Services STS in an Amazon Web Services Region
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken
func ( c * STS ) GetFederationToken ( input * GetFederationTokenInput ) ( * GetFederationTokenOutput , error ) {
req , out := c . GetFederationTokenRequest ( input )
return out , req . Send ( )
}
// GetFederationTokenWithContext is the same as GetFederationToken with the addition of
// the ability to pass a context and additional request options.
//
// See GetFederationToken for details on how to use this API operation.
//
// The context must be non-nil and will be used for request cancellation. If
// the context is nil a panic will occur. In the future the SDK may create
// sub-contexts for http.Requests. See https://golang.org/pkg/context/
// for more information on using Contexts.
func ( c * STS ) GetFederationTokenWithContext ( ctx aws . Context , input * GetFederationTokenInput , opts ... request . Option ) ( * GetFederationTokenOutput , error ) {
req , out := c . GetFederationTokenRequest ( input )
req . SetContext ( ctx )
req . ApplyOptions ( opts ... )
return out , req . Send ( )
}
const opGetSessionToken = "GetSessionToken"
// GetSessionTokenRequest generates a "aws/request.Request" representing the
// client's request for the GetSessionToken operation. The "output" return
// value will be populated with the request's response once the request completes
// successfully.
//
// Use "Send" method on the returned Request to send the API call to the service.
// the "output" return value is not valid until after Send returns without error.
//
// See GetSessionToken for more information on using the GetSessionToken
// API call, and error handling.
//
// This method is useful when you want to inject custom logic or configuration
// into the SDK's request lifecycle. Such as custom headers, or retry logic.
//
2022-08-22 20:13:17 +00:00
// // Example sending a request using the GetSessionTokenRequest method.
// req, resp := client.GetSessionTokenRequest(params)
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// err := req.Send()
// if err == nil { // resp is now filled
// fmt.Println(resp)
// }
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken
func ( c * STS ) GetSessionTokenRequest ( input * GetSessionTokenInput ) ( req * request . Request , output * GetSessionTokenOutput ) {
op := & request . Operation {
Name : opGetSessionToken ,
HTTPMethod : "POST" ,
HTTPPath : "/" ,
}
if input == nil {
input = & GetSessionTokenInput { }
}
output = & GetSessionTokenOutput { }
req = c . newRequest ( op , input , output )
return
}
// GetSessionToken API operation for AWS Security Token Service.
//
2021-09-01 13:20:44 +00:00
// Returns a set of temporary credentials for an Amazon Web Services account
// or IAM user. The credentials consist of an access key ID, a secret access
// key, and a security token. Typically, you use GetSessionToken if you want
// to use MFA to protect programmatic calls to specific Amazon Web Services
2023-05-08 20:59:29 +00:00
// API operations like Amazon EC2 StopInstances.
//
// MFA-enabled IAM users must call GetSessionToken and submit an MFA code that
// is associated with their MFA device. Using the temporary security credentials
// that the call returns, IAM users can then make programmatic calls to API
// operations that require MFA authentication. An incorrect MFA code causes
// the API to return an access denied error. For a comparison of GetSessionToken
2021-09-01 13:20:44 +00:00
// with the other API operations that produce temporary credentials, see Requesting
// Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
2022-01-20 09:43:15 +00:00
// and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2022-05-18 05:37:10 +00:00
// No permissions are required for users to perform this operation. The purpose
// of the sts:GetSessionToken operation is to authenticate the user using MFA.
// You cannot use policies to control authentication operations. For more information,
// see Permissions for GetSessionToken (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html)
// in the IAM User Guide.
//
2022-08-22 20:13:17 +00:00
// # Session Duration
2021-03-22 16:29:47 +00:00
//
2021-09-01 13:20:44 +00:00
// The GetSessionToken operation must be called by using the long-term Amazon
2023-05-08 20:59:29 +00:00
// Web Services security credentials of an IAM user. Credentials that are created
// by IAM users are valid for the duration that you specify. This duration can
// range from 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36
// hours), with a default of 43,200 seconds (12 hours). Credentials based on
// account credentials can range from 900 seconds (15 minutes) up to 3,600 seconds
// (1 hour), with a default of 1 hour.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// # Permissions
2021-03-22 16:29:47 +00:00
//
// The temporary security credentials created by GetSessionToken can be used
2021-09-01 13:20:44 +00:00
// to make API calls to any Amazon Web Services service with the following exceptions:
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - You cannot call any IAM API operations unless MFA authentication information
// is included in the request.
2021-03-22 16:29:47 +00:00
//
2022-08-22 20:13:17 +00:00
// - You cannot call any STS API except AssumeRole or GetCallerIdentity.
2021-03-22 16:29:47 +00:00
//
2023-05-08 20:59:29 +00:00
// The credentials that GetSessionToken returns are based on permissions associated
// with the IAM user whose credentials were used to call the operation. The
// temporary credentials have the same permissions as the IAM user.
2021-03-22 16:29:47 +00:00
//
2023-05-08 20:59:29 +00:00
// Although it is possible to call GetSessionToken using the security credentials
// of an Amazon Web Services account root user rather than an IAM user, we do
// not recommend it. If GetSessionToken is called using root user credentials,
// the temporary credentials have root user permissions. For more information,
// see Safeguard your root user credentials and don't use them for everyday
// tasks (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials)
// in the IAM User Guide
2021-03-22 16:29:47 +00:00
//
// For more information about using GetSessionToken to create temporary credentials,
2023-05-08 20:59:29 +00:00
// see Temporary Credentials for Users in Untrusted Environments (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
// with awserr.Error's Code and Message methods to get detailed information about
// the error.
//
// See the AWS API reference guide for AWS Security Token Service's
// API operation GetSessionToken for usage and error information.
//
// Returned Error Codes:
2022-08-22 20:13:17 +00:00
// - ErrCodeRegionDisabledException "RegionDisabledException"
// STS is not activated in the requested region for the account that is being
// asked to generate credentials. The account administrator must use the IAM
// console to activate STS in that region. For more information, see Activating
// and Deactivating Amazon Web Services STS in an Amazon Web Services Region
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
//
// See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken
func ( c * STS ) GetSessionToken ( input * GetSessionTokenInput ) ( * GetSessionTokenOutput , error ) {
req , out := c . GetSessionTokenRequest ( input )
return out , req . Send ( )
}
// GetSessionTokenWithContext is the same as GetSessionToken with the addition of
// the ability to pass a context and additional request options.
//
// See GetSessionToken for details on how to use this API operation.
//
// The context must be non-nil and will be used for request cancellation. If
// the context is nil a panic will occur. In the future the SDK may create
// sub-contexts for http.Requests. See https://golang.org/pkg/context/
// for more information on using Contexts.
func ( c * STS ) GetSessionTokenWithContext ( ctx aws . Context , input * GetSessionTokenInput , opts ... request . Option ) ( * GetSessionTokenOutput , error ) {
req , out := c . GetSessionTokenRequest ( input )
req . SetContext ( ctx )
req . ApplyOptions ( opts ... )
return out , req . Send ( )
}
type AssumeRoleInput struct {
_ struct { } ` type:"structure" `
2022-01-20 09:43:15 +00:00
// The duration, in seconds, of the role session. The value specified can range
// from 900 seconds (15 minutes) up to the maximum session duration set for
// the role. The maximum session duration setting can have a value from 1 hour
// to 12 hours. If you specify a value higher than this setting or the administrator
// setting (whichever is lower), the operation fails. For example, if you specify
// a session duration of 12 hours, but your administrator set the maximum session
// duration to 6 hours, your operation fails.
//
// Role chaining limits your Amazon Web Services CLI or Amazon Web Services
// API role session to a maximum of one hour. When you use the AssumeRole API
// operation to assume a role, you can specify the duration of your role session
// with the DurationSeconds parameter. You can specify a parameter value of
// up to 43200 seconds (12 hours), depending on the maximum session duration
// setting for your role. However, if you assume a role using role chaining
// and provide a DurationSeconds parameter value greater than one hour, the
// operation fails. To learn how to view the maximum value for your role, see
// View the Maximum Session Duration Setting for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
// By default, the value is set to 3600 seconds.
//
// The DurationSeconds parameter is separate from the duration of a console
// session that you might request using the returned credentials. The request
// to the federation endpoint for a console sign-in token takes a SessionDuration
// parameter that specifies the maximum length of the console session. For more
// information, see Creating a URL that Enables Federated Users to Access the
2022-01-20 09:43:15 +00:00
// Amazon Web Services Management Console (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
DurationSeconds * int64 ` min:"900" type:"integer" `
// A unique identifier that might be required when you assume a role in another
// account. If the administrator of the account to which the role belongs provided
// you with an external ID, then provide that value in the ExternalId parameter.
// This value can be any string, such as a passphrase or account number. A cross-account
// role is usually set up to trust everyone in an account. Therefore, the administrator
// of the trusting account might send an external ID to the administrator of
// the trusted account. That way, only someone with the ID can assume the role,
// rather than everyone in the account. For more information about the external
2021-09-01 13:20:44 +00:00
// ID, see How to Use an External ID When Granting Access to Your Amazon Web
// Services Resources to a Third Party (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@:/-
ExternalId * string ` min:"2" type:"string" `
// An IAM policy in JSON format that you want to use as an inline session policy.
//
// This parameter is optional. Passing policies to this operation returns new
// temporary credentials. The resulting session's permissions are the intersection
// of the role's identity-based policy and the session policies. You can use
2021-09-01 13:20:44 +00:00
// the role's temporary credentials in subsequent Amazon Web Services API calls
// to access resources in the account that owns the role. You cannot use session
// policies to grant more permissions than those allowed by the identity-based
// policy of the role that is being assumed. For more information, see Session
// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2021-06-04 08:59:18 +00:00
// The plaintext that you use for both inline and managed session policies can't
// exceed 2,048 characters. The JSON policy characters can be any ASCII character
// from the space character to the end of the valid character list (\u0020 through
// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
// return (\u000D) characters.
2021-03-22 16:29:47 +00:00
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
Policy * string ` min:"1" type:"string" `
// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
// to use as managed session policies. The policies must exist in the same account
// as the role.
//
// This parameter is optional. You can provide up to 10 managed policy ARNs.
2021-06-04 08:59:18 +00:00
// However, the plaintext that you use for both inline and managed session policies
// can't exceed 2,048 characters. For more information about ARNs, see Amazon
2021-09-01 13:20:44 +00:00
// Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
// in the Amazon Web Services General Reference.
2021-03-22 16:29:47 +00:00
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
//
// Passing policies to this operation returns new temporary credentials. The
// resulting session's permissions are the intersection of the role's identity-based
// policy and the session policies. You can use the role's temporary credentials
2021-09-01 13:20:44 +00:00
// in subsequent Amazon Web Services API calls to access resources in the account
// that owns the role. You cannot use session policies to grant more permissions
// than those allowed by the identity-based policy of the role that is being
// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
PolicyArns [ ] * PolicyDescriptorType ` type:"list" `
2023-11-20 20:28:57 +00:00
// A list of previously acquired trusted context assertions in the format of
// a JSON array. The trusted context assertion is signed and encrypted by Amazon
// Web Services STS.
//
// The following is an example of a ProvidedContext value that includes a single
// trusted context assertion and the ARN of the context provider from which
// the trusted context assertion was generated.
//
2023-12-04 20:53:57 +00:00
// [{"ProviderArn":"arn:aws:iam::aws:contextProvider/IdentityCenter","ContextAssertion":"trusted-context-assertion"}]
2023-07-26 07:15:37 +00:00
ProvidedContexts [ ] * ProvidedContext ` type:"list" `
2021-03-22 16:29:47 +00:00
// The Amazon Resource Name (ARN) of the role to assume.
//
// RoleArn is a required field
RoleArn * string ` min:"20" type:"string" required:"true" `
// An identifier for the assumed role session.
//
// Use the role session name to uniquely identify a session when the same role
// is assumed by different principals or for different reasons. In cross-account
// scenarios, the role session name is visible to, and can be logged by the
// account that owns the role. The role session name is also used in the ARN
// of the assumed role principal. This means that subsequent cross-account API
// requests that use the temporary security credentials will expose the role
2021-09-01 13:20:44 +00:00
// session name to the external account in their CloudTrail logs.
2021-03-22 16:29:47 +00:00
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@-
//
// RoleSessionName is a required field
RoleSessionName * string ` min:"2" type:"string" required:"true" `
// The identification number of the MFA device that is associated with the user
// who is making the AssumeRole call. Specify this value if the trust policy
// of the role being assumed includes a condition that requires MFA authentication.
// The value is either the serial number for a hardware device (such as GAHT12345678)
// or an Amazon Resource Name (ARN) for a virtual device (such as arn:aws:iam::123456789012:mfa/user).
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@-
SerialNumber * string ` min:"9" type:"string" `
2021-06-04 08:59:18 +00:00
// The source identity specified by the principal that is calling the AssumeRole
// operation.
//
// You can require users to specify a source identity when they assume a role.
// You do this by using the sts:SourceIdentity condition key in a role trust
2021-09-01 13:20:44 +00:00
// policy. You can use source identity information in CloudTrail logs to determine
// who took actions with a role. You can use the aws:SourceIdentity condition
// key to further control access to Amazon Web Services resources based on the
// value of source identity. For more information about using source identity,
// see Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)
2021-06-04 08:59:18 +00:00
// in the IAM User Guide.
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@-. You cannot
2021-09-01 13:20:44 +00:00
// use a value that begins with the text aws:. This prefix is reserved for Amazon
// Web Services internal use.
2021-06-04 08:59:18 +00:00
SourceIdentity * string ` min:"2" type:"string" `
2021-03-22 16:29:47 +00:00
// A list of session tags that you want to pass. Each session tag consists of
// a key name and an associated value. For more information about session tags,
2022-01-20 09:43:15 +00:00
// see Tagging Amazon Web Services STS Sessions (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2021-06-04 08:59:18 +00:00
// This parameter is optional. You can pass up to 50 session tags. The plaintext
// session tag keys can’ t exceed 128 characters, and the values can’ t exceed
// 256 characters. For these and additional limits, see IAM and STS Character
2021-03-22 16:29:47 +00:00
// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
//
// You can pass a session tag with the same key as a tag that is already attached
// to the role. When you do, session tags override a role tag with the same
// key.
//
// Tag key– value pairs are not case sensitive, but case is preserved. This
// means that you cannot have separate Department and department tag keys. Assume
// that the role has the Department=Marketing tag and you pass the department=engineering
// session tag. Department and department are not saved as separate tags, and
// the session tag passed in the request takes precedence over the role tag.
//
// Additionally, if you used temporary credentials to perform this operation,
// the new session inherits any transitive session tags from the calling session.
// If you pass a session tag with the same key as an inherited tag, the operation
2021-09-01 13:20:44 +00:00
// fails. To view the inherited tags for a session, see the CloudTrail logs.
2022-03-07 20:22:29 +00:00
// For more information, see Viewing Session Tags in CloudTrail (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_ctlogs)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
Tags [ ] * Tag ` type:"list" `
// The value provided by the MFA device, if the trust policy of the role being
2021-06-04 08:59:18 +00:00
// assumed requires MFA. (In other words, if the policy includes a condition
// that tests for MFA). If the role being assumed requires MFA and if the TokenCode
// value is missing or expired, the AssumeRole call returns an "access denied"
// error.
2021-03-22 16:29:47 +00:00
//
// The format for this parameter, as described by its regex pattern, is a sequence
// of six numeric digits.
TokenCode * string ` min:"6" type:"string" `
// A list of keys for session tags that you want to set as transitive. If you
// set a tag key as transitive, the corresponding key and value passes to subsequent
// sessions in a role chain. For more information, see Chaining Roles with Session
// Tags (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
// in the IAM User Guide.
//
// This parameter is optional. When you set session tags as transitive, the
// session policy and session tags packed binary limit is not affected.
//
// If you choose not to specify a transitive tag key, then no tags are passed
// from this session to any subsequent sessions.
TransitiveTagKeys [ ] * string ` type:"list" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleInput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleInput ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * AssumeRoleInput ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "AssumeRoleInput" }
if s . DurationSeconds != nil && * s . DurationSeconds < 900 {
invalidParams . Add ( request . NewErrParamMinValue ( "DurationSeconds" , 900 ) )
}
if s . ExternalId != nil && len ( * s . ExternalId ) < 2 {
invalidParams . Add ( request . NewErrParamMinLen ( "ExternalId" , 2 ) )
}
if s . Policy != nil && len ( * s . Policy ) < 1 {
invalidParams . Add ( request . NewErrParamMinLen ( "Policy" , 1 ) )
}
if s . RoleArn == nil {
invalidParams . Add ( request . NewErrParamRequired ( "RoleArn" ) )
}
if s . RoleArn != nil && len ( * s . RoleArn ) < 20 {
invalidParams . Add ( request . NewErrParamMinLen ( "RoleArn" , 20 ) )
}
if s . RoleSessionName == nil {
invalidParams . Add ( request . NewErrParamRequired ( "RoleSessionName" ) )
}
if s . RoleSessionName != nil && len ( * s . RoleSessionName ) < 2 {
invalidParams . Add ( request . NewErrParamMinLen ( "RoleSessionName" , 2 ) )
}
if s . SerialNumber != nil && len ( * s . SerialNumber ) < 9 {
invalidParams . Add ( request . NewErrParamMinLen ( "SerialNumber" , 9 ) )
}
2021-06-04 08:59:18 +00:00
if s . SourceIdentity != nil && len ( * s . SourceIdentity ) < 2 {
invalidParams . Add ( request . NewErrParamMinLen ( "SourceIdentity" , 2 ) )
}
2021-03-22 16:29:47 +00:00
if s . TokenCode != nil && len ( * s . TokenCode ) < 6 {
invalidParams . Add ( request . NewErrParamMinLen ( "TokenCode" , 6 ) )
}
if s . PolicyArns != nil {
for i , v := range s . PolicyArns {
if v == nil {
continue
}
if err := v . Validate ( ) ; err != nil {
invalidParams . AddNested ( fmt . Sprintf ( "%s[%v]" , "PolicyArns" , i ) , err . ( request . ErrInvalidParams ) )
}
}
}
2023-07-26 07:15:37 +00:00
if s . ProvidedContexts != nil {
for i , v := range s . ProvidedContexts {
if v == nil {
continue
}
if err := v . Validate ( ) ; err != nil {
invalidParams . AddNested ( fmt . Sprintf ( "%s[%v]" , "ProvidedContexts" , i ) , err . ( request . ErrInvalidParams ) )
}
}
}
2021-03-22 16:29:47 +00:00
if s . Tags != nil {
for i , v := range s . Tags {
if v == nil {
continue
}
if err := v . Validate ( ) ; err != nil {
invalidParams . AddNested ( fmt . Sprintf ( "%s[%v]" , "Tags" , i ) , err . ( request . ErrInvalidParams ) )
}
}
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetDurationSeconds sets the DurationSeconds field's value.
func ( s * AssumeRoleInput ) SetDurationSeconds ( v int64 ) * AssumeRoleInput {
s . DurationSeconds = & v
return s
}
// SetExternalId sets the ExternalId field's value.
func ( s * AssumeRoleInput ) SetExternalId ( v string ) * AssumeRoleInput {
s . ExternalId = & v
return s
}
// SetPolicy sets the Policy field's value.
func ( s * AssumeRoleInput ) SetPolicy ( v string ) * AssumeRoleInput {
s . Policy = & v
return s
}
// SetPolicyArns sets the PolicyArns field's value.
func ( s * AssumeRoleInput ) SetPolicyArns ( v [ ] * PolicyDescriptorType ) * AssumeRoleInput {
s . PolicyArns = v
return s
}
2023-07-26 07:15:37 +00:00
// SetProvidedContexts sets the ProvidedContexts field's value.
func ( s * AssumeRoleInput ) SetProvidedContexts ( v [ ] * ProvidedContext ) * AssumeRoleInput {
s . ProvidedContexts = v
return s
}
2021-03-22 16:29:47 +00:00
// SetRoleArn sets the RoleArn field's value.
func ( s * AssumeRoleInput ) SetRoleArn ( v string ) * AssumeRoleInput {
s . RoleArn = & v
return s
}
// SetRoleSessionName sets the RoleSessionName field's value.
func ( s * AssumeRoleInput ) SetRoleSessionName ( v string ) * AssumeRoleInput {
s . RoleSessionName = & v
return s
}
// SetSerialNumber sets the SerialNumber field's value.
func ( s * AssumeRoleInput ) SetSerialNumber ( v string ) * AssumeRoleInput {
s . SerialNumber = & v
return s
}
2021-06-04 08:59:18 +00:00
// SetSourceIdentity sets the SourceIdentity field's value.
func ( s * AssumeRoleInput ) SetSourceIdentity ( v string ) * AssumeRoleInput {
s . SourceIdentity = & v
return s
}
2021-03-22 16:29:47 +00:00
// SetTags sets the Tags field's value.
func ( s * AssumeRoleInput ) SetTags ( v [ ] * Tag ) * AssumeRoleInput {
s . Tags = v
return s
}
// SetTokenCode sets the TokenCode field's value.
func ( s * AssumeRoleInput ) SetTokenCode ( v string ) * AssumeRoleInput {
s . TokenCode = & v
return s
}
// SetTransitiveTagKeys sets the TransitiveTagKeys field's value.
func ( s * AssumeRoleInput ) SetTransitiveTagKeys ( v [ ] * string ) * AssumeRoleInput {
s . TransitiveTagKeys = v
return s
}
// Contains the response to a successful AssumeRole request, including temporary
2021-09-01 13:20:44 +00:00
// Amazon Web Services credentials that can be used to make Amazon Web Services
// requests.
2021-03-22 16:29:47 +00:00
type AssumeRoleOutput struct {
_ struct { } ` type:"structure" `
// The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers
// that you can use to refer to the resulting temporary security credentials.
// For example, you can reference these credentials as a principal in a resource-based
// policy by using the ARN or assumed role ID. The ARN and ID include the RoleSessionName
// that you specified when you called AssumeRole.
AssumedRoleUser * AssumedRoleUser ` type:"structure" `
// The temporary security credentials, which include an access key ID, a secret
// access key, and a security (or session) token.
//
// The size of the security token that STS API operations return is not fixed.
// We strongly recommend that you make no assumptions about the maximum size.
Credentials * Credentials ` type:"structure" `
// A percentage value that indicates the packed size of the session policies
// and session tags combined passed in the request. The request fails if the
// packed size is greater than 100 percent, which means the policies and tags
// exceeded the allowed space.
PackedPolicySize * int64 ` type:"integer" `
2021-06-04 08:59:18 +00:00
// The source identity specified by the principal that is calling the AssumeRole
// operation.
//
// You can require users to specify a source identity when they assume a role.
// You do this by using the sts:SourceIdentity condition key in a role trust
2021-09-01 13:20:44 +00:00
// policy. You can use source identity information in CloudTrail logs to determine
// who took actions with a role. You can use the aws:SourceIdentity condition
// key to further control access to Amazon Web Services resources based on the
// value of source identity. For more information about using source identity,
// see Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)
2021-06-04 08:59:18 +00:00
// in the IAM User Guide.
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@-
SourceIdentity * string ` min:"2" type:"string" `
2021-03-22 16:29:47 +00:00
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleOutput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleOutput ) GoString ( ) string {
return s . String ( )
}
// SetAssumedRoleUser sets the AssumedRoleUser field's value.
func ( s * AssumeRoleOutput ) SetAssumedRoleUser ( v * AssumedRoleUser ) * AssumeRoleOutput {
s . AssumedRoleUser = v
return s
}
// SetCredentials sets the Credentials field's value.
func ( s * AssumeRoleOutput ) SetCredentials ( v * Credentials ) * AssumeRoleOutput {
s . Credentials = v
return s
}
// SetPackedPolicySize sets the PackedPolicySize field's value.
func ( s * AssumeRoleOutput ) SetPackedPolicySize ( v int64 ) * AssumeRoleOutput {
s . PackedPolicySize = & v
return s
}
2021-06-04 08:59:18 +00:00
// SetSourceIdentity sets the SourceIdentity field's value.
func ( s * AssumeRoleOutput ) SetSourceIdentity ( v string ) * AssumeRoleOutput {
s . SourceIdentity = & v
return s
}
2021-03-22 16:29:47 +00:00
type AssumeRoleWithSAMLInput struct {
_ struct { } ` type:"structure" `
// The duration, in seconds, of the role session. Your role session lasts for
// the duration that you specify for the DurationSeconds parameter, or until
// the time specified in the SAML authentication response's SessionNotOnOrAfter
// value, whichever is shorter. You can provide a DurationSeconds value from
// 900 seconds (15 minutes) up to the maximum session duration setting for the
// role. This setting can have a value from 1 hour to 12 hours. If you specify
// a value higher than this setting, the operation fails. For example, if you
// specify a session duration of 12 hours, but your administrator set the maximum
// session duration to 6 hours, your operation fails. To learn how to view the
// maximum value for your role, see View the Maximum Session Duration Setting
// for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session)
// in the IAM User Guide.
//
// By default, the value is set to 3600 seconds.
//
// The DurationSeconds parameter is separate from the duration of a console
// session that you might request using the returned credentials. The request
// to the federation endpoint for a console sign-in token takes a SessionDuration
// parameter that specifies the maximum length of the console session. For more
// information, see Creating a URL that Enables Federated Users to Access the
2022-01-20 09:43:15 +00:00
// Amazon Web Services Management Console (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
DurationSeconds * int64 ` min:"900" type:"integer" `
// An IAM policy in JSON format that you want to use as an inline session policy.
//
// This parameter is optional. Passing policies to this operation returns new
// temporary credentials. The resulting session's permissions are the intersection
// of the role's identity-based policy and the session policies. You can use
2021-09-01 13:20:44 +00:00
// the role's temporary credentials in subsequent Amazon Web Services API calls
// to access resources in the account that owns the role. You cannot use session
// policies to grant more permissions than those allowed by the identity-based
// policy of the role that is being assumed. For more information, see Session
// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2021-06-04 08:59:18 +00:00
// The plaintext that you use for both inline and managed session policies can't
// exceed 2,048 characters. The JSON policy characters can be any ASCII character
// from the space character to the end of the valid character list (\u0020 through
// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
// return (\u000D) characters.
2021-03-22 16:29:47 +00:00
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
Policy * string ` min:"1" type:"string" `
// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
// to use as managed session policies. The policies must exist in the same account
// as the role.
//
// This parameter is optional. You can provide up to 10 managed policy ARNs.
2021-06-04 08:59:18 +00:00
// However, the plaintext that you use for both inline and managed session policies
// can't exceed 2,048 characters. For more information about ARNs, see Amazon
2021-09-01 13:20:44 +00:00
// Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
// in the Amazon Web Services General Reference.
2021-03-22 16:29:47 +00:00
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
//
// Passing policies to this operation returns new temporary credentials. The
// resulting session's permissions are the intersection of the role's identity-based
// policy and the session policies. You can use the role's temporary credentials
2021-09-01 13:20:44 +00:00
// in subsequent Amazon Web Services API calls to access resources in the account
// that owns the role. You cannot use session policies to grant more permissions
// than those allowed by the identity-based policy of the role that is being
// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
PolicyArns [ ] * PolicyDescriptorType ` type:"list" `
// The Amazon Resource Name (ARN) of the SAML provider in IAM that describes
// the IdP.
//
// PrincipalArn is a required field
PrincipalArn * string ` min:"20" type:"string" required:"true" `
// The Amazon Resource Name (ARN) of the role that the caller is assuming.
//
// RoleArn is a required field
RoleArn * string ` min:"20" type:"string" required:"true" `
2021-06-04 08:59:18 +00:00
// The base64 encoded SAML authentication response provided by the IdP.
2021-03-22 16:29:47 +00:00
//
// For more information, see Configuring a Relying Party and Adding Claims (https://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html)
// in the IAM User Guide.
//
2023-05-22 21:01:09 +00:00
// SAMLAssertion is a sensitive parameter and its value will be
// replaced with "sensitive" in string returned by AssumeRoleWithSAMLInput's
// String and GoString methods.
//
2021-03-22 16:29:47 +00:00
// SAMLAssertion is a required field
2023-05-22 21:01:09 +00:00
SAMLAssertion * string ` min:"4" type:"string" required:"true" sensitive:"true" `
2021-03-22 16:29:47 +00:00
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleWithSAMLInput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleWithSAMLInput ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * AssumeRoleWithSAMLInput ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "AssumeRoleWithSAMLInput" }
if s . DurationSeconds != nil && * s . DurationSeconds < 900 {
invalidParams . Add ( request . NewErrParamMinValue ( "DurationSeconds" , 900 ) )
}
if s . Policy != nil && len ( * s . Policy ) < 1 {
invalidParams . Add ( request . NewErrParamMinLen ( "Policy" , 1 ) )
}
if s . PrincipalArn == nil {
invalidParams . Add ( request . NewErrParamRequired ( "PrincipalArn" ) )
}
if s . PrincipalArn != nil && len ( * s . PrincipalArn ) < 20 {
invalidParams . Add ( request . NewErrParamMinLen ( "PrincipalArn" , 20 ) )
}
if s . RoleArn == nil {
invalidParams . Add ( request . NewErrParamRequired ( "RoleArn" ) )
}
if s . RoleArn != nil && len ( * s . RoleArn ) < 20 {
invalidParams . Add ( request . NewErrParamMinLen ( "RoleArn" , 20 ) )
}
if s . SAMLAssertion == nil {
invalidParams . Add ( request . NewErrParamRequired ( "SAMLAssertion" ) )
}
if s . SAMLAssertion != nil && len ( * s . SAMLAssertion ) < 4 {
invalidParams . Add ( request . NewErrParamMinLen ( "SAMLAssertion" , 4 ) )
}
if s . PolicyArns != nil {
for i , v := range s . PolicyArns {
if v == nil {
continue
}
if err := v . Validate ( ) ; err != nil {
invalidParams . AddNested ( fmt . Sprintf ( "%s[%v]" , "PolicyArns" , i ) , err . ( request . ErrInvalidParams ) )
}
}
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetDurationSeconds sets the DurationSeconds field's value.
func ( s * AssumeRoleWithSAMLInput ) SetDurationSeconds ( v int64 ) * AssumeRoleWithSAMLInput {
s . DurationSeconds = & v
return s
}
// SetPolicy sets the Policy field's value.
func ( s * AssumeRoleWithSAMLInput ) SetPolicy ( v string ) * AssumeRoleWithSAMLInput {
s . Policy = & v
return s
}
// SetPolicyArns sets the PolicyArns field's value.
func ( s * AssumeRoleWithSAMLInput ) SetPolicyArns ( v [ ] * PolicyDescriptorType ) * AssumeRoleWithSAMLInput {
s . PolicyArns = v
return s
}
// SetPrincipalArn sets the PrincipalArn field's value.
func ( s * AssumeRoleWithSAMLInput ) SetPrincipalArn ( v string ) * AssumeRoleWithSAMLInput {
s . PrincipalArn = & v
return s
}
// SetRoleArn sets the RoleArn field's value.
func ( s * AssumeRoleWithSAMLInput ) SetRoleArn ( v string ) * AssumeRoleWithSAMLInput {
s . RoleArn = & v
return s
}
// SetSAMLAssertion sets the SAMLAssertion field's value.
func ( s * AssumeRoleWithSAMLInput ) SetSAMLAssertion ( v string ) * AssumeRoleWithSAMLInput {
s . SAMLAssertion = & v
return s
}
// Contains the response to a successful AssumeRoleWithSAML request, including
2021-09-01 13:20:44 +00:00
// temporary Amazon Web Services credentials that can be used to make Amazon
// Web Services requests.
2021-03-22 16:29:47 +00:00
type AssumeRoleWithSAMLOutput struct {
_ struct { } ` type:"structure" `
// The identifiers for the temporary security credentials that the operation
// returns.
AssumedRoleUser * AssumedRoleUser ` type:"structure" `
// The value of the Recipient attribute of the SubjectConfirmationData element
// of the SAML assertion.
Audience * string ` type:"string" `
// The temporary security credentials, which include an access key ID, a secret
// access key, and a security (or session) token.
//
// The size of the security token that STS API operations return is not fixed.
// We strongly recommend that you make no assumptions about the maximum size.
Credentials * Credentials ` type:"structure" `
// The value of the Issuer element of the SAML assertion.
Issuer * string ` type:"string" `
2021-06-04 08:59:18 +00:00
// A hash value based on the concatenation of the following:
//
// * The Issuer response value.
//
2021-09-01 13:20:44 +00:00
// * The Amazon Web Services account ID.
2021-06-04 08:59:18 +00:00
//
// * The friendly name (the last part of the ARN) of the SAML provider in
// IAM.
//
// The combination of NameQualifier and Subject can be used to uniquely identify
2023-05-08 20:59:29 +00:00
// a user.
2021-03-22 16:29:47 +00:00
//
// The following pseudocode shows how the hash value is calculated:
//
// BASE64 ( SHA1 ( "https://example.com/saml" + "123456789012" + "/MySAMLIdP"
// ) )
NameQualifier * string ` type:"string" `
// A percentage value that indicates the packed size of the session policies
// and session tags combined passed in the request. The request fails if the
// packed size is greater than 100 percent, which means the policies and tags
// exceeded the allowed space.
PackedPolicySize * int64 ` type:"integer" `
2021-06-04 08:59:18 +00:00
// The value in the SourceIdentity attribute in the SAML assertion.
//
// You can require users to set a source identity value when they assume a role.
// You do this by using the sts:SourceIdentity condition key in a role trust
// policy. That way, actions that are taken with the role are associated with
// that user. After the source identity is set, the value cannot be changed.
// It is present in the request for all actions that are taken by the role and
// persists across chained role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining)
// sessions. You can configure your SAML identity provider to use an attribute
// associated with your users, like user name or email, as the source identity
// when calling AssumeRoleWithSAML. You do this by adding an attribute to the
// SAML assertion. For more information about using source identity, see Monitor
// and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)
// in the IAM User Guide.
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@-
SourceIdentity * string ` min:"2" type:"string" `
2021-03-22 16:29:47 +00:00
// The value of the NameID element in the Subject element of the SAML assertion.
Subject * string ` type:"string" `
// The format of the name ID, as defined by the Format attribute in the NameID
// element of the SAML assertion. Typical examples of the format are transient
// or persistent.
//
// If the format includes the prefix urn:oasis:names:tc:SAML:2.0:nameid-format,
// that prefix is removed. For example, urn:oasis:names:tc:SAML:2.0:nameid-format:transient
// is returned as transient. If the format includes any other prefix, the format
// is returned with no modifications.
SubjectType * string ` type:"string" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleWithSAMLOutput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleWithSAMLOutput ) GoString ( ) string {
return s . String ( )
}
// SetAssumedRoleUser sets the AssumedRoleUser field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetAssumedRoleUser ( v * AssumedRoleUser ) * AssumeRoleWithSAMLOutput {
s . AssumedRoleUser = v
return s
}
// SetAudience sets the Audience field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetAudience ( v string ) * AssumeRoleWithSAMLOutput {
s . Audience = & v
return s
}
// SetCredentials sets the Credentials field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetCredentials ( v * Credentials ) * AssumeRoleWithSAMLOutput {
s . Credentials = v
return s
}
// SetIssuer sets the Issuer field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetIssuer ( v string ) * AssumeRoleWithSAMLOutput {
s . Issuer = & v
return s
}
// SetNameQualifier sets the NameQualifier field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetNameQualifier ( v string ) * AssumeRoleWithSAMLOutput {
s . NameQualifier = & v
return s
}
// SetPackedPolicySize sets the PackedPolicySize field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetPackedPolicySize ( v int64 ) * AssumeRoleWithSAMLOutput {
s . PackedPolicySize = & v
return s
}
2021-06-04 08:59:18 +00:00
// SetSourceIdentity sets the SourceIdentity field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetSourceIdentity ( v string ) * AssumeRoleWithSAMLOutput {
s . SourceIdentity = & v
return s
}
2021-03-22 16:29:47 +00:00
// SetSubject sets the Subject field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetSubject ( v string ) * AssumeRoleWithSAMLOutput {
s . Subject = & v
return s
}
// SetSubjectType sets the SubjectType field's value.
func ( s * AssumeRoleWithSAMLOutput ) SetSubjectType ( v string ) * AssumeRoleWithSAMLOutput {
s . SubjectType = & v
return s
}
type AssumeRoleWithWebIdentityInput struct {
_ struct { } ` type:"structure" `
// The duration, in seconds, of the role session. The value can range from 900
// seconds (15 minutes) up to the maximum session duration setting for the role.
// This setting can have a value from 1 hour to 12 hours. If you specify a value
// higher than this setting, the operation fails. For example, if you specify
// a session duration of 12 hours, but your administrator set the maximum session
// duration to 6 hours, your operation fails. To learn how to view the maximum
// value for your role, see View the Maximum Session Duration Setting for a
// Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session)
// in the IAM User Guide.
//
// By default, the value is set to 3600 seconds.
//
// The DurationSeconds parameter is separate from the duration of a console
// session that you might request using the returned credentials. The request
// to the federation endpoint for a console sign-in token takes a SessionDuration
// parameter that specifies the maximum length of the console session. For more
// information, see Creating a URL that Enables Federated Users to Access the
2022-01-20 09:43:15 +00:00
// Amazon Web Services Management Console (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
DurationSeconds * int64 ` min:"900" type:"integer" `
// An IAM policy in JSON format that you want to use as an inline session policy.
//
// This parameter is optional. Passing policies to this operation returns new
// temporary credentials. The resulting session's permissions are the intersection
// of the role's identity-based policy and the session policies. You can use
2021-09-01 13:20:44 +00:00
// the role's temporary credentials in subsequent Amazon Web Services API calls
// to access resources in the account that owns the role. You cannot use session
// policies to grant more permissions than those allowed by the identity-based
// policy of the role that is being assumed. For more information, see Session
// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
//
2021-06-04 08:59:18 +00:00
// The plaintext that you use for both inline and managed session policies can't
// exceed 2,048 characters. The JSON policy characters can be any ASCII character
// from the space character to the end of the valid character list (\u0020 through
// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
// return (\u000D) characters.
2021-03-22 16:29:47 +00:00
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
Policy * string ` min:"1" type:"string" `
// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
// to use as managed session policies. The policies must exist in the same account
// as the role.
//
// This parameter is optional. You can provide up to 10 managed policy ARNs.
2021-06-04 08:59:18 +00:00
// However, the plaintext that you use for both inline and managed session policies
// can't exceed 2,048 characters. For more information about ARNs, see Amazon
2021-09-01 13:20:44 +00:00
// Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
// in the Amazon Web Services General Reference.
2021-03-22 16:29:47 +00:00
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
//
// Passing policies to this operation returns new temporary credentials. The
// resulting session's permissions are the intersection of the role's identity-based
// policy and the session policies. You can use the role's temporary credentials
2021-09-01 13:20:44 +00:00
// in subsequent Amazon Web Services API calls to access resources in the account
// that owns the role. You cannot use session policies to grant more permissions
// than those allowed by the identity-based policy of the role that is being
// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
2021-03-22 16:29:47 +00:00
// in the IAM User Guide.
PolicyArns [ ] * PolicyDescriptorType ` type:"list" `
2022-03-07 20:22:29 +00:00
// The fully qualified host component of the domain name of the OAuth 2.0 identity
// provider. Do not specify this value for an OpenID Connect identity provider.
2021-03-22 16:29:47 +00:00
//
2022-03-07 20:22:29 +00:00
// Currently www.amazon.com and graph.facebook.com are the only supported identity
// providers for OAuth 2.0 access tokens. Do not include URL schemes and port
// numbers.
2021-03-22 16:29:47 +00:00
//
// Do not specify this value for OpenID Connect ID tokens.
ProviderId * string ` min:"4" type:"string" `
// The Amazon Resource Name (ARN) of the role that the caller is assuming.
//
// RoleArn is a required field
RoleArn * string ` min:"20" type:"string" required:"true" `
// An identifier for the assumed role session. Typically, you pass the name
// or identifier that is associated with the user who is using your application.
// That way, the temporary security credentials that your application will use
// are associated with that user. This session name is included as part of the
// ARN and assumed role ID in the AssumedRoleUser response element.
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@-
//
// RoleSessionName is a required field
RoleSessionName * string ` min:"2" type:"string" required:"true" `
// The OAuth 2.0 access token or OpenID Connect ID token that is provided by
// the identity provider. Your application must get this token by authenticating
// the user who is using your application with a web identity provider before
2023-07-26 07:15:37 +00:00
// the application makes an AssumeRoleWithWebIdentity call. Only tokens with
// RSA algorithms (RS256) are supported.
2021-03-22 16:29:47 +00:00
//
2023-05-22 21:01:09 +00:00
// WebIdentityToken is a sensitive parameter and its value will be
// replaced with "sensitive" in string returned by AssumeRoleWithWebIdentityInput's
// String and GoString methods.
//
2021-03-22 16:29:47 +00:00
// WebIdentityToken is a required field
2023-05-22 21:01:09 +00:00
WebIdentityToken * string ` min:"4" type:"string" required:"true" sensitive:"true" `
2021-03-22 16:29:47 +00:00
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleWithWebIdentityInput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleWithWebIdentityInput ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * AssumeRoleWithWebIdentityInput ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "AssumeRoleWithWebIdentityInput" }
if s . DurationSeconds != nil && * s . DurationSeconds < 900 {
invalidParams . Add ( request . NewErrParamMinValue ( "DurationSeconds" , 900 ) )
}
if s . Policy != nil && len ( * s . Policy ) < 1 {
invalidParams . Add ( request . NewErrParamMinLen ( "Policy" , 1 ) )
}
if s . ProviderId != nil && len ( * s . ProviderId ) < 4 {
invalidParams . Add ( request . NewErrParamMinLen ( "ProviderId" , 4 ) )
}
if s . RoleArn == nil {
invalidParams . Add ( request . NewErrParamRequired ( "RoleArn" ) )
}
if s . RoleArn != nil && len ( * s . RoleArn ) < 20 {
invalidParams . Add ( request . NewErrParamMinLen ( "RoleArn" , 20 ) )
}
if s . RoleSessionName == nil {
invalidParams . Add ( request . NewErrParamRequired ( "RoleSessionName" ) )
}
if s . RoleSessionName != nil && len ( * s . RoleSessionName ) < 2 {
invalidParams . Add ( request . NewErrParamMinLen ( "RoleSessionName" , 2 ) )
}
if s . WebIdentityToken == nil {
invalidParams . Add ( request . NewErrParamRequired ( "WebIdentityToken" ) )
}
if s . WebIdentityToken != nil && len ( * s . WebIdentityToken ) < 4 {
invalidParams . Add ( request . NewErrParamMinLen ( "WebIdentityToken" , 4 ) )
}
if s . PolicyArns != nil {
for i , v := range s . PolicyArns {
if v == nil {
continue
}
if err := v . Validate ( ) ; err != nil {
invalidParams . AddNested ( fmt . Sprintf ( "%s[%v]" , "PolicyArns" , i ) , err . ( request . ErrInvalidParams ) )
}
}
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetDurationSeconds sets the DurationSeconds field's value.
func ( s * AssumeRoleWithWebIdentityInput ) SetDurationSeconds ( v int64 ) * AssumeRoleWithWebIdentityInput {
s . DurationSeconds = & v
return s
}
// SetPolicy sets the Policy field's value.
func ( s * AssumeRoleWithWebIdentityInput ) SetPolicy ( v string ) * AssumeRoleWithWebIdentityInput {
s . Policy = & v
return s
}
// SetPolicyArns sets the PolicyArns field's value.
func ( s * AssumeRoleWithWebIdentityInput ) SetPolicyArns ( v [ ] * PolicyDescriptorType ) * AssumeRoleWithWebIdentityInput {
s . PolicyArns = v
return s
}
// SetProviderId sets the ProviderId field's value.
func ( s * AssumeRoleWithWebIdentityInput ) SetProviderId ( v string ) * AssumeRoleWithWebIdentityInput {
s . ProviderId = & v
return s
}
// SetRoleArn sets the RoleArn field's value.
func ( s * AssumeRoleWithWebIdentityInput ) SetRoleArn ( v string ) * AssumeRoleWithWebIdentityInput {
s . RoleArn = & v
return s
}
// SetRoleSessionName sets the RoleSessionName field's value.
func ( s * AssumeRoleWithWebIdentityInput ) SetRoleSessionName ( v string ) * AssumeRoleWithWebIdentityInput {
s . RoleSessionName = & v
return s
}
// SetWebIdentityToken sets the WebIdentityToken field's value.
func ( s * AssumeRoleWithWebIdentityInput ) SetWebIdentityToken ( v string ) * AssumeRoleWithWebIdentityInput {
s . WebIdentityToken = & v
return s
}
// Contains the response to a successful AssumeRoleWithWebIdentity request,
2021-09-01 13:20:44 +00:00
// including temporary Amazon Web Services credentials that can be used to make
// Amazon Web Services requests.
2021-03-22 16:29:47 +00:00
type AssumeRoleWithWebIdentityOutput struct {
_ struct { } ` type:"structure" `
// The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers
// that you can use to refer to the resulting temporary security credentials.
// For example, you can reference these credentials as a principal in a resource-based
// policy by using the ARN or assumed role ID. The ARN and ID include the RoleSessionName
// that you specified when you called AssumeRole.
AssumedRoleUser * AssumedRoleUser ` type:"structure" `
// The intended audience (also known as client ID) of the web identity token.
// This is traditionally the client identifier issued to the application that
// requested the web identity token.
Audience * string ` type:"string" `
// The temporary security credentials, which include an access key ID, a secret
// access key, and a security token.
//
// The size of the security token that STS API operations return is not fixed.
// We strongly recommend that you make no assumptions about the maximum size.
Credentials * Credentials ` type:"structure" `
// A percentage value that indicates the packed size of the session policies
// and session tags combined passed in the request. The request fails if the
// packed size is greater than 100 percent, which means the policies and tags
// exceeded the allowed space.
PackedPolicySize * int64 ` type:"integer" `
// The issuing authority of the web identity token presented. For OpenID Connect
// ID tokens, this contains the value of the iss field. For OAuth 2.0 access
// tokens, this contains the value of the ProviderId parameter that was passed
// in the AssumeRoleWithWebIdentity request.
Provider * string ` type:"string" `
2021-06-04 08:59:18 +00:00
// The value of the source identity that is returned in the JSON web token (JWT)
// from the identity provider.
//
// You can require users to set a source identity value when they assume a role.
// You do this by using the sts:SourceIdentity condition key in a role trust
// policy. That way, actions that are taken with the role are associated with
// that user. After the source identity is set, the value cannot be changed.
// It is present in the request for all actions that are taken by the role and
// persists across chained role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining)
// sessions. You can configure your identity provider to use an attribute associated
// with your users, like user name or email, as the source identity when calling
// AssumeRoleWithWebIdentity. You do this by adding a claim to the JSON web
// token. To learn more about OIDC tokens and claims, see Using Tokens with
// User Pools (https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html)
// in the Amazon Cognito Developer Guide. For more information about using source
// identity, see Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)
// in the IAM User Guide.
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@-
SourceIdentity * string ` min:"2" type:"string" `
2021-03-22 16:29:47 +00:00
// The unique user identifier that is returned by the identity provider. This
// identifier is associated with the WebIdentityToken that was submitted with
// the AssumeRoleWithWebIdentity call. The identifier is typically unique to
// the user and the application that acquired the WebIdentityToken (pairwise
// identifier). For OpenID Connect ID tokens, this field contains the value
// returned by the identity provider as the token's sub (Subject) claim.
SubjectFromWebIdentityToken * string ` min:"6" type:"string" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleWithWebIdentityOutput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumeRoleWithWebIdentityOutput ) GoString ( ) string {
return s . String ( )
}
// SetAssumedRoleUser sets the AssumedRoleUser field's value.
func ( s * AssumeRoleWithWebIdentityOutput ) SetAssumedRoleUser ( v * AssumedRoleUser ) * AssumeRoleWithWebIdentityOutput {
s . AssumedRoleUser = v
return s
}
// SetAudience sets the Audience field's value.
func ( s * AssumeRoleWithWebIdentityOutput ) SetAudience ( v string ) * AssumeRoleWithWebIdentityOutput {
s . Audience = & v
return s
}
// SetCredentials sets the Credentials field's value.
func ( s * AssumeRoleWithWebIdentityOutput ) SetCredentials ( v * Credentials ) * AssumeRoleWithWebIdentityOutput {
s . Credentials = v
return s
}
// SetPackedPolicySize sets the PackedPolicySize field's value.
func ( s * AssumeRoleWithWebIdentityOutput ) SetPackedPolicySize ( v int64 ) * AssumeRoleWithWebIdentityOutput {
s . PackedPolicySize = & v
return s
}
// SetProvider sets the Provider field's value.
func ( s * AssumeRoleWithWebIdentityOutput ) SetProvider ( v string ) * AssumeRoleWithWebIdentityOutput {
s . Provider = & v
return s
}
2021-06-04 08:59:18 +00:00
// SetSourceIdentity sets the SourceIdentity field's value.
func ( s * AssumeRoleWithWebIdentityOutput ) SetSourceIdentity ( v string ) * AssumeRoleWithWebIdentityOutput {
s . SourceIdentity = & v
return s
}
2021-03-22 16:29:47 +00:00
// SetSubjectFromWebIdentityToken sets the SubjectFromWebIdentityToken field's value.
func ( s * AssumeRoleWithWebIdentityOutput ) SetSubjectFromWebIdentityToken ( v string ) * AssumeRoleWithWebIdentityOutput {
s . SubjectFromWebIdentityToken = & v
return s
}
// The identifiers for the temporary security credentials that the operation
// returns.
type AssumedRoleUser struct {
_ struct { } ` type:"structure" `
// The ARN of the temporary security credentials that are returned from the
// AssumeRole action. For more information about ARNs and how to use them in
// policies, see IAM Identifiers (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html)
// in the IAM User Guide.
//
// Arn is a required field
Arn * string ` min:"20" type:"string" required:"true" `
// A unique identifier that contains the role ID and the role session name of
2021-09-01 13:20:44 +00:00
// the role that is being assumed. The role ID is generated by Amazon Web Services
// when the role is created.
2021-03-22 16:29:47 +00:00
//
// AssumedRoleId is a required field
AssumedRoleId * string ` min:"2" type:"string" required:"true" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumedRoleUser ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s AssumedRoleUser ) GoString ( ) string {
return s . String ( )
}
// SetArn sets the Arn field's value.
func ( s * AssumedRoleUser ) SetArn ( v string ) * AssumedRoleUser {
s . Arn = & v
return s
}
// SetAssumedRoleId sets the AssumedRoleId field's value.
func ( s * AssumedRoleUser ) SetAssumedRoleId ( v string ) * AssumedRoleUser {
s . AssumedRoleId = & v
return s
}
2021-09-01 13:20:44 +00:00
// Amazon Web Services credentials for API authentication.
2021-03-22 16:29:47 +00:00
type Credentials struct {
_ struct { } ` type:"structure" `
// The access key ID that identifies the temporary security credentials.
//
// AccessKeyId is a required field
AccessKeyId * string ` min:"16" type:"string" required:"true" `
// The date on which the current credentials expire.
//
// Expiration is a required field
Expiration * time . Time ` type:"timestamp" required:"true" `
// The secret access key that can be used to sign requests.
//
2023-05-22 21:01:09 +00:00
// SecretAccessKey is a sensitive parameter and its value will be
// replaced with "sensitive" in string returned by Credentials's
// String and GoString methods.
//
2021-03-22 16:29:47 +00:00
// SecretAccessKey is a required field
2023-05-22 21:01:09 +00:00
SecretAccessKey * string ` type:"string" required:"true" sensitive:"true" `
2021-03-22 16:29:47 +00:00
// The token that users must pass to the service API to use the temporary credentials.
//
// SessionToken is a required field
SessionToken * string ` type:"string" required:"true" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s Credentials ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s Credentials ) GoString ( ) string {
return s . String ( )
}
// SetAccessKeyId sets the AccessKeyId field's value.
func ( s * Credentials ) SetAccessKeyId ( v string ) * Credentials {
s . AccessKeyId = & v
return s
}
// SetExpiration sets the Expiration field's value.
func ( s * Credentials ) SetExpiration ( v time . Time ) * Credentials {
s . Expiration = & v
return s
}
// SetSecretAccessKey sets the SecretAccessKey field's value.
func ( s * Credentials ) SetSecretAccessKey ( v string ) * Credentials {
s . SecretAccessKey = & v
return s
}
// SetSessionToken sets the SessionToken field's value.
func ( s * Credentials ) SetSessionToken ( v string ) * Credentials {
s . SessionToken = & v
return s
}
type DecodeAuthorizationMessageInput struct {
_ struct { } ` type:"structure" `
// The encoded message that was returned with the response.
//
// EncodedMessage is a required field
EncodedMessage * string ` min:"1" type:"string" required:"true" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s DecodeAuthorizationMessageInput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s DecodeAuthorizationMessageInput ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * DecodeAuthorizationMessageInput ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "DecodeAuthorizationMessageInput" }
if s . EncodedMessage == nil {
invalidParams . Add ( request . NewErrParamRequired ( "EncodedMessage" ) )
}
if s . EncodedMessage != nil && len ( * s . EncodedMessage ) < 1 {
invalidParams . Add ( request . NewErrParamMinLen ( "EncodedMessage" , 1 ) )
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetEncodedMessage sets the EncodedMessage field's value.
func ( s * DecodeAuthorizationMessageInput ) SetEncodedMessage ( v string ) * DecodeAuthorizationMessageInput {
s . EncodedMessage = & v
return s
}
// A document that contains additional information about the authorization status
2021-09-01 13:20:44 +00:00
// of a request from an encoded message that is returned in response to an Amazon
// Web Services request.
2021-03-22 16:29:47 +00:00
type DecodeAuthorizationMessageOutput struct {
_ struct { } ` type:"structure" `
2022-01-20 09:43:15 +00:00
// The API returns a response with the decoded message.
2021-03-22 16:29:47 +00:00
DecodedMessage * string ` type:"string" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s DecodeAuthorizationMessageOutput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s DecodeAuthorizationMessageOutput ) GoString ( ) string {
return s . String ( )
}
// SetDecodedMessage sets the DecodedMessage field's value.
func ( s * DecodeAuthorizationMessageOutput ) SetDecodedMessage ( v string ) * DecodeAuthorizationMessageOutput {
s . DecodedMessage = & v
return s
}
// Identifiers for the federated user that is associated with the credentials.
type FederatedUser struct {
_ struct { } ` type:"structure" `
// The ARN that specifies the federated user that is associated with the credentials.
// For more information about ARNs and how to use them in policies, see IAM
// Identifiers (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html)
// in the IAM User Guide.
//
// Arn is a required field
Arn * string ` min:"20" type:"string" required:"true" `
// The string that identifies the federated user associated with the credentials,
// similar to the unique ID of an IAM user.
//
// FederatedUserId is a required field
FederatedUserId * string ` min:"2" type:"string" required:"true" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s FederatedUser ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s FederatedUser ) GoString ( ) string {
return s . String ( )
}
// SetArn sets the Arn field's value.
func ( s * FederatedUser ) SetArn ( v string ) * FederatedUser {
s . Arn = & v
return s
}
// SetFederatedUserId sets the FederatedUserId field's value.
func ( s * FederatedUser ) SetFederatedUserId ( v string ) * FederatedUser {
s . FederatedUserId = & v
return s
}
type GetAccessKeyInfoInput struct {
_ struct { } ` type:"structure" `
// The identifier of an access key.
//
// This parameter allows (through its regex pattern) a string of characters
// that can consist of any upper- or lowercase letter or digit.
//
// AccessKeyId is a required field
AccessKeyId * string ` min:"16" type:"string" required:"true" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetAccessKeyInfoInput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetAccessKeyInfoInput ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * GetAccessKeyInfoInput ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "GetAccessKeyInfoInput" }
if s . AccessKeyId == nil {
invalidParams . Add ( request . NewErrParamRequired ( "AccessKeyId" ) )
}
if s . AccessKeyId != nil && len ( * s . AccessKeyId ) < 16 {
invalidParams . Add ( request . NewErrParamMinLen ( "AccessKeyId" , 16 ) )
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetAccessKeyId sets the AccessKeyId field's value.
func ( s * GetAccessKeyInfoInput ) SetAccessKeyId ( v string ) * GetAccessKeyInfoInput {
s . AccessKeyId = & v
return s
}
type GetAccessKeyInfoOutput struct {
_ struct { } ` type:"structure" `
2021-09-01 13:20:44 +00:00
// The number used to identify the Amazon Web Services account.
2021-03-22 16:29:47 +00:00
Account * string ` type:"string" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetAccessKeyInfoOutput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetAccessKeyInfoOutput ) GoString ( ) string {
return s . String ( )
}
// SetAccount sets the Account field's value.
func ( s * GetAccessKeyInfoOutput ) SetAccount ( v string ) * GetAccessKeyInfoOutput {
s . Account = & v
return s
}
type GetCallerIdentityInput struct {
_ struct { } ` type:"structure" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetCallerIdentityInput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetCallerIdentityInput ) GoString ( ) string {
return s . String ( )
}
// Contains the response to a successful GetCallerIdentity request, including
// information about the entity making the request.
type GetCallerIdentityOutput struct {
_ struct { } ` type:"structure" `
2021-09-01 13:20:44 +00:00
// The Amazon Web Services account ID number of the account that owns or contains
// the calling entity.
2021-03-22 16:29:47 +00:00
Account * string ` type:"string" `
2021-09-01 13:20:44 +00:00
// The Amazon Web Services ARN associated with the calling entity.
2021-03-22 16:29:47 +00:00
Arn * string ` min:"20" type:"string" `
// The unique identifier of the calling entity. The exact value depends on the
// type of entity that is making the call. The values returned are those listed
// in the aws:userid column in the Principal table (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable)
// found on the Policy Variables reference page in the IAM User Guide.
UserId * string ` type:"string" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetCallerIdentityOutput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetCallerIdentityOutput ) GoString ( ) string {
return s . String ( )
}
// SetAccount sets the Account field's value.
func ( s * GetCallerIdentityOutput ) SetAccount ( v string ) * GetCallerIdentityOutput {
s . Account = & v
return s
}
// SetArn sets the Arn field's value.
func ( s * GetCallerIdentityOutput ) SetArn ( v string ) * GetCallerIdentityOutput {
s . Arn = & v
return s
}
// SetUserId sets the UserId field's value.
func ( s * GetCallerIdentityOutput ) SetUserId ( v string ) * GetCallerIdentityOutput {
s . UserId = & v
return s
}
type GetFederationTokenInput struct {
_ struct { } ` type:"structure" `
// The duration, in seconds, that the session should last. Acceptable durations
// for federation sessions range from 900 seconds (15 minutes) to 129,600 seconds
// (36 hours), with 43,200 seconds (12 hours) as the default. Sessions obtained
2023-05-08 20:59:29 +00:00
// using root user credentials are restricted to a maximum of 3,600 seconds
// (one hour). If the specified duration is longer than one hour, the session
// obtained by using root user credentials defaults to one hour.
2021-03-22 16:29:47 +00:00
DurationSeconds * int64 ` min:"900" type:"integer" `
// The name of the federated user. The name is used as an identifier for the
// temporary security credentials (such as Bob). For example, you can reference
// the federated user name in a resource-based policy, such as in an Amazon
// S3 bucket policy.
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@-
//
// Name is a required field
Name * string ` min:"2" type:"string" required:"true" `
// An IAM policy in JSON format that you want to use as an inline session policy.
//
// You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// to this operation. You can pass a single JSON policy document to use as an
2022-11-21 20:13:23 +00:00
// inline session policy. You can also specify up to 10 managed policy Amazon
// Resource Names (ARNs) to use as managed session policies.
2021-03-22 16:29:47 +00:00
//
// This parameter is optional. However, if you do not pass any session policies,
// then the resulting federated user session has no permissions.
//
// When you pass session policies, the session permissions are the intersection
// of the IAM user policies and the session policies that you pass. This gives
// you a way to further restrict the permissions for a federated user. You cannot
// use session policies to grant more permissions than those that are defined
// in the permissions policy of the IAM user. For more information, see Session
// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// in the IAM User Guide.
//
// The resulting credentials can be used to access a resource that has a resource-based
// policy. If that policy specifically references the federated user session
// in the Principal element of the policy, the session has the permissions allowed
// by the policy. These permissions are granted in addition to the permissions
// that are granted by the session policies.
//
2021-06-04 08:59:18 +00:00
// The plaintext that you use for both inline and managed session policies can't
// exceed 2,048 characters. The JSON policy characters can be any ASCII character
// from the space character to the end of the valid character list (\u0020 through
// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
// return (\u000D) characters.
2021-03-22 16:29:47 +00:00
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
Policy * string ` min:"1" type:"string" `
// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
// to use as a managed session policy. The policies must exist in the same account
// as the IAM user that is requesting federated access.
//
// You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// to this operation. You can pass a single JSON policy document to use as an
2022-11-21 20:13:23 +00:00
// inline session policy. You can also specify up to 10 managed policy Amazon
// Resource Names (ARNs) to use as managed session policies. The plaintext that
// you use for both inline and managed session policies can't exceed 2,048 characters.
// You can provide up to 10 managed policy ARNs. For more information about
// ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces
// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
2021-09-01 13:20:44 +00:00
// in the Amazon Web Services General Reference.
2021-03-22 16:29:47 +00:00
//
// This parameter is optional. However, if you do not pass any session policies,
// then the resulting federated user session has no permissions.
//
// When you pass session policies, the session permissions are the intersection
// of the IAM user policies and the session policies that you pass. This gives
// you a way to further restrict the permissions for a federated user. You cannot
// use session policies to grant more permissions than those that are defined
// in the permissions policy of the IAM user. For more information, see Session
// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
// in the IAM User Guide.
//
// The resulting credentials can be used to access a resource that has a resource-based
// policy. If that policy specifically references the federated user session
// in the Principal element of the policy, the session has the permissions allowed
// by the policy. These permissions are granted in addition to the permissions
// that are granted by the session policies.
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
PolicyArns [ ] * PolicyDescriptorType ` type:"list" `
// A list of session tags. Each session tag consists of a key name and an associated
// value. For more information about session tags, see Passing Session Tags
// in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
//
2021-06-04 08:59:18 +00:00
// This parameter is optional. You can pass up to 50 session tags. The plaintext
// session tag keys can’ t exceed 128 characters and the values can’ t exceed
// 256 characters. For these and additional limits, see IAM and STS Character
2021-03-22 16:29:47 +00:00
// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
2022-11-21 20:13:23 +00:00
// An Amazon Web Services conversion compresses the passed inline session policy,
// managed policy ARNs, and session tags into a packed binary format that has
// a separate limit. Your request can fail for this limit even if your plaintext
// meets the other requirements. The PackedPolicySize response element indicates
// by percentage how close the policies and tags for your request are to the
// upper size limit.
2021-03-22 16:29:47 +00:00
//
// You can pass a session tag with the same key as a tag that is already attached
// to the user you are federating. When you do, session tags override a user
// tag with the same key.
//
// Tag key– value pairs are not case sensitive, but case is preserved. This
// means that you cannot have separate Department and department tag keys. Assume
// that the role has the Department=Marketing tag and you pass the department=engineering
// session tag. Department and department are not saved as separate tags, and
// the session tag passed in the request takes precedence over the role tag.
Tags [ ] * Tag ` type:"list" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetFederationTokenInput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetFederationTokenInput ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * GetFederationTokenInput ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "GetFederationTokenInput" }
if s . DurationSeconds != nil && * s . DurationSeconds < 900 {
invalidParams . Add ( request . NewErrParamMinValue ( "DurationSeconds" , 900 ) )
}
if s . Name == nil {
invalidParams . Add ( request . NewErrParamRequired ( "Name" ) )
}
if s . Name != nil && len ( * s . Name ) < 2 {
invalidParams . Add ( request . NewErrParamMinLen ( "Name" , 2 ) )
}
if s . Policy != nil && len ( * s . Policy ) < 1 {
invalidParams . Add ( request . NewErrParamMinLen ( "Policy" , 1 ) )
}
if s . PolicyArns != nil {
for i , v := range s . PolicyArns {
if v == nil {
continue
}
if err := v . Validate ( ) ; err != nil {
invalidParams . AddNested ( fmt . Sprintf ( "%s[%v]" , "PolicyArns" , i ) , err . ( request . ErrInvalidParams ) )
}
}
}
if s . Tags != nil {
for i , v := range s . Tags {
if v == nil {
continue
}
if err := v . Validate ( ) ; err != nil {
invalidParams . AddNested ( fmt . Sprintf ( "%s[%v]" , "Tags" , i ) , err . ( request . ErrInvalidParams ) )
}
}
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetDurationSeconds sets the DurationSeconds field's value.
func ( s * GetFederationTokenInput ) SetDurationSeconds ( v int64 ) * GetFederationTokenInput {
s . DurationSeconds = & v
return s
}
// SetName sets the Name field's value.
func ( s * GetFederationTokenInput ) SetName ( v string ) * GetFederationTokenInput {
s . Name = & v
return s
}
// SetPolicy sets the Policy field's value.
func ( s * GetFederationTokenInput ) SetPolicy ( v string ) * GetFederationTokenInput {
s . Policy = & v
return s
}
// SetPolicyArns sets the PolicyArns field's value.
func ( s * GetFederationTokenInput ) SetPolicyArns ( v [ ] * PolicyDescriptorType ) * GetFederationTokenInput {
s . PolicyArns = v
return s
}
// SetTags sets the Tags field's value.
func ( s * GetFederationTokenInput ) SetTags ( v [ ] * Tag ) * GetFederationTokenInput {
s . Tags = v
return s
}
// Contains the response to a successful GetFederationToken request, including
2021-09-01 13:20:44 +00:00
// temporary Amazon Web Services credentials that can be used to make Amazon
// Web Services requests.
2021-03-22 16:29:47 +00:00
type GetFederationTokenOutput struct {
_ struct { } ` type:"structure" `
// The temporary security credentials, which include an access key ID, a secret
// access key, and a security (or session) token.
//
// The size of the security token that STS API operations return is not fixed.
// We strongly recommend that you make no assumptions about the maximum size.
Credentials * Credentials ` type:"structure" `
// Identifiers for the federated user associated with the credentials (such
// as arn:aws:sts::123456789012:federated-user/Bob or 123456789012:Bob). You
// can use the federated user's ARN in your resource-based policies, such as
// an Amazon S3 bucket policy.
FederatedUser * FederatedUser ` type:"structure" `
// A percentage value that indicates the packed size of the session policies
// and session tags combined passed in the request. The request fails if the
// packed size is greater than 100 percent, which means the policies and tags
// exceeded the allowed space.
PackedPolicySize * int64 ` type:"integer" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetFederationTokenOutput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetFederationTokenOutput ) GoString ( ) string {
return s . String ( )
}
// SetCredentials sets the Credentials field's value.
func ( s * GetFederationTokenOutput ) SetCredentials ( v * Credentials ) * GetFederationTokenOutput {
s . Credentials = v
return s
}
// SetFederatedUser sets the FederatedUser field's value.
func ( s * GetFederationTokenOutput ) SetFederatedUser ( v * FederatedUser ) * GetFederationTokenOutput {
s . FederatedUser = v
return s
}
// SetPackedPolicySize sets the PackedPolicySize field's value.
func ( s * GetFederationTokenOutput ) SetPackedPolicySize ( v int64 ) * GetFederationTokenOutput {
s . PackedPolicySize = & v
return s
}
type GetSessionTokenInput struct {
_ struct { } ` type:"structure" `
// The duration, in seconds, that the credentials should remain valid. Acceptable
// durations for IAM user sessions range from 900 seconds (15 minutes) to 129,600
// seconds (36 hours), with 43,200 seconds (12 hours) as the default. Sessions
2021-09-01 13:20:44 +00:00
// for Amazon Web Services account owners are restricted to a maximum of 3,600
// seconds (one hour). If the duration is longer than one hour, the session
// for Amazon Web Services account owners defaults to one hour.
2021-03-22 16:29:47 +00:00
DurationSeconds * int64 ` min:"900" type:"integer" `
// The identification number of the MFA device that is associated with the IAM
// user who is making the GetSessionToken call. Specify this value if the IAM
// user has a policy that requires MFA authentication. The value is either the
// serial number for a hardware device (such as GAHT12345678) or an Amazon Resource
// Name (ARN) for a virtual device (such as arn:aws:iam::123456789012:mfa/user).
2022-01-20 09:43:15 +00:00
// You can find the device for an IAM user by going to the Amazon Web Services
// Management Console and viewing the user's security credentials.
2021-03-22 16:29:47 +00:00
//
// The regex used to validate this parameter is a string of characters consisting
// of upper- and lower-case alphanumeric characters with no spaces. You can
// also include underscores or any of the following characters: =,.@:/-
SerialNumber * string ` min:"9" type:"string" `
// The value provided by the MFA device, if MFA is required. If any policy requires
// the IAM user to submit an MFA code, specify this value. If MFA authentication
// is required, the user must provide a code when requesting a set of temporary
// security credentials. A user who fails to provide the code receives an "access
// denied" response when requesting resources that require MFA authentication.
//
// The format for this parameter, as described by its regex pattern, is a sequence
// of six numeric digits.
TokenCode * string ` min:"6" type:"string" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetSessionTokenInput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetSessionTokenInput ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * GetSessionTokenInput ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "GetSessionTokenInput" }
if s . DurationSeconds != nil && * s . DurationSeconds < 900 {
invalidParams . Add ( request . NewErrParamMinValue ( "DurationSeconds" , 900 ) )
}
if s . SerialNumber != nil && len ( * s . SerialNumber ) < 9 {
invalidParams . Add ( request . NewErrParamMinLen ( "SerialNumber" , 9 ) )
}
if s . TokenCode != nil && len ( * s . TokenCode ) < 6 {
invalidParams . Add ( request . NewErrParamMinLen ( "TokenCode" , 6 ) )
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetDurationSeconds sets the DurationSeconds field's value.
func ( s * GetSessionTokenInput ) SetDurationSeconds ( v int64 ) * GetSessionTokenInput {
s . DurationSeconds = & v
return s
}
// SetSerialNumber sets the SerialNumber field's value.
func ( s * GetSessionTokenInput ) SetSerialNumber ( v string ) * GetSessionTokenInput {
s . SerialNumber = & v
return s
}
// SetTokenCode sets the TokenCode field's value.
func ( s * GetSessionTokenInput ) SetTokenCode ( v string ) * GetSessionTokenInput {
s . TokenCode = & v
return s
}
// Contains the response to a successful GetSessionToken request, including
2021-09-01 13:20:44 +00:00
// temporary Amazon Web Services credentials that can be used to make Amazon
// Web Services requests.
2021-03-22 16:29:47 +00:00
type GetSessionTokenOutput struct {
_ struct { } ` type:"structure" `
// The temporary security credentials, which include an access key ID, a secret
// access key, and a security (or session) token.
//
// The size of the security token that STS API operations return is not fixed.
// We strongly recommend that you make no assumptions about the maximum size.
Credentials * Credentials ` type:"structure" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetSessionTokenOutput ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s GetSessionTokenOutput ) GoString ( ) string {
return s . String ( )
}
// SetCredentials sets the Credentials field's value.
func ( s * GetSessionTokenOutput ) SetCredentials ( v * Credentials ) * GetSessionTokenOutput {
s . Credentials = v
return s
}
// A reference to the IAM managed policy that is passed as a session policy
// for a role session or a federated user session.
type PolicyDescriptorType struct {
_ struct { } ` type:"structure" `
// The Amazon Resource Name (ARN) of the IAM managed policy to use as a session
// policy for the role. For more information about ARNs, see Amazon Resource
2021-09-01 13:20:44 +00:00
// Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
// in the Amazon Web Services General Reference.
2021-03-22 16:29:47 +00:00
Arn * string ` locationName:"arn" min:"20" type:"string" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s PolicyDescriptorType ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s PolicyDescriptorType ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * PolicyDescriptorType ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "PolicyDescriptorType" }
if s . Arn != nil && len ( * s . Arn ) < 20 {
invalidParams . Add ( request . NewErrParamMinLen ( "Arn" , 20 ) )
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetArn sets the Arn field's value.
func ( s * PolicyDescriptorType ) SetArn ( v string ) * PolicyDescriptorType {
s . Arn = & v
return s
}
2023-11-20 20:28:57 +00:00
// Contains information about the provided context. This includes the signed
// and encrypted trusted context assertion and the context provider ARN from
// which the trusted context assertion was generated.
2023-07-26 07:15:37 +00:00
type ProvidedContext struct {
_ struct { } ` type:"structure" `
2023-11-20 20:28:57 +00:00
// The signed and encrypted trusted context assertion generated by the context
// provider. The trusted context assertion is signed and encrypted by Amazon
// Web Services STS.
2023-07-26 07:15:37 +00:00
ContextAssertion * string ` min:"4" type:"string" `
2023-11-20 20:28:57 +00:00
// The context provider ARN from which the trusted context assertion was generated.
2023-07-26 07:15:37 +00:00
ProviderArn * string ` min:"20" type:"string" `
}
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
func ( s ProvidedContext ) String ( ) string {
return awsutil . Prettify ( s )
}
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
func ( s ProvidedContext ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * ProvidedContext ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "ProvidedContext" }
if s . ContextAssertion != nil && len ( * s . ContextAssertion ) < 4 {
invalidParams . Add ( request . NewErrParamMinLen ( "ContextAssertion" , 4 ) )
}
if s . ProviderArn != nil && len ( * s . ProviderArn ) < 20 {
invalidParams . Add ( request . NewErrParamMinLen ( "ProviderArn" , 20 ) )
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetContextAssertion sets the ContextAssertion field's value.
func ( s * ProvidedContext ) SetContextAssertion ( v string ) * ProvidedContext {
s . ContextAssertion = & v
return s
}
// SetProviderArn sets the ProviderArn field's value.
func ( s * ProvidedContext ) SetProviderArn ( v string ) * ProvidedContext {
s . ProviderArn = & v
return s
}
2021-03-22 16:29:47 +00:00
// You can pass custom key-value pair attributes when you assume a role or federate
// a user. These are called session tags. You can then use the session tags
2022-01-20 09:43:15 +00:00
// to control access to resources. For more information, see Tagging Amazon
// Web Services STS Sessions (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
// in the IAM User Guide.
2021-03-22 16:29:47 +00:00
type Tag struct {
_ struct { } ` type:"structure" `
// The key for a session tag.
//
// You can pass up to 50 session tags. The plain text session tag keys can’ t
// exceed 128 characters. For these and additional limits, see IAM and STS Character
// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
// Key is a required field
Key * string ` min:"1" type:"string" required:"true" `
// The value for a session tag.
//
// You can pass up to 50 session tags. The plain text session tag values can’ t
// exceed 256 characters. For these and additional limits, see IAM and STS Character
// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
// in the IAM User Guide.
//
// Value is a required field
Value * string ` type:"string" required:"true" `
}
2021-09-22 11:11:10 +00:00
// String returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s Tag ) String ( ) string {
return awsutil . Prettify ( s )
}
2021-09-22 11:11:10 +00:00
// GoString returns the string representation.
//
// API parameter values that are decorated as "sensitive" in the API will not
// be included in the string output. The member name will be present, but the
// value will be replaced with "sensitive".
2021-03-22 16:29:47 +00:00
func ( s Tag ) GoString ( ) string {
return s . String ( )
}
// Validate inspects the fields of the type to determine if they are valid.
func ( s * Tag ) Validate ( ) error {
invalidParams := request . ErrInvalidParams { Context : "Tag" }
if s . Key == nil {
invalidParams . Add ( request . NewErrParamRequired ( "Key" ) )
}
if s . Key != nil && len ( * s . Key ) < 1 {
invalidParams . Add ( request . NewErrParamMinLen ( "Key" , 1 ) )
}
if s . Value == nil {
invalidParams . Add ( request . NewErrParamRequired ( "Value" ) )
}
if invalidParams . Len ( ) > 0 {
return invalidParams
}
return nil
}
// SetKey sets the Key field's value.
func ( s * Tag ) SetKey ( v string ) * Tag {
s . Key = & v
return s
}
// SetValue sets the Value field's value.
func ( s * Tag ) SetValue ( v string ) * Tag {
s . Value = & v
return s
}