Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 api.go // Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. package sts import ( "fmt" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awsutil" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/request" ) const opAssumeRole = "AssumeRole" // AssumeRoleRequest generates a "aws/request.Request" representing the // client's request for the AssumeRole operation. The "output" return // value will be populated with the request's response once the request completes // successfully. // // Use "Send" method on the returned Request to send the API call to the service. // the "output" return value is not valid until after Send returns without error. // // See AssumeRole for more information on using the AssumeRole // API call, and error handling. // // This method is useful when you want to inject custom logic or configuration // into the SDK's request lifecycle. Such as custom headers, or retry logic. // // // Example sending a request using the AssumeRoleRequest method. // req, resp := client.AssumeRoleRequest(params) // // err := req.Send() // if err == nil { // resp is now filled // fmt.Println(resp) // } // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole func (c STS) AssumeRoleRequest(input AssumeRoleInput) (req request.Request, output AssumeRoleOutput) { op := &request.Operation{ Name: opAssumeRole, HTTPMethod: "POST", HTTPPath: "/", } if input == nil { input = &AssumeRoleInput{} } output = &AssumeRoleOutput{} req = c.newRequest(op, input, output) return } // AssumeRole API operation for AWS Security Token Service. // // Returns a set of temporary security credentials that you can use to access // Amazon Web Services resources. These temporary credentials consist of an // access key ID, a secret access key, and a security token. Typically, you // use AssumeRole within your account or for cross-account access. For a comparison // of AssumeRole with other API operations that produce temporary credentials, // see Requesting Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) // and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison) // in the IAM User Guide. // // # Permissions // // The temporary security credentials created by AssumeRole can be used to make // API calls to any Amazon Web Services service with the following exception: // You cannot call the Amazon Web Services STS GetFederationToken or GetSessionToken // API operations. // // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // to this operation. You can pass a single JSON policy document to use as an // inline session policy. You can also specify up to 10 managed policy Amazon // Resource Names (ARNs) to use as managed session policies. The plaintext that // you use for both inline and managed session policies can't exceed 2,048 characters. // Passing policies to this operation returns new temporary credentials. The // resulting session's permissions are the intersection of the role's identity-based // policy and the session policies. You can use the role's temporary credentials // in subsequent Amazon Web Services API calls to access resources in the account // that owns the role. You cannot use session policies to grant more permissions // than those allowed by the identity-based policy of the role that is being // assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. // // When you create a role, you create two policies: a role trust policy that // specifies who can assume the role, and a permissions policy that specifies // what can be done with the role. You specify the trusted principal that is // allowed to assume the role in the role trust policy. // // To assume a role from a different account, your Amazon Web Services account // must be trusted by the role. The trust relationship is defined in the role's // trust policy when the role is created. That trust policy states which accounts // are allowed to delegate that access to users in the account. // // A user who wants to access a role in a different account must also have permissions // that are delegated from the account administrator. The administrator must // attach a policy that allows the user to call AssumeRole for the ARN of the // role in the other account. // // To allow a user to assume a role in the same account, you can do either of // the following: // // - Attach a policy to the user that allows the user to call AssumeRole // (as long as the role's trust policy trusts the account). // // - Add the user as a principal directly in the role's trust policy. // // You can do either because the role’s trust policy acts as an IAM resource-based // policy. When a resource-based policy grants access to a principal in the // same account, no additional identity-based policy is required. For more information // about trust policies and resource-based policies, see IAM Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) // in the IAM User Guide. // // # Tags // // (Optional) You can pass tag key-value pairs to your session. These tags are // called session tags. For more information about session tags, see Passing // Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // An administrator must grant you the permissions necessary to pass session // tags. The administrator can also create granular permissions to allow you // to pass only specific session tags. For more information, see Tutorial: Using // Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html) // in the IAM User Guide. // // You can set the session tags as transitive. Transitive tags persist during // role chaining. For more information, see Chaining Roles with Session Tags // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining) // in the IAM User Guide. // // # Using MFA with AssumeRole // // (Optional) You can include multi-factor authentication (MFA) information // when you call AssumeRole. This is useful for cross-account scenarios to ensure // that the user that assumes the role has been authenticated with an Amazon // Web Services MFA device. In that scenario, the trust policy of the role being // assumed includes a condition that tests for MFA authentication. If the caller // does not include valid MFA information, the request to assume the role is // denied. The condition in a trust policy that tests for MFA authentication // might look like the following example. // // "Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}} // // For more information, see Configuring MFA-Protected API Access (https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html) // in the IAM User Guide guide. // // To use MFA with AssumeRole, you pass values for the SerialNumber and TokenCode // parameters. The SerialNumber value identifies the user's hardware or virtual // MFA device. The TokenCode is the time-based one-time password (TOTP) that // the MFA device produces. // // Returns awserr.Error for service API and SDK errors. Use runtime type assertions // with awserr.Error's Code and Message methods to get detailed information about // the error. // // See the AWS API reference guide for AWS Security Token Service's // API operation AssumeRole for usage and error information. // // Returned Error Codes: // // - ErrCodeMalformedPolicyDocumentException "MalformedPolicyDocument" // The request was rejected because the policy document was malformed. The error // message describes the specific error. // // - ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge" // The request was rejected because the total packed size of the session policies // and session tags combined was too large. An Amazon Web Services conversion // compresses the session policy document, session policy ARNs, and session // tags into a packed binary format that has a separate limit. The error message // indicates by percentage how close the policies and tags are to the upper // size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // You could receive this error even though you meet other defined session policy // and session tag limits. For more information, see IAM and STS Entity Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // - ErrCodeRegionDisabledException "RegionDisabledException" // STS is not activated in the requested region for the account that is being // asked to generate credentials. The account administrator must use the IAM // console to activate STS in that region. For more information, see Activating // and Deactivating Amazon Web Services STS in an Amazon Web Services Region // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) // in the IAM User Guide. // // - ErrCodeExpiredTokenException "ExpiredTokenException" // The web identity token that was passed is expired or is not valid. Get a // new identity token from the identity provider and then retry the request. // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole func (c STS) AssumeRole(input AssumeRoleInput) (AssumeRoleOutput, error) { req, out := c.AssumeRoleRequest(input) return out, req.Send() } // AssumeRoleWithContext is the same as AssumeRole with the addition of // the ability to pass a context and additional request options. // // See AssumeRole for details on how to use this API operation. // // The context must be non-nil and will be used for request cancellation. If // the context is nil a panic will occur. In the future the SDK may create // sub-contexts for http.Requests. See https://golang.org/pkg/context/ // for more information on using Contexts. func (c STS) AssumeRoleWithContext(ctx aws.Context, input AssumeRoleInput, opts ...request.Option) (AssumeRoleOutput, error) { req, out := c.AssumeRoleRequest(input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } const opAssumeRoleWithSAML = "AssumeRoleWithSAML" // AssumeRoleWithSAMLRequest generates a "aws/request.Request" representing the // client's request for the AssumeRoleWithSAML operation. The "output" return // value will be populated with the request's response once the request completes // successfully. // // Use "Send" method on the returned Request to send the API call to the service. // the "output" return value is not valid until after Send returns without error. // // See AssumeRoleWithSAML for more information on using the AssumeRoleWithSAML // API call, and error handling. // // This method is useful when you want to inject custom logic or configuration // into the SDK's request lifecycle. Such as custom headers, or retry logic. // // // Example sending a request using the AssumeRoleWithSAMLRequest method. // req, resp := client.AssumeRoleWithSAMLRequest(params) // // err := req.Send() // if err == nil { // resp is now filled // fmt.Println(resp) // } // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML func (c STS) AssumeRoleWithSAMLRequest(input AssumeRoleWithSAMLInput) (req request.Request, output AssumeRoleWithSAMLOutput) { op := &request.Operation{ Name: opAssumeRoleWithSAML, HTTPMethod: "POST", HTTPPath: "/", } if input == nil { input = &AssumeRoleWithSAMLInput{} } output = &AssumeRoleWithSAMLOutput{} req = c.newRequest(op, input, output) req.Config.Credentials = credentials.AnonymousCredentials return } // AssumeRoleWithSAML API operation for AWS Security Token Service. // // Returns a set of temporary security credentials for users who have been authenticated // via a SAML authentication response. This operation provides a mechanism for // tying an enterprise identity store or directory to role-based Amazon Web // Services access without user-specific credentials or configuration. For a // comparison of AssumeRoleWithSAML with the other API operations that produce // temporary credentials, see Requesting Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) // and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison) // in the IAM User Guide. // // The temporary security credentials returned by this operation consist of // an access key ID, a secret access key, and a security token. Applications // can use these temporary security credentials to sign calls to Amazon Web // Services services. // // # Session Duration // // By default, the temporary security credentials created by AssumeRoleWithSAML // last for one hour. However, you can use the optional DurationSeconds parameter // to specify the duration of your session. Your role session lasts for the // duration that you specify, or until the time specified in the SAML authentication // response's SessionNotOnOrAfter value, whichever is shorter. You can provide // a DurationSeconds value from 900 seconds (15 minutes) up to the maximum session // duration setting for the role. This setting can have a value from 1 hour // to 12 hours. To learn how to view the maximum value for your role, see View // the Maximum Session Duration Setting for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) // in the IAM User Guide. The maximum session duration limit applies when you // use the AssumeRole* API operations or the assume-role* CLI commands. However // the limit does not apply when you use those operations to create a console // URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html) // in the IAM User Guide. // // Role chaining (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining) // limits your CLI or Amazon Web Services API role session to a maximum of one // hour. When you use the AssumeRole API operation to assume a role, you can // specify the duration of your role session with the DurationSeconds parameter. // You can specify a parameter value of up to 43200 seconds (12 hours), depending // on the maximum session duration setting for your role. However, if you assume // a role using role chaining and provide a DurationSeconds parameter value // greater than one hour, the operation fails. // // # Permissions // // The temporary security credentials created by AssumeRoleWithSAML can be used // to make API calls to any Amazon Web Services service with the following exception: // you cannot call the STS GetFederationToken or GetSessionToken API operations. // // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // to this operation. You can pass a single JSON policy document to use as an // inline session policy. You can also specify up to 10 managed policy Amazon // Resource Names (ARNs) to use as managed session policies. The plaintext that // you use for both inline and managed session policies can't exceed 2,048 characters. // Passing policies to this operation returns new temporary credentials. The // resulting session's permissions are the intersection of the role's identity-based // policy and the session policies. You can use the role's temporary credentials // in subsequent Amazon Web Services API calls to access resources in the account // that owns the role. You cannot use session policies to grant more permissions // than those allowed by the identity-based policy of the role that is being // assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. // // Calling AssumeRoleWithSAML does not require the use of Amazon Web Services // security credentials. The identity of the caller is validated by using keys // in the metadata document that is uploaded for the SAML provider entity for // your identity provider. // // Calling AssumeRoleWithSAML can result in an entry in your CloudTrail logs. // The entry includes the value in the NameID element of the SAML assertion. // We recommend that you use a NameIDType that is not associated with any personally // identifiable information (PII). For example, you could instead use the persistent // identifier (urn:oasis:names:tc:SAML:2.0:nameid-format:persistent). // // # Tags // // (Optional) You can configure your IdP to pass attributes into your SAML assertion // as session tags. Each session tag consists of a key name and an associated // value. For more information about session tags, see Passing Session Tags // in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // You can pass up to 50 session tags. The plaintext session tag keys can’t // exceed 128 characters and the values can’t exceed 256 characters. For these // and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. // // You can pass a session tag with the same key as a tag that is attached to // the role. When you do, session tags override the role's tags with the same // key. // // An administrator must grant you the permissions necessary to pass session // tags. The administrator can also create granular permissions to allow you // to pass only specific session tags. For more information, see Tutorial: Using // Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html) // in the IAM User Guide. // // You can set the session tags as transitive. Transitive tags persist during // role chaining. For more information, see Chaining Roles with Session Tags // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining) // in the IAM User Guide. // // # SAML Configuration // // Before your application can call AssumeRoleWithSAML, you must configure your // SAML identity provider (IdP) to issue the claims required by Amazon Web Services. // Additionally, you must use Identity and Access Management (IAM) to create // a SAML provider entity in your Amazon Web Services account that represents // your identity provider. You must also create an IAM role that specifies this // SAML provider in its trust policy. // // For more information, see the following resources: // // - About SAML 2.0-based Federation (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html) // in the IAM User Guide. // // - Creating SAML Identity Providers (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html) // in the IAM User Guide. // // - Configuring a Relying Party and Claims (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_relying-party.html) // in the IAM User Guide. // // - Creating a Role for SAML 2.0 Federation (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_saml.html) // in the IAM User Guide. // // Returns awserr.Error for service API and SDK errors. Use runtime type assertions // with awserr.Error's Code and Message methods to get detailed information about // the error. // // See the AWS API reference guide for AWS Security Token Service's // API operation AssumeRoleWithSAML for usage and error information. // // Returned Error Codes: // // - ErrCodeMalformedPolicyDocumentException "MalformedPolicyDocument" // The request was rejected because the policy document was malformed. The error // message describes the specific error. // // - ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge" // The request was rejected because the total packed size of the session policies // and session tags combined was too large. An Amazon Web Services conversion // compresses the session policy document, session policy ARNs, and session // tags into a packed binary format that has a separate limit. The error message // indicates by percentage how close the policies and tags are to the upper // size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // You could receive this error even though you meet other defined session policy // and session tag limits. For more information, see IAM and STS Entity Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // - ErrCodeIDPRejectedClaimException "IDPRejectedClaim" // The identity provider (IdP) reported that authentication failed. This might // be because the claim is invalid. // // If this error is returned for the AssumeRoleWithWebIdentity operation, it // can also mean that the claim has expired or has been explicitly revoked. // // - ErrCodeInvalidIdentityTokenException "InvalidIdentityToken" // The web identity token that was passed could not be validated by Amazon Web // Services. Get a new identity token from the identity provider and then retry // the request. // // - ErrCodeExpiredTokenException "ExpiredTokenException" // The web identity token that was passed is expired or is not valid. Get a // new identity token from the identity provider and then retry the request. // // - ErrCodeRegionDisabledException "RegionDisabledException" // STS is not activated in the requested region for the account that is being // asked to generate credentials. The account administrator must use the IAM // console to activate STS in that region. For more information, see Activating // and Deactivating Amazon Web Services STS in an Amazon Web Services Region // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) // in the IAM User Guide. // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML func (c STS) AssumeRoleWithSAML(input AssumeRoleWithSAMLInput) (AssumeRoleWithSAMLOutput, error) { req, out := c.AssumeRoleWithSAMLRequest(input) return out, req.Send() } // AssumeRoleWithSAMLWithContext is the same as AssumeRoleWithSAML with the addition of // the ability to pass a context and additional request options. // // See AssumeRoleWithSAML for details on how to use this API operation. // // The context must be non-nil and will be used for request cancellation. If // the context is nil a panic will occur. In the future the SDK may create // sub-contexts for http.Requests. See https://golang.org/pkg/context/ // for more information on using Contexts. func (c STS) AssumeRoleWithSAMLWithContext(ctx aws.Context, input AssumeRoleWithSAMLInput, opts ...request.Option) (AssumeRoleWithSAMLOutput, error) { req, out := c.AssumeRoleWithSAMLRequest(input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } const opAssumeRoleWithWebIdentity = "AssumeRoleWithWebIdentity" // AssumeRoleWithWebIdentityRequest generates a "aws/request.Request" representing the // client's request for the AssumeRoleWithWebIdentity operation. The "output" return // value will be populated with the request's response once the request completes // successfully. // // Use "Send" method on the returned Request to send the API call to the service. // the "output" return value is not valid until after Send returns without error. // // See AssumeRoleWithWebIdentity for more information on using the AssumeRoleWithWebIdentity // API call, and error handling. // // This method is useful when you want to inject custom logic or configuration // into the SDK's request lifecycle. Such as custom headers, or retry logic. // // // Example sending a request using the AssumeRoleWithWebIdentityRequest method. // req, resp := client.AssumeRoleWithWebIdentityRequest(params) // // err := req.Send() // if err == nil { // resp is now filled // fmt.Println(resp) // } // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity func (c STS) AssumeRoleWithWebIdentityRequest(input AssumeRoleWithWebIdentityInput) (req request.Request, output AssumeRoleWithWebIdentityOutput) { op := &request.Operation{ Name: opAssumeRoleWithWebIdentity, HTTPMethod: "POST", HTTPPath: "/", } if input == nil { input = &AssumeRoleWithWebIdentityInput{} } output = &AssumeRoleWithWebIdentityOutput{} req = c.newRequest(op, input, output) req.Config.Credentials = credentials.AnonymousCredentials return } // AssumeRoleWithWebIdentity API operation for AWS Security Token Service. // // Returns a set of temporary security credentials for users who have been authenticated // in a mobile or web application with a web identity provider. Example providers // include the OAuth 2.0 providers Login with Amazon and Facebook, or any OpenID // Connect-compatible identity provider such as Google or Amazon Cognito federated // identities (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html). // // For mobile applications, we recommend that you use Amazon Cognito. You can // use Amazon Cognito with the Amazon Web Services SDK for iOS Developer Guide // (http://aws.amazon.com/sdkforios/) and the Amazon Web Services SDK for Android // Developer Guide (http://aws.amazon.com/sdkforandroid/) to uniquely identify // a user. You can also supply the user with a consistent identity throughout // the lifetime of an application. // // To learn more about Amazon Cognito, see Amazon Cognito identity pools (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html) // in Amazon Cognito Developer Guide. // // Calling AssumeRoleWithWebIdentity does not require the use of Amazon Web // Services security credentials. Therefore, you can distribute an application // (for example, on mobile devices) that requests temporary security credentials // without including long-term Amazon Web Services credentials in the application. // You also don't need to deploy server-based proxy services that use long-term // Amazon Web Services credentials. Instead, the identity of the caller is validated // by using a token from the web identity provider. For a comparison of AssumeRoleWithWebIdentity // with the other API operations that produce temporary credentials, see Requesting // Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) // and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison) // in the IAM User Guide. // // The temporary security credentials returned by this API consist of an access // key ID, a secret access key, and a security token. Applications can use these // temporary security credentials to sign calls to Amazon Web Services service // API operations. // // # Session Duration // // By default, the temporary security credentials created by AssumeRoleWithWebIdentity // last for one hour. However, you can use the optional DurationSeconds parameter // to specify the duration of your session. You can provide a value from 900 // seconds (15 minutes) up to the maximum session duration setting for the role. // This setting can have a value from 1 hour to 12 hours. To learn how to view // the maximum value for your role, see View the Maximum Session Duration Setting // for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) // in the IAM User Guide. The maximum session duration limit applies when you // use the AssumeRole* API operations or the assume-role* CLI commands. However // the limit does not apply when you use those operations to create a console // URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html) // in the IAM User Guide. // // # Permissions // // The temporary security credentials created by AssumeRoleWithWebIdentity can // be used to make API calls to any Amazon Web Services service with the following // exception: you cannot call the STS GetFederationToken or GetSessionToken // API operations. // // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // to this operation. You can pass a single JSON policy document to use as an // inline session policy. You can also specify up to 10 managed policy Amazon // Resource Names (ARNs) to use as managed session policies. The plaintext that // you use for both inline and managed session policies can't exceed 2,048 characters. // Passing policies to this operation returns new temporary credentials. The // resulting session's permissions are the intersection of the role's identity-based // policy and the session policies. You can use the role's temporary credentials // in subsequent Amazon Web Services API calls to access resources in the account // that owns the role. You cannot use session policies to grant more permissions // than those allowed by the identity-based policy of the role that is being // assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. // // # Tags // // (Optional) You can configure your IdP to pass attributes into your web identity // token as session tags. Each session tag consists of a key name and an associated // value. For more information about session tags, see Passing Session Tags // in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // You can pass up to 50 session tags. The plaintext session tag keys can’t // exceed 128 characters and the values can’t exceed 256 characters. For these // and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. // // You can pass a session tag with the same key as a tag that is attached to // the role. When you do, the session tag overrides the role tag with the same // key. // // An administrator must grant you the permissions necessary to pass session // tags. The administrator can also create granular permissions to allow you // to pass only specific session tags. For more information, see Tutorial: Using // Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html) // in the IAM User Guide. // // You can set the session tags as transitive. Transitive tags persist during // role chaining. For more information, see Chaining Roles with Session Tags // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining) // in the IAM User Guide. // // # Identities // // Before your application can call AssumeRoleWithWebIdentity, you must have // an identity token from a supported identity provider and create a role that // the application can assume. The role that your application assumes must trust // the identity provider that is associated with the identity token. In other // words, the identity provider must be specified in the role's trust policy. // // Calling AssumeRoleWithWebIdentity can result in an entry in your CloudTrail // logs. The entry includes the Subject (http://openid.net/specs/openid-connect-core-1_0.html#Claims) // of the provided web identity token. We recommend that you avoid using any // personally identifiable information (PII) in this field. For example, you // could instead use a GUID or a pairwise identifier, as suggested in the OIDC // specification (http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes). // // For more information about how to use web identity federation and the AssumeRoleWithWebIdentity // API, see the following resources: // // - Using Web Identity Federation API Operations for Mobile Apps (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html) // and Federation Through a Web-based Identity Provider (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity). // // - Web Identity Federation Playground (https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/). // Walk through the process of authenticating through Login with Amazon, // Facebook, or Google, getting temporary security credentials, and then // using those credentials to make a request to Amazon Web Services. // // - Amazon Web Services SDK for iOS Developer Guide (http://aws.amazon.com/sdkforios/) // and Amazon Web Services SDK for Android Developer Guide (http://aws.amazon.com/sdkforandroid/). // These toolkits contain sample apps that show how to invoke the identity // providers. The toolkits then show how to use the information from these // providers to get and use temporary security credentials. // // - Web Identity Federation with Mobile Applications (http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications). // This article discusses web identity federation and shows an example of // how to use web identity federation to get access to content in Amazon // S3. // // Returns awserr.Error for service API and SDK errors. Use runtime type assertions // with awserr.Error's Code and Message methods to get detailed information about // the error. // // See the AWS API reference guide for AWS Security Token Service's // API operation AssumeRoleWithWebIdentity for usage and error information. // // Returned Error Codes: // // - ErrCodeMalformedPolicyDocumentException "MalformedPolicyDocument" // The request was rejected because the policy document was malformed. The error // message describes the specific error. // // - ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge" // The request was rejected because the total packed size of the session policies // and session tags combined was too large. An Amazon Web Services conversion // compresses the session policy document, session policy ARNs, and session // tags into a packed binary format that has a separate limit. The error message // indicates by percentage how close the policies and tags are to the upper // size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // You could receive this error even though you meet other defined session policy // and session tag limits. For more information, see IAM and STS Entity Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // - ErrCodeIDPRejectedClaimException "IDPRejectedClaim" // The identity provider (IdP) reported that authentication failed. This might // be because the claim is invalid. // // If this error is returned for the AssumeRoleWithWebIdentity operation, it // can also mean that the claim has expired or has been explicitly revoked. // // - ErrCodeIDPCommunicationErrorException "IDPCommunicationError" // The request could not be fulfilled because the identity provider (IDP) that // was asked to verify the incoming identity token could not be reached. This // is often a transient error caused by network conditions. Retry the request // a limited number of times so that you don't exceed the request rate. If the // error persists, the identity provider might be down or not responding. // // - ErrCodeInvalidIdentityTokenException "InvalidIdentityToken" // The web identity token that was passed could not be validated by Amazon Web // Services. Get a new identity token from the identity provider and then retry // the request. // // - ErrCodeExpiredTokenException "ExpiredTokenException" // The web identity token that was passed is expired or is not valid. Get a // new identity token from the identity provider and then retry the request. // // - ErrCodeRegionDisabledException "RegionDisabledException" // STS is not activated in the requested region for the account that is being // asked to generate credentials. The account administrator must use the IAM // console to activate STS in that region. For more information, see Activating // and Deactivating Amazon Web Services STS in an Amazon Web Services Region // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) // in the IAM User Guide. // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity func (c STS) AssumeRoleWithWebIdentity(input AssumeRoleWithWebIdentityInput) (AssumeRoleWithWebIdentityOutput, error) { req, out := c.AssumeRoleWithWebIdentityRequest(input) return out, req.Send() } // AssumeRoleWithWebIdentityWithContext is the same as AssumeRoleWithWebIdentity with the addition of // the ability to pass a context and additional request options. // // See AssumeRoleWithWebIdentity for details on how to use this API operation. // // The context must be non-nil and will be used for request cancellation. If // the context is nil a panic will occur. In the future the SDK may create // sub-contexts for http.Requests. See https://golang.org/pkg/context/ // for more information on using Contexts. func (c STS) AssumeRoleWithWebIdentityWithContext(ctx aws.Context, input AssumeRoleWithWebIdentityInput, opts ...request.Option) (AssumeRoleWithWebIdentityOutput, error) { req, out := c.AssumeRoleWithWebIdentityRequest(input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } const opDecodeAuthorizationMessage = "DecodeAuthorizationMessage" // DecodeAuthorizationMessageRequest generates a "aws/request.Request" representing the // client's request for the DecodeAuthorizationMessage operation. The "output" return // value will be populated with the request's response once the request completes // successfully. // // Use "Send" method on the returned Request to send the API call to the service. // the "output" return value is not valid until after Send returns without error. // // See DecodeAuthorizationMessage for more information on using the DecodeAuthorizationMessage // API call, and error handling. // // This method is useful when you want to inject custom logic or configuration // into the SDK's request lifecycle. Such as custom headers, or retry logic. // // // Example sending a request using the DecodeAuthorizationMessageRequest method. // req, resp := client.DecodeAuthorizationMessageRequest(params) // // err := req.Send() // if err == nil { // resp is now filled // fmt.Println(resp) // } // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage func (c STS) DecodeAuthorizationMessageRequest(input DecodeAuthorizationMessageInput) (req request.Request, output DecodeAuthorizationMessageOutput) { op := &request.Operation{ Name: opDecodeAuthorizationMessage, HTTPMethod: "POST", HTTPPath: "/", } if input == nil { input = &DecodeAuthorizationMessageInput{} } output = &DecodeAuthorizationMessageOutput{} req = c.newRequest(op, input, output) return } // DecodeAuthorizationMessage API operation for AWS Security Token Service. // // Decodes additional information about the authorization status of a request // from an encoded message returned in response to an Amazon Web Services request. // // For example, if a user is not authorized to perform an operation that he // or she has requested, the request returns a Client.UnauthorizedOperation // response (an HTTP 403 response). Some Amazon Web Services operations additionally // return an encoded message that can provide details about this authorization // failure. // // Only certain Amazon Web Services operations return an encoded authorization // message. The documentation for an individual operation indicates whether // that operation returns an encoded message in addition to returning an HTTP // code. // // The message is encoded because the details of the authorization status can // contain privileged information that the user who requested the operation // should not see. To decode an authorization status message, a user must be // granted permissions through an IAM policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) // to request the DecodeAuthorizationMessage (sts:DecodeAuthorizationMessage) // action. // // The decoded message includes the following type of information: // // - Whether the request was denied due to an explicit deny or due to the // absence of an explicit allow. For more information, see Determining Whether // a Request is Allowed or Denied (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow) // in the IAM User Guide. // // - The principal who made the request. // // - The requested action. // // - The requested resource. // // - The values of condition keys in the context of the user's request. // // Returns awserr.Error for service API and SDK errors. Use runtime type assertions // with awserr.Error's Code and Message methods to get detailed information about // the error. // // See the AWS API reference guide for AWS Security Token Service's // API operation DecodeAuthorizationMessage for usage and error information. // // Returned Error Codes: // - ErrCodeInvalidAuthorizationMessageException "InvalidAuthorizationMessageException" // The error returned if the message passed to DecodeAuthorizationMessage was // invalid. This can happen if the token contains invalid characters, such as // linebreaks. // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage func (c STS) DecodeAuthorizationMessage(input DecodeAuthorizationMessageInput) (DecodeAuthorizationMessageOutput, error) { req, out := c.DecodeAuthorizationMessageRequest(input) return out, req.Send() } // DecodeAuthorizationMessageWithContext is the same as DecodeAuthorizationMessage with the addition of // the ability to pass a context and additional request options. // // See DecodeAuthorizationMessage for details on how to use this API operation. // // The context must be non-nil and will be used for request cancellation. If // the context is nil a panic will occur. In the future the SDK may create // sub-contexts for http.Requests. See https://golang.org/pkg/context/ // for more information on using Contexts. func (c STS) DecodeAuthorizationMessageWithContext(ctx aws.Context, input DecodeAuthorizationMessageInput, opts ...request.Option) (DecodeAuthorizationMessageOutput, error) { req, out := c.DecodeAuthorizationMessageRequest(input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } const opGetAccessKeyInfo = "GetAccessKeyInfo" // GetAccessKeyInfoRequest generates a "aws/request.Request" representing the // client's request for the GetAccessKeyInfo operation. The "output" return // value will be populated with the request's response once the request completes // successfully. // // Use "Send" method on the returned Request to send the API call to the service. // the "output" return value is not valid until after Send returns without error. // // See GetAccessKeyInfo for more information on using the GetAccessKeyInfo // API call, and error handling. // // This method is useful when you want to inject custom logic or configuration // into the SDK's request lifecycle. Such as custom headers, or retry logic. // // // Example sending a request using the GetAccessKeyInfoRequest method. // req, resp := client.GetAccessKeyInfoRequest(params) // // err := req.Send() // if err == nil { // resp is now filled // fmt.Println(resp) // } // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo func (c STS) GetAccessKeyInfoRequest(input GetAccessKeyInfoInput) (req request.Request, output GetAccessKeyInfoOutput) { op := &request.Operation{ Name: opGetAccessKeyInfo, HTTPMethod: "POST", HTTPPath: "/", } if input == nil { input = &GetAccessKeyInfoInput{} } output = &GetAccessKeyInfoOutput{} req = c.newRequest(op, input, output) return } // GetAccessKeyInfo API operation for AWS Security Token Service. // // Returns the account identifier for the specified access key ID. // // Access keys consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE) // and a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). // For more information about access keys, see Managing Access Keys for IAM // Users (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) // in the IAM User Guide. // // When you pass an access key ID to this operation, it returns the ID of the // Amazon Web Services account to which the keys belong. Access key IDs beginning // with AKIA are long-term credentials for an IAM user or the Amazon Web Services // account root user. Access key IDs beginning with ASIA are temporary credentials // that are created using STS operations. If the account in the response belongs // to you, you can sign in as the root user and review your root user access // keys. Then, you can pull a credentials report (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html) // to learn which IAM user owns the keys. To learn who requested the temporary // credentials for an ASIA access key, view the STS events in your CloudTrail // logs (https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html) // in the IAM User Guide. // // This operation does not indicate the state of the access key. The key might // be active, inactive, or deleted. Active keys might not have permissions to // perform an operation. Providing a deleted access key might return an error // that the key doesn't exist. // // Returns awserr.Error for service API and SDK errors. Use runtime type assertions // with awserr.Error's Code and Message methods to get detailed information about // the error. // // See the AWS API reference guide for AWS Security Token Service's // API operation GetAccessKeyInfo for usage and error information. // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo func (c STS) GetAccessKeyInfo(input GetAccessKeyInfoInput) (GetAccessKeyInfoOutput, error) { req, out := c.GetAccessKeyInfoRequest(input) return out, req.Send() } // GetAccessKeyInfoWithContext is the same as GetAccessKeyInfo with the addition of // the ability to pass a context and additional request options. // // See GetAccessKeyInfo for details on how to use this API operation. // // The context must be non-nil and will be used for request cancellation. If // the context is nil a panic will occur. In the future the SDK may create // sub-contexts for http.Requests. See https://golang.org/pkg/context/ // for more information on using Contexts. func (c STS) GetAccessKeyInfoWithContext(ctx aws.Context, input GetAccessKeyInfoInput, opts ...request.Option) (GetAccessKeyInfoOutput, error) { req, out := c.GetAccessKeyInfoRequest(input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } const opGetCallerIdentity = "GetCallerIdentity" // GetCallerIdentityRequest generates a "aws/request.Request" representing the // client's request for the GetCallerIdentity operation. The "output" return // value will be populated with the request's response once the request completes // successfully. // // Use "Send" method on the returned Request to send the API call to the service. // the "output" return value is not valid until after Send returns without error. // // See GetCallerIdentity for more information on using the GetCallerIdentity // API call, and error handling. // // This method is useful when you want to inject custom logic or configuration // into the SDK's request lifecycle. Such as custom headers, or retry logic. // // // Example sending a request using the GetCallerIdentityRequest method. // req, resp := client.GetCallerIdentityRequest(params) // // err := req.Send() // if err == nil { // resp is now filled // fmt.Println(resp) // } // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity func (c STS) GetCallerIdentityRequest(input GetCallerIdentityInput) (req request.Request, output GetCallerIdentityOutput) { op := &request.Operation{ Name: opGetCallerIdentity, HTTPMethod: "POST", HTTPPath: "/", } if input == nil { input = &GetCallerIdentityInput{} } output = &GetCallerIdentityOutput{} req = c.newRequest(op, input, output) return } // GetCallerIdentity API operation for AWS Security Token Service. // // Returns details about the IAM user or role whose credentials are used to // call the operation. // // No permissions are required to perform this operation. If an administrator // attaches a policy to your identity that explicitly denies access to the sts:GetCallerIdentity // action, you can still perform this operation. Permissions are not required // because the same information is returned when access is denied. To view an // example response, see I Am Not Authorized to Perform: iam:DeleteVirtualMFADevice // (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa) // in the IAM User Guide. // // Returns awserr.Error for service API and SDK errors. Use runtime type assertions // with awserr.Error's Code and Message methods to get detailed information about // the error. // // See the AWS API reference guide for AWS Security Token Service's // API operation GetCallerIdentity for usage and error information. // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity func (c STS) GetCallerIdentity(input GetCallerIdentityInput) (GetCallerIdentityOutput, error) { req, out := c.GetCallerIdentityRequest(input) return out, req.Send() } // GetCallerIdentityWithContext is the same as GetCallerIdentity with the addition of // the ability to pass a context and additional request options. // // See GetCallerIdentity for details on how to use this API operation. // // The context must be non-nil and will be used for request cancellation. If // the context is nil a panic will occur. In the future the SDK may create // sub-contexts for http.Requests. See https://golang.org/pkg/context/ // for more information on using Contexts. func (c STS) GetCallerIdentityWithContext(ctx aws.Context, input GetCallerIdentityInput, opts ...request.Option) (GetCallerIdentityOutput, error) { req, out := c.GetCallerIdentityRequest(input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } const opGetFederationToken = "GetFederationToken" // GetFederationTokenRequest generates a "aws/request.Request" representing the // client's request for the GetFederationToken operation. The "output" return // value will be populated with the request's response once the request completes // successfully. // // Use "Send" method on the returned Request to send the API call to the service. // the "output" return value is not valid until after Send returns without error. // // See GetFederationToken for more information on using the GetFederationToken // API call, and error handling. // // This method is useful when you want to inject custom logic or configuration // into the SDK's request lifecycle. Such as custom headers, or retry logic. // // // Example sending a request using the GetFederationTokenRequest method. // req, resp := client.GetFederationTokenRequest(params) // // err := req.Send() // if err == nil { // resp is now filled // fmt.Println(resp) // } // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken func (c STS) GetFederationTokenRequest(input GetFederationTokenInput) (req request.Request, output GetFederationTokenOutput) { op := &request.Operation{ Name: opGetFederationToken, HTTPMethod: "POST", HTTPPath: "/", } if input == nil { input = &GetFederationTokenInput{} } output = &GetFederationTokenOutput{} req = c.newRequest(op, input, output) return } // GetFederationToken API operation for AWS Security Token Service. // // Returns a set of temporary security credentials (consisting of an access // key ID, a secret access key, and a security token) for a user. A typical // use is in a proxy application that gets temporary security credentials on // behalf of distributed applications inside a corporate network. // // You must call the GetFederationToken operation using the long-term security // credentials of an IAM user. As a result, this call is appropriate in contexts // where those credentials can be safeguarded, usually in a server-based application. // For a comparison of GetFederationToken with the other API operations that // produce temporary credentials, see Requesting Temporary Security Credentials // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) // and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison) // in the IAM User Guide. // // Although it is possible to call GetFederationToken using the security credentials // of an Amazon Web Services account root user rather than an IAM user that // you create for the purpose of a proxy application, we do not recommend it. // For more information, see Safeguard your root user credentials and don't // use them for everyday tasks (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials) // in the IAM User Guide. // // You can create a mobile-based or browser-based app that can authenticate // users using a web identity provider like Login with Amazon, Facebook, Google, // or an OpenID Connect-compatible identity provider. In this case, we recommend // that you use Amazon Cognito (http://aws.amazon.com/cognito/) or AssumeRoleWithWebIdentity. // For more information, see Federation Through a Web-based Identity Provider // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity) // in the IAM User Guide. // // # Session duration // // The temporary credentials are valid for the specified duration, from 900 // seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours). The default // session duration is 43,200 seconds (12 hours). Temporary credentials obtained // by using the root user credentials have a maximum duration of 3,600 seconds // (1 hour). // // # Permissions // // You can use the temporary credentials created by GetFederationToken in any // Amazon Web Services service with the following exceptions: // // - You cannot call any IAM operations using the CLI or the Amazon Web Services // API. This limitation does not apply to console sessions. // // - You cannot call any STS operations except GetCallerIdentity. // // You can use temporary credentials for single sign-on (SSO) to the console. // // You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // to this operation. You can pass a single JSON policy document to use as an // inline session policy. You can also specify up to 10 managed policy Amazon // Resource Names (ARNs) to use as managed session policies. The plaintext that // you use for both inline and managed session policies can't exceed 2,048 characters. // // Though the session policy parameters are optional, if you do not pass a policy, // then the resulting federated user session has no permissions. When you pass // session policies, the session permissions are the intersection of the IAM // user policies and the session policies that you pass. This gives you a way // to further restrict the permissions for a federated user. You cannot use // session policies to grant more permissions than those that are defined in // the permissions policy of the IAM user. For more information, see Session // Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. For information about using GetFederationToken to // create temporary security credentials, see GetFederationToken—Federation // Through a Custom Identity Broker (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken). // // You can use the credentials to access a resource that has a resource-based // policy. If that policy specifically references the federated user session // in the Principal element of the policy, the session has the permissions allowed // by the policy. These permissions are granted in addition to the permissions // granted by the session policies. // // # Tags // // (Optional) You can pass tag key-value pairs to your session. These are called // session tags. For more information about session tags, see Passing Session // Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // You can create a mobile-based or browser-based app that can authenticate // users using a web identity provider like Login with Amazon, Facebook, Google, // or an OpenID Connect-compatible identity provider. In this case, we recommend // that you use Amazon Cognito (http://aws.amazon.com/cognito/) or AssumeRoleWithWebIdentity. // For more information, see Federation Through a Web-based Identity Provider // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity) // in the IAM User Guide. // // An administrator must grant you the permissions necessary to pass session // tags. The administrator can also create granular permissions to allow you // to pass only specific session tags. For more information, see Tutorial: Using // Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html) // in the IAM User Guide. // // Tag key–value pairs are not case sensitive, but case is preserved. This // means that you cannot have separate Department and department tag keys. Assume // that the user that you are federating has the Department=Marketing tag and // you pass the department=engineering session tag. Department and department // are not saved as separate tags, and the session tag passed in the request // takes precedence over the user tag. // // Returns awserr.Error for service API and SDK errors. Use runtime type assertions // with awserr.Error's Code and Message methods to get detailed information about // the error. // // See the AWS API reference guide for AWS Security Token Service's // API operation GetFederationToken for usage and error information. // // Returned Error Codes: // // - ErrCodeMalformedPolicyDocumentException "MalformedPolicyDocument" // The request was rejected because the policy document was malformed. The error // message describes the specific error. // // - ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge" // The request was rejected because the total packed size of the session policies // and session tags combined was too large. An Amazon Web Services conversion // compresses the session policy document, session policy ARNs, and session // tags into a packed binary format that has a separate limit. The error message // indicates by percentage how close the policies and tags are to the upper // size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // You could receive this error even though you meet other defined session policy // and session tag limits. For more information, see IAM and STS Entity Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // - ErrCodeRegionDisabledException "RegionDisabledException" // STS is not activated in the requested region for the account that is being // asked to generate credentials. The account administrator must use the IAM // console to activate STS in that region. For more information, see Activating // and Deactivating Amazon Web Services STS in an Amazon Web Services Region // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) // in the IAM User Guide. // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken func (c STS) GetFederationToken(input GetFederationTokenInput) (GetFederationTokenOutput, error) { req, out := c.GetFederationTokenRequest(input) return out, req.Send() } // GetFederationTokenWithContext is the same as GetFederationToken with the addition of // the ability to pass a context and additional request options. // // See GetFederationToken for details on how to use this API operation. // // The context must be non-nil and will be used for request cancellation. If // the context is nil a panic will occur. In the future the SDK may create // sub-contexts for http.Requests. See https://golang.org/pkg/context/ // for more information on using Contexts. func (c STS) GetFederationTokenWithContext(ctx aws.Context, input GetFederationTokenInput, opts ...request.Option) (GetFederationTokenOutput, error) { req, out := c.GetFederationTokenRequest(input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } const opGetSessionToken = "GetSessionToken" // GetSessionTokenRequest generates a "aws/request.Request" representing the // client's request for the GetSessionToken operation. The "output" return // value will be populated with the request's response once the request completes // successfully. // // Use "Send" method on the returned Request to send the API call to the service. // the "output" return value is not valid until after Send returns without error. // // See GetSessionToken for more information on using the GetSessionToken // API call, and error handling. // // This method is useful when you want to inject custom logic or configuration // into the SDK's request lifecycle. Such as custom headers, or retry logic. // // // Example sending a request using the GetSessionTokenRequest method. // req, resp := client.GetSessionTokenRequest(params) // // err := req.Send() // if err == nil { // resp is now filled // fmt.Println(resp) // } // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken func (c STS) GetSessionTokenRequest(input GetSessionTokenInput) (req request.Request, output GetSessionTokenOutput) { op := &request.Operation{ Name: opGetSessionToken, HTTPMethod: "POST", HTTPPath: "/", } if input == nil { input = &GetSessionTokenInput{} } output = &GetSessionTokenOutput{} req = c.newRequest(op, input, output) return } // GetSessionToken API operation for AWS Security Token Service. // // Returns a set of temporary credentials for an Amazon Web Services account // or IAM user. The credentials consist of an access key ID, a secret access // key, and a security token. Typically, you use GetSessionToken if you want // to use MFA to protect programmatic calls to specific Amazon Web Services // API operations like Amazon EC2 StopInstances. // // MFA-enabled IAM users must call GetSessionToken and submit an MFA code that // is associated with their MFA device. Using the temporary security credentials // that the call returns, IAM users can then make programmatic calls to API // operations that require MFA authentication. An incorrect MFA code causes // the API to return an access denied error. For a comparison of GetSessionToken // with the other API operations that produce temporary credentials, see Requesting // Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) // and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison) // in the IAM User Guide. // // No permissions are required for users to perform this operation. The purpose // of the sts:GetSessionToken operation is to authenticate the user using MFA. // You cannot use policies to control authentication operations. For more information, // see Permissions for GetSessionToken (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html) // in the IAM User Guide. // // # Session Duration // // The GetSessionToken operation must be called by using the long-term Amazon // Web Services security credentials of an IAM user. Credentials that are created // by IAM users are valid for the duration that you specify. This duration can // range from 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36 // hours), with a default of 43,200 seconds (12 hours). Credentials based on // account credentials can range from 900 seconds (15 minutes) up to 3,600 seconds // (1 hour), with a default of 1 hour. // // # Permissions // // The temporary security credentials created by GetSessionToken can be used // to make API calls to any Amazon Web Services service with the following exceptions: // // - You cannot call any IAM API operations unless MFA authentication information // is included in the request. // // - You cannot call any STS API except AssumeRole or GetCallerIdentity. // // The credentials that GetSessionToken returns are based on permissions associated // with the IAM user whose credentials were used to call the operation. The // temporary credentials have the same permissions as the IAM user. // // Although it is possible to call GetSessionToken using the security credentials // of an Amazon Web Services account root user rather than an IAM user, we do // not recommend it. If GetSessionToken is called using root user credentials, // the temporary credentials have root user permissions. For more information, // see Safeguard your root user credentials and don't use them for everyday // tasks (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials) // in the IAM User Guide // // For more information about using GetSessionToken to create temporary credentials, // see Temporary Credentials for Users in Untrusted Environments (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken) // in the IAM User Guide. // // Returns awserr.Error for service API and SDK errors. Use runtime type assertions // with awserr.Error's Code and Message methods to get detailed information about // the error. // // See the AWS API reference guide for AWS Security Token Service's // API operation GetSessionToken for usage and error information. // // Returned Error Codes: // - ErrCodeRegionDisabledException "RegionDisabledException" // STS is not activated in the requested region for the account that is being // asked to generate credentials. The account administrator must use the IAM // console to activate STS in that region. For more information, see Activating // and Deactivating Amazon Web Services STS in an Amazon Web Services Region // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) // in the IAM User Guide. // // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken func (c STS) GetSessionToken(input GetSessionTokenInput) (GetSessionTokenOutput, error) { req, out := c.GetSessionTokenRequest(input) return out, req.Send() } // GetSessionTokenWithContext is the same as GetSessionToken with the addition of // the ability to pass a context and additional request options. // // See GetSessionToken for details on how to use this API operation. // // The context must be non-nil and will be used for request cancellation. If // the context is nil a panic will occur. In the future the SDK may create // sub-contexts for http.Requests. See https://golang.org/pkg/context/ // for more information on using Contexts. func (c STS) GetSessionTokenWithContext(ctx aws.Context, input GetSessionTokenInput, opts ...request.Option) (GetSessionTokenOutput, error) { req, out := c.GetSessionTokenRequest(input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } type AssumeRoleInput struct { _ struct{} `type:"structure"` // The duration, in seconds, of the role session. The value specified can range // from 900 seconds (15 minutes) up to the maximum session duration set for // the role. The maximum session duration setting can have a value from 1 hour // to 12 hours. If you specify a value higher than this setting or the administrator // setting (whichever is lower), the operation fails. For example, if you specify // a session duration of 12 hours, but your administrator set the maximum session // duration to 6 hours, your operation fails. // // Role chaining limits your Amazon Web Services CLI or Amazon Web Services // API role session to a maximum of one hour. When you use the AssumeRole API // operation to assume a role, you can specify the duration of your role session // with the DurationSeconds parameter. You can specify a parameter value of // up to 43200 seconds (12 hours), depending on the maximum session duration // setting for your role. However, if you assume a role using role chaining // and provide a DurationSeconds parameter value greater than one hour, the // operation fails. To learn how to view the maximum value for your role, see // View the Maximum Session Duration Setting for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) // in the IAM User Guide. // // By default, the value is set to 3600 seconds. // // The DurationSeconds parameter is separate from the duration of a console // session that you might request using the returned credentials. The request // to the federation endpoint for a console sign-in token takes a SessionDuration // parameter that specifies the maximum length of the console session. For more // information, see Creating a URL that Enables Federated Users to Access the // Amazon Web Services Management Console (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html) // in the IAM User Guide. DurationSeconds int64 `min:"900" type:"integer"` // A unique identifier that might be required when you assume a role in another // account. If the administrator of the account to which the role belongs provided // you with an external ID, then provide that value in the ExternalId parameter. // This value can be any string, such as a passphrase or account number. A cross-account // role is usually set up to trust everyone in an account. Therefore, the administrator // of the trusting account might send an external ID to the administrator of // the trusted account. That way, only someone with the ID can assume the role, // rather than everyone in the account. For more information about the external // ID, see How to Use an External ID When Granting Access to Your Amazon Web // Services Resources to a Third Party (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html) // in the IAM User Guide. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@:/- ExternalId string `min:"2" type:"string"` // An IAM policy in JSON format that you want to use as an inline session policy. // // This parameter is optional. Passing policies to this operation returns new // temporary credentials. The resulting session's permissions are the intersection // of the role's identity-based policy and the session policies. You can use // the role's temporary credentials in subsequent Amazon Web Services API calls // to access resources in the account that owns the role. You cannot use session // policies to grant more permissions than those allowed by the identity-based // policy of the role that is being assumed. For more information, see Session // Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. // // The plaintext that you use for both inline and managed session policies can't // exceed 2,048 characters. The JSON policy characters can be any ASCII character // from the space character to the end of the valid character list (\u0020 through // \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage // return (\u000D) characters. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. Policy string `min:"1" type:"string"` // The Amazon Resource Names (ARNs) of the IAM managed policies that you want // to use as managed session policies. The policies must exist in the same account // as the role. // // This parameter is optional. You can provide up to 10 managed policy ARNs. // However, the plaintext that you use for both inline and managed session policies // can't exceed 2,048 characters. For more information about ARNs, see Amazon // Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) // in the Amazon Web Services General Reference. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. // // Passing policies to this operation returns new temporary credentials. The // resulting session's permissions are the intersection of the role's identity-based // policy and the session policies. You can use the role's temporary credentials // in subsequent Amazon Web Services API calls to access resources in the account // that owns the role. You cannot use session policies to grant more permissions // than those allowed by the identity-based policy of the role that is being // assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. PolicyArns []PolicyDescriptorType `type:"list"` // A list of previously acquired trusted context assertions in the format of // a JSON array. The trusted context assertion is signed and encrypted by Amazon // Web Services STS. // // The following is an example of a ProvidedContext value that includes a single // trusted context assertion and the ARN of the context provider from which // the trusted context assertion was generated. // // [{"ProviderArn":"arn:aws:iam::aws:contextProvider/IdentityCenter","ContextAssertion":"trusted-context-assertion"}] ProvidedContexts []ProvidedContext `type:"list"` // The Amazon Resource Name (ARN) of the role to assume. // // RoleArn is a required field RoleArn string `min:"20" type:"string" required:"true"` // An identifier for the assumed role session. // // Use the role session name to uniquely identify a session when the same role // is assumed by different principals or for different reasons. In cross-account // scenarios, the role session name is visible to, and can be logged by the // account that owns the role. The role session name is also used in the ARN // of the assumed role principal. This means that subsequent cross-account API // requests that use the temporary security credentials will expose the role // session name to the external account in their CloudTrail logs. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@- // // RoleSessionName is a required field RoleSessionName string `min:"2" type:"string" required:"true"` // The identification number of the MFA device that is associated with the user // who is making the AssumeRole call. Specify this value if the trust policy // of the role being assumed includes a condition that requires MFA authentication. // The value is either the serial number for a hardware device (such as GAHT12345678) // or an Amazon Resource Name (ARN) for a virtual device (such as arn:aws:iam::123456789012:mfa/user). // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@- SerialNumber string `min:"9" type:"string"` // The source identity specified by the principal that is calling the AssumeRole // operation. // // You can require users to specify a source identity when they assume a role. // You do this by using the sts:SourceIdentity condition key in a role trust // policy. You can use source identity information in CloudTrail logs to determine // who took actions with a role. You can use the aws:SourceIdentity condition // key to further control access to Amazon Web Services resources based on the // value of source identity. For more information about using source identity, // see Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) // in the IAM User Guide. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@-. You cannot // use a value that begins with the text aws:. This prefix is reserved for Amazon // Web Services internal use. SourceIdentity string `min:"2" type:"string"` // A list of session tags that you want to pass. Each session tag consists of // a key name and an associated value. For more information about session tags, // see Tagging Amazon Web Services STS Sessions (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // This parameter is optional. You can pass up to 50 session tags. The plaintext // session tag keys can’t exceed 128 characters, and the values can’t exceed // 256 characters. For these and additional limits, see IAM and STS Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. // // You can pass a session tag with the same key as a tag that is already attached // to the role. When you do, session tags override a role tag with the same // key. // // Tag key–value pairs are not case sensitive, but case is preserved. This // means that you cannot have separate Department and department tag keys. Assume // that the role has the Department=Marketing tag and you pass the department=engineering // session tag. Department and department are not saved as separate tags, and // the session tag passed in the request takes precedence over the role tag. // // Additionally, if you used temporary credentials to perform this operation, // the new session inherits any transitive session tags from the calling session. // If you pass a session tag with the same key as an inherited tag, the operation // fails. To view the inherited tags for a session, see the CloudTrail logs. // For more information, see Viewing Session Tags in CloudTrail (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_ctlogs) // in the IAM User Guide. Tags []Tag `type:"list"` // The value provided by the MFA device, if the trust policy of the role being // assumed requires MFA. (In other words, if the policy includes a condition // that tests for MFA). If the role being assumed requires MFA and if the TokenCode // value is missing or expired, the AssumeRole call returns an "access denied" // error. // // The format for this parameter, as described by its regex pattern, is a sequence // of six numeric digits. TokenCode string `min:"6" type:"string"` // A list of keys for session tags that you want to set as transitive. If you // set a tag key as transitive, the corresponding key and value passes to subsequent // sessions in a role chain. For more information, see Chaining Roles with Session // Tags (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining) // in the IAM User Guide. // // This parameter is optional. When you set session tags as transitive, the // session policy and session tags packed binary limit is not affected. // // If you choose not to specify a transitive tag key, then no tags are passed // from this session to any subsequent sessions. TransitiveTagKeys []string `type:"list"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleInput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleInput) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s AssumeRoleInput) Validate() error { invalidParams := request.ErrInvalidParams{Context: "AssumeRoleInput"} if s.DurationSeconds != nil && s.DurationSeconds < 900 { invalidParams.Add(request.NewErrParamMinValue("DurationSeconds", 900)) } if s.ExternalId != nil && len(s.ExternalId) < 2 { invalidParams.Add(request.NewErrParamMinLen("ExternalId", 2)) } if s.Policy != nil && len(s.Policy) < 1 { invalidParams.Add(request.NewErrParamMinLen("Policy", 1)) } if s.RoleArn == nil { invalidParams.Add(request.NewErrParamRequired("RoleArn")) } if s.RoleArn != nil && len(s.RoleArn) < 20 { invalidParams.Add(request.NewErrParamMinLen("RoleArn", 20)) } if s.RoleSessionName == nil { invalidParams.Add(request.NewErrParamRequired("RoleSessionName")) } if s.RoleSessionName != nil && len(s.RoleSessionName) < 2 { invalidParams.Add(request.NewErrParamMinLen("RoleSessionName", 2)) } if s.SerialNumber != nil && len(s.SerialNumber) < 9 { invalidParams.Add(request.NewErrParamMinLen("SerialNumber", 9)) } if s.SourceIdentity != nil && len(s.SourceIdentity) < 2 { invalidParams.Add(request.NewErrParamMinLen("SourceIdentity", 2)) } if s.TokenCode != nil && len(s.TokenCode) < 6 { invalidParams.Add(request.NewErrParamMinLen("TokenCode", 6)) } if s.PolicyArns != nil { for i, v := range s.PolicyArns { if v == nil { continue } if err := v.Validate(); err != nil { invalidParams.AddNested(fmt.Sprintf("%s[%v]", "PolicyArns", i), err.(request.ErrInvalidParams)) } } } if s.ProvidedContexts != nil { for i, v := range s.ProvidedContexts { if v == nil { continue } if err := v.Validate(); err != nil { invalidParams.AddNested(fmt.Sprintf("%s[%v]", "ProvidedContexts", i), err.(request.ErrInvalidParams)) } } } if s.Tags != nil { for i, v := range s.Tags { if v == nil { continue } if err := v.Validate(); err != nil { invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams)) } } } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetDurationSeconds sets the DurationSeconds field's value. func (s AssumeRoleInput) SetDurationSeconds(v int64) AssumeRoleInput { s.DurationSeconds = &v return s } // SetExternalId sets the ExternalId field's value. func (s AssumeRoleInput) SetExternalId(v string) AssumeRoleInput { s.ExternalId = &v return s } // SetPolicy sets the Policy field's value. func (s AssumeRoleInput) SetPolicy(v string) AssumeRoleInput { s.Policy = &v return s } // SetPolicyArns sets the PolicyArns field's value. func (s AssumeRoleInput) SetPolicyArns(v []PolicyDescriptorType) AssumeRoleInput { s.PolicyArns = v return s } // SetProvidedContexts sets the ProvidedContexts field's value. func (s AssumeRoleInput) SetProvidedContexts(v []ProvidedContext) AssumeRoleInput { s.ProvidedContexts = v return s } // SetRoleArn sets the RoleArn field's value. func (s AssumeRoleInput) SetRoleArn(v string) AssumeRoleInput { s.RoleArn = &v return s } // SetRoleSessionName sets the RoleSessionName field's value. func (s AssumeRoleInput) SetRoleSessionName(v string) AssumeRoleInput { s.RoleSessionName = &v return s } // SetSerialNumber sets the SerialNumber field's value. func (s AssumeRoleInput) SetSerialNumber(v string) AssumeRoleInput { s.SerialNumber = &v return s } // SetSourceIdentity sets the SourceIdentity field's value. func (s AssumeRoleInput) SetSourceIdentity(v string) AssumeRoleInput { s.SourceIdentity = &v return s } // SetTags sets the Tags field's value. func (s AssumeRoleInput) SetTags(v []Tag) AssumeRoleInput { s.Tags = v return s } // SetTokenCode sets the TokenCode field's value. func (s AssumeRoleInput) SetTokenCode(v string) AssumeRoleInput { s.TokenCode = &v return s } // SetTransitiveTagKeys sets the TransitiveTagKeys field's value. func (s AssumeRoleInput) SetTransitiveTagKeys(v []string) AssumeRoleInput { s.TransitiveTagKeys = v return s } // Contains the response to a successful AssumeRole request, including temporary // Amazon Web Services credentials that can be used to make Amazon Web Services // requests. type AssumeRoleOutput struct { _ struct{} `type:"structure"` // The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers // that you can use to refer to the resulting temporary security credentials. // For example, you can reference these credentials as a principal in a resource-based // policy by using the ARN or assumed role ID. The ARN and ID include the RoleSessionName // that you specified when you called AssumeRole. AssumedRoleUser AssumedRoleUser `type:"structure"` // The temporary security credentials, which include an access key ID, a secret // access key, and a security (or session) token. // // The size of the security token that STS API operations return is not fixed. // We strongly recommend that you make no assumptions about the maximum size. Credentials Credentials `type:"structure"` // A percentage value that indicates the packed size of the session policies // and session tags combined passed in the request. The request fails if the // packed size is greater than 100 percent, which means the policies and tags // exceeded the allowed space. PackedPolicySize int64 `type:"integer"` // The source identity specified by the principal that is calling the AssumeRole // operation. // // You can require users to specify a source identity when they assume a role. // You do this by using the sts:SourceIdentity condition key in a role trust // policy. You can use source identity information in CloudTrail logs to determine // who took actions with a role. You can use the aws:SourceIdentity condition // key to further control access to Amazon Web Services resources based on the // value of source identity. For more information about using source identity, // see Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) // in the IAM User Guide. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@- SourceIdentity string `min:"2" type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleOutput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleOutput) GoString() string { return s.String() } // SetAssumedRoleUser sets the AssumedRoleUser field's value. func (s AssumeRoleOutput) SetAssumedRoleUser(v AssumedRoleUser) AssumeRoleOutput { s.AssumedRoleUser = v return s } // SetCredentials sets the Credentials field's value. func (s AssumeRoleOutput) SetCredentials(v Credentials) AssumeRoleOutput { s.Credentials = v return s } // SetPackedPolicySize sets the PackedPolicySize field's value. func (s AssumeRoleOutput) SetPackedPolicySize(v int64) AssumeRoleOutput { s.PackedPolicySize = &v return s } // SetSourceIdentity sets the SourceIdentity field's value. func (s AssumeRoleOutput) SetSourceIdentity(v string) AssumeRoleOutput { s.SourceIdentity = &v return s } type AssumeRoleWithSAMLInput struct { _ struct{} `type:"structure"` // The duration, in seconds, of the role session. Your role session lasts for // the duration that you specify for the DurationSeconds parameter, or until // the time specified in the SAML authentication response's SessionNotOnOrAfter // value, whichever is shorter. You can provide a DurationSeconds value from // 900 seconds (15 minutes) up to the maximum session duration setting for the // role. This setting can have a value from 1 hour to 12 hours. If you specify // a value higher than this setting, the operation fails. For example, if you // specify a session duration of 12 hours, but your administrator set the maximum // session duration to 6 hours, your operation fails. To learn how to view the // maximum value for your role, see View the Maximum Session Duration Setting // for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) // in the IAM User Guide. // // By default, the value is set to 3600 seconds. // // The DurationSeconds parameter is separate from the duration of a console // session that you might request using the returned credentials. The request // to the federation endpoint for a console sign-in token takes a SessionDuration // parameter that specifies the maximum length of the console session. For more // information, see Creating a URL that Enables Federated Users to Access the // Amazon Web Services Management Console (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html) // in the IAM User Guide. DurationSeconds int64 `min:"900" type:"integer"` // An IAM policy in JSON format that you want to use as an inline session policy. // // This parameter is optional. Passing policies to this operation returns new // temporary credentials. The resulting session's permissions are the intersection // of the role's identity-based policy and the session policies. You can use // the role's temporary credentials in subsequent Amazon Web Services API calls // to access resources in the account that owns the role. You cannot use session // policies to grant more permissions than those allowed by the identity-based // policy of the role that is being assumed. For more information, see Session // Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. // // The plaintext that you use for both inline and managed session policies can't // exceed 2,048 characters. The JSON policy characters can be any ASCII character // from the space character to the end of the valid character list (\u0020 through // \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage // return (\u000D) characters. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. Policy string `min:"1" type:"string"` // The Amazon Resource Names (ARNs) of the IAM managed policies that you want // to use as managed session policies. The policies must exist in the same account // as the role. // // This parameter is optional. You can provide up to 10 managed policy ARNs. // However, the plaintext that you use for both inline and managed session policies // can't exceed 2,048 characters. For more information about ARNs, see Amazon // Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) // in the Amazon Web Services General Reference. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. // // Passing policies to this operation returns new temporary credentials. The // resulting session's permissions are the intersection of the role's identity-based // policy and the session policies. You can use the role's temporary credentials // in subsequent Amazon Web Services API calls to access resources in the account // that owns the role. You cannot use session policies to grant more permissions // than those allowed by the identity-based policy of the role that is being // assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. PolicyArns []PolicyDescriptorType `type:"list"` // The Amazon Resource Name (ARN) of the SAML provider in IAM that describes // the IdP. // // PrincipalArn is a required field PrincipalArn string `min:"20" type:"string" required:"true"` // The Amazon Resource Name (ARN) of the role that the caller is assuming. // // RoleArn is a required field RoleArn string `min:"20" type:"string" required:"true"` // The base64 encoded SAML authentication response provided by the IdP. // // For more information, see Configuring a Relying Party and Adding Claims (https://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html) // in the IAM User Guide. // // SAMLAssertion is a sensitive parameter and its value will be // replaced with "sensitive" in string returned by AssumeRoleWithSAMLInput's // String and GoString methods. // // SAMLAssertion is a required field SAMLAssertion string `min:"4" type:"string" required:"true" sensitive:"true"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleWithSAMLInput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleWithSAMLInput) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s AssumeRoleWithSAMLInput) Validate() error { invalidParams := request.ErrInvalidParams{Context: "AssumeRoleWithSAMLInput"} if s.DurationSeconds != nil && s.DurationSeconds < 900 { invalidParams.Add(request.NewErrParamMinValue("DurationSeconds", 900)) } if s.Policy != nil && len(s.Policy) < 1 { invalidParams.Add(request.NewErrParamMinLen("Policy", 1)) } if s.PrincipalArn == nil { invalidParams.Add(request.NewErrParamRequired("PrincipalArn")) } if s.PrincipalArn != nil && len(s.PrincipalArn) < 20 { invalidParams.Add(request.NewErrParamMinLen("PrincipalArn", 20)) } if s.RoleArn == nil { invalidParams.Add(request.NewErrParamRequired("RoleArn")) } if s.RoleArn != nil && len(s.RoleArn) < 20 { invalidParams.Add(request.NewErrParamMinLen("RoleArn", 20)) } if s.SAMLAssertion == nil { invalidParams.Add(request.NewErrParamRequired("SAMLAssertion")) } if s.SAMLAssertion != nil && len(s.SAMLAssertion) < 4 { invalidParams.Add(request.NewErrParamMinLen("SAMLAssertion", 4)) } if s.PolicyArns != nil { for i, v := range s.PolicyArns { if v == nil { continue } if err := v.Validate(); err != nil { invalidParams.AddNested(fmt.Sprintf("%s[%v]", "PolicyArns", i), err.(request.ErrInvalidParams)) } } } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetDurationSeconds sets the DurationSeconds field's value. func (s AssumeRoleWithSAMLInput) SetDurationSeconds(v int64) AssumeRoleWithSAMLInput { s.DurationSeconds = &v return s } // SetPolicy sets the Policy field's value. func (s AssumeRoleWithSAMLInput) SetPolicy(v string) AssumeRoleWithSAMLInput { s.Policy = &v return s } // SetPolicyArns sets the PolicyArns field's value. func (s AssumeRoleWithSAMLInput) SetPolicyArns(v []PolicyDescriptorType) AssumeRoleWithSAMLInput { s.PolicyArns = v return s } // SetPrincipalArn sets the PrincipalArn field's value. func (s AssumeRoleWithSAMLInput) SetPrincipalArn(v string) AssumeRoleWithSAMLInput { s.PrincipalArn = &v return s } // SetRoleArn sets the RoleArn field's value. func (s AssumeRoleWithSAMLInput) SetRoleArn(v string) AssumeRoleWithSAMLInput { s.RoleArn = &v return s } // SetSAMLAssertion sets the SAMLAssertion field's value. func (s AssumeRoleWithSAMLInput) SetSAMLAssertion(v string) AssumeRoleWithSAMLInput { s.SAMLAssertion = &v return s } // Contains the response to a successful AssumeRoleWithSAML request, including // temporary Amazon Web Services credentials that can be used to make Amazon // Web Services requests. type AssumeRoleWithSAMLOutput struct { _ struct{} `type:"structure"` // The identifiers for the temporary security credentials that the operation // returns. AssumedRoleUser AssumedRoleUser `type:"structure"` // The value of the Recipient attribute of the SubjectConfirmationData element // of the SAML assertion. Audience string `type:"string"` // The temporary security credentials, which include an access key ID, a secret // access key, and a security (or session) token. // // The size of the security token that STS API operations return is not fixed. // We strongly recommend that you make no assumptions about the maximum size. Credentials Credentials `type:"structure"` // The value of the Issuer element of the SAML assertion. Issuer string `type:"string"` // A hash value based on the concatenation of the following: // // * The Issuer response value. // // * The Amazon Web Services account ID. // // * The friendly name (the last part of the ARN) of the SAML provider in // IAM. // // The combination of NameQualifier and Subject can be used to uniquely identify // a user. // // The following pseudocode shows how the hash value is calculated: // // BASE64 ( SHA1 ( "https://example.com/saml" + "123456789012" + "/MySAMLIdP" // ) ) NameQualifier string `type:"string"` // A percentage value that indicates the packed size of the session policies // and session tags combined passed in the request. The request fails if the // packed size is greater than 100 percent, which means the policies and tags // exceeded the allowed space. PackedPolicySize int64 `type:"integer"` // The value in the SourceIdentity attribute in the SAML assertion. // // You can require users to set a source identity value when they assume a role. // You do this by using the sts:SourceIdentity condition key in a role trust // policy. That way, actions that are taken with the role are associated with // that user. After the source identity is set, the value cannot be changed. // It is present in the request for all actions that are taken by the role and // persists across chained role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining) // sessions. You can configure your SAML identity provider to use an attribute // associated with your users, like user name or email, as the source identity // when calling AssumeRoleWithSAML. You do this by adding an attribute to the // SAML assertion. For more information about using source identity, see Monitor // and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) // in the IAM User Guide. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@- SourceIdentity string `min:"2" type:"string"` // The value of the NameID element in the Subject element of the SAML assertion. Subject string `type:"string"` // The format of the name ID, as defined by the Format attribute in the NameID // element of the SAML assertion. Typical examples of the format are transient // or persistent. // // If the format includes the prefix urn:oasis:names:tc:SAML:2.0:nameid-format, // that prefix is removed. For example, urn:oasis:names:tc:SAML:2.0:nameid-format:transient // is returned as transient. If the format includes any other prefix, the format // is returned with no modifications. SubjectType string `type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleWithSAMLOutput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleWithSAMLOutput) GoString() string { return s.String() } // SetAssumedRoleUser sets the AssumedRoleUser field's value. func (s AssumeRoleWithSAMLOutput) SetAssumedRoleUser(v AssumedRoleUser) AssumeRoleWithSAMLOutput { s.AssumedRoleUser = v return s } // SetAudience sets the Audience field's value. func (s AssumeRoleWithSAMLOutput) SetAudience(v string) AssumeRoleWithSAMLOutput { s.Audience = &v return s } // SetCredentials sets the Credentials field's value. func (s AssumeRoleWithSAMLOutput) SetCredentials(v Credentials) AssumeRoleWithSAMLOutput { s.Credentials = v return s } // SetIssuer sets the Issuer field's value. func (s AssumeRoleWithSAMLOutput) SetIssuer(v string) AssumeRoleWithSAMLOutput { s.Issuer = &v return s } // SetNameQualifier sets the NameQualifier field's value. func (s AssumeRoleWithSAMLOutput) SetNameQualifier(v string) AssumeRoleWithSAMLOutput { s.NameQualifier = &v return s } // SetPackedPolicySize sets the PackedPolicySize field's value. func (s AssumeRoleWithSAMLOutput) SetPackedPolicySize(v int64) AssumeRoleWithSAMLOutput { s.PackedPolicySize = &v return s } // SetSourceIdentity sets the SourceIdentity field's value. func (s AssumeRoleWithSAMLOutput) SetSourceIdentity(v string) AssumeRoleWithSAMLOutput { s.SourceIdentity = &v return s } // SetSubject sets the Subject field's value. func (s AssumeRoleWithSAMLOutput) SetSubject(v string) AssumeRoleWithSAMLOutput { s.Subject = &v return s } // SetSubjectType sets the SubjectType field's value. func (s AssumeRoleWithSAMLOutput) SetSubjectType(v string) AssumeRoleWithSAMLOutput { s.SubjectType = &v return s } type AssumeRoleWithWebIdentityInput struct { _ struct{} `type:"structure"` // The duration, in seconds, of the role session. The value can range from 900 // seconds (15 minutes) up to the maximum session duration setting for the role. // This setting can have a value from 1 hour to 12 hours. If you specify a value // higher than this setting, the operation fails. For example, if you specify // a session duration of 12 hours, but your administrator set the maximum session // duration to 6 hours, your operation fails. To learn how to view the maximum // value for your role, see View the Maximum Session Duration Setting for a // Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) // in the IAM User Guide. // // By default, the value is set to 3600 seconds. // // The DurationSeconds parameter is separate from the duration of a console // session that you might request using the returned credentials. The request // to the federation endpoint for a console sign-in token takes a SessionDuration // parameter that specifies the maximum length of the console session. For more // information, see Creating a URL that Enables Federated Users to Access the // Amazon Web Services Management Console (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html) // in the IAM User Guide. DurationSeconds int64 `min:"900" type:"integer"` // An IAM policy in JSON format that you want to use as an inline session policy. // // This parameter is optional. Passing policies to this operation returns new // temporary credentials. The resulting session's permissions are the intersection // of the role's identity-based policy and the session policies. You can use // the role's temporary credentials in subsequent Amazon Web Services API calls // to access resources in the account that owns the role. You cannot use session // policies to grant more permissions than those allowed by the identity-based // policy of the role that is being assumed. For more information, see Session // Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. // // The plaintext that you use for both inline and managed session policies can't // exceed 2,048 characters. The JSON policy characters can be any ASCII character // from the space character to the end of the valid character list (\u0020 through // \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage // return (\u000D) characters. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. Policy string `min:"1" type:"string"` // The Amazon Resource Names (ARNs) of the IAM managed policies that you want // to use as managed session policies. The policies must exist in the same account // as the role. // // This parameter is optional. You can provide up to 10 managed policy ARNs. // However, the plaintext that you use for both inline and managed session policies // can't exceed 2,048 characters. For more information about ARNs, see Amazon // Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) // in the Amazon Web Services General Reference. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. // // Passing policies to this operation returns new temporary credentials. The // resulting session's permissions are the intersection of the role's identity-based // policy and the session policies. You can use the role's temporary credentials // in subsequent Amazon Web Services API calls to access resources in the account // that owns the role. You cannot use session policies to grant more permissions // than those allowed by the identity-based policy of the role that is being // assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. PolicyArns []PolicyDescriptorType `type:"list"` // The fully qualified host component of the domain name of the OAuth 2.0 identity // provider. Do not specify this value for an OpenID Connect identity provider. // // Currently www.amazon.com and graph.facebook.com are the only supported identity // providers for OAuth 2.0 access tokens. Do not include URL schemes and port // numbers. // // Do not specify this value for OpenID Connect ID tokens. ProviderId string `min:"4" type:"string"` // The Amazon Resource Name (ARN) of the role that the caller is assuming. // // RoleArn is a required field RoleArn string `min:"20" type:"string" required:"true"` // An identifier for the assumed role session. Typically, you pass the name // or identifier that is associated with the user who is using your application. // That way, the temporary security credentials that your application will use // are associated with that user. This session name is included as part of the // ARN and assumed role ID in the AssumedRoleUser response element. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@- // // RoleSessionName is a required field RoleSessionName string `min:"2" type:"string" required:"true"` // The OAuth 2.0 access token or OpenID Connect ID token that is provided by // the identity provider. Your application must get this token by authenticating // the user who is using your application with a web identity provider before // the application makes an AssumeRoleWithWebIdentity call. Only tokens with // RSA algorithms (RS256) are supported. // // WebIdentityToken is a sensitive parameter and its value will be // replaced with "sensitive" in string returned by AssumeRoleWithWebIdentityInput's // String and GoString methods. // // WebIdentityToken is a required field WebIdentityToken string `min:"4" type:"string" required:"true" sensitive:"true"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleWithWebIdentityInput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleWithWebIdentityInput) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s AssumeRoleWithWebIdentityInput) Validate() error { invalidParams := request.ErrInvalidParams{Context: "AssumeRoleWithWebIdentityInput"} if s.DurationSeconds != nil && s.DurationSeconds < 900 { invalidParams.Add(request.NewErrParamMinValue("DurationSeconds", 900)) } if s.Policy != nil && len(s.Policy) < 1 { invalidParams.Add(request.NewErrParamMinLen("Policy", 1)) } if s.ProviderId != nil && len(s.ProviderId) < 4 { invalidParams.Add(request.NewErrParamMinLen("ProviderId", 4)) } if s.RoleArn == nil { invalidParams.Add(request.NewErrParamRequired("RoleArn")) } if s.RoleArn != nil && len(s.RoleArn) < 20 { invalidParams.Add(request.NewErrParamMinLen("RoleArn", 20)) } if s.RoleSessionName == nil { invalidParams.Add(request.NewErrParamRequired("RoleSessionName")) } if s.RoleSessionName != nil && len(s.RoleSessionName) < 2 { invalidParams.Add(request.NewErrParamMinLen("RoleSessionName", 2)) } if s.WebIdentityToken == nil { invalidParams.Add(request.NewErrParamRequired("WebIdentityToken")) } if s.WebIdentityToken != nil && len(s.WebIdentityToken) < 4 { invalidParams.Add(request.NewErrParamMinLen("WebIdentityToken", 4)) } if s.PolicyArns != nil { for i, v := range s.PolicyArns { if v == nil { continue } if err := v.Validate(); err != nil { invalidParams.AddNested(fmt.Sprintf("%s[%v]", "PolicyArns", i), err.(request.ErrInvalidParams)) } } } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetDurationSeconds sets the DurationSeconds field's value. func (s AssumeRoleWithWebIdentityInput) SetDurationSeconds(v int64) AssumeRoleWithWebIdentityInput { s.DurationSeconds = &v return s } // SetPolicy sets the Policy field's value. func (s AssumeRoleWithWebIdentityInput) SetPolicy(v string) AssumeRoleWithWebIdentityInput { s.Policy = &v return s } // SetPolicyArns sets the PolicyArns field's value. func (s AssumeRoleWithWebIdentityInput) SetPolicyArns(v []PolicyDescriptorType) AssumeRoleWithWebIdentityInput { s.PolicyArns = v return s } // SetProviderId sets the ProviderId field's value. func (s AssumeRoleWithWebIdentityInput) SetProviderId(v string) AssumeRoleWithWebIdentityInput { s.ProviderId = &v return s } // SetRoleArn sets the RoleArn field's value. func (s AssumeRoleWithWebIdentityInput) SetRoleArn(v string) AssumeRoleWithWebIdentityInput { s.RoleArn = &v return s } // SetRoleSessionName sets the RoleSessionName field's value. func (s AssumeRoleWithWebIdentityInput) SetRoleSessionName(v string) AssumeRoleWithWebIdentityInput { s.RoleSessionName = &v return s } // SetWebIdentityToken sets the WebIdentityToken field's value. func (s AssumeRoleWithWebIdentityInput) SetWebIdentityToken(v string) AssumeRoleWithWebIdentityInput { s.WebIdentityToken = &v return s } // Contains the response to a successful AssumeRoleWithWebIdentity request, // including temporary Amazon Web Services credentials that can be used to make // Amazon Web Services requests. type AssumeRoleWithWebIdentityOutput struct { _ struct{} `type:"structure"` // The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers // that you can use to refer to the resulting temporary security credentials. // For example, you can reference these credentials as a principal in a resource-based // policy by using the ARN or assumed role ID. The ARN and ID include the RoleSessionName // that you specified when you called AssumeRole. AssumedRoleUser AssumedRoleUser `type:"structure"` // The intended audience (also known as client ID) of the web identity token. // This is traditionally the client identifier issued to the application that // requested the web identity token. Audience string `type:"string"` // The temporary security credentials, which include an access key ID, a secret // access key, and a security token. // // The size of the security token that STS API operations return is not fixed. // We strongly recommend that you make no assumptions about the maximum size. Credentials Credentials `type:"structure"` // A percentage value that indicates the packed size of the session policies // and session tags combined passed in the request. The request fails if the // packed size is greater than 100 percent, which means the policies and tags // exceeded the allowed space. PackedPolicySize int64 `type:"integer"` // The issuing authority of the web identity token presented. For OpenID Connect // ID tokens, this contains the value of the iss field. For OAuth 2.0 access // tokens, this contains the value of the ProviderId parameter that was passed // in the AssumeRoleWithWebIdentity request. Provider string `type:"string"` // The value of the source identity that is returned in the JSON web token (JWT) // from the identity provider. // // You can require users to set a source identity value when they assume a role. // You do this by using the sts:SourceIdentity condition key in a role trust // policy. That way, actions that are taken with the role are associated with // that user. After the source identity is set, the value cannot be changed. // It is present in the request for all actions that are taken by the role and // persists across chained role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining) // sessions. You can configure your identity provider to use an attribute associated // with your users, like user name or email, as the source identity when calling // AssumeRoleWithWebIdentity. You do this by adding a claim to the JSON web // token. To learn more about OIDC tokens and claims, see Using Tokens with // User Pools (https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html) // in the Amazon Cognito Developer Guide. For more information about using source // identity, see Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) // in the IAM User Guide. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@- SourceIdentity string `min:"2" type:"string"` // The unique user identifier that is returned by the identity provider. This // identifier is associated with the WebIdentityToken that was submitted with // the AssumeRoleWithWebIdentity call. The identifier is typically unique to // the user and the application that acquired the WebIdentityToken (pairwise // identifier). For OpenID Connect ID tokens, this field contains the value // returned by the identity provider as the token's sub (Subject) claim. SubjectFromWebIdentityToken string `min:"6" type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleWithWebIdentityOutput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumeRoleWithWebIdentityOutput) GoString() string { return s.String() } // SetAssumedRoleUser sets the AssumedRoleUser field's value. func (s AssumeRoleWithWebIdentityOutput) SetAssumedRoleUser(v AssumedRoleUser) AssumeRoleWithWebIdentityOutput { s.AssumedRoleUser = v return s } // SetAudience sets the Audience field's value. func (s AssumeRoleWithWebIdentityOutput) SetAudience(v string) AssumeRoleWithWebIdentityOutput { s.Audience = &v return s } // SetCredentials sets the Credentials field's value. func (s AssumeRoleWithWebIdentityOutput) SetCredentials(v Credentials) AssumeRoleWithWebIdentityOutput { s.Credentials = v return s } // SetPackedPolicySize sets the PackedPolicySize field's value. func (s AssumeRoleWithWebIdentityOutput) SetPackedPolicySize(v int64) AssumeRoleWithWebIdentityOutput { s.PackedPolicySize = &v return s } // SetProvider sets the Provider field's value. func (s AssumeRoleWithWebIdentityOutput) SetProvider(v string) AssumeRoleWithWebIdentityOutput { s.Provider = &v return s } // SetSourceIdentity sets the SourceIdentity field's value. func (s AssumeRoleWithWebIdentityOutput) SetSourceIdentity(v string) AssumeRoleWithWebIdentityOutput { s.SourceIdentity = &v return s } // SetSubjectFromWebIdentityToken sets the SubjectFromWebIdentityToken field's value. func (s AssumeRoleWithWebIdentityOutput) SetSubjectFromWebIdentityToken(v string) AssumeRoleWithWebIdentityOutput { s.SubjectFromWebIdentityToken = &v return s } // The identifiers for the temporary security credentials that the operation // returns. type AssumedRoleUser struct { _ struct{} `type:"structure"` // The ARN of the temporary security credentials that are returned from the // AssumeRole action. For more information about ARNs and how to use them in // policies, see IAM Identifiers (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html) // in the IAM User Guide. // // Arn is a required field Arn string `min:"20" type:"string" required:"true"` // A unique identifier that contains the role ID and the role session name of // the role that is being assumed. The role ID is generated by Amazon Web Services // when the role is created. // // AssumedRoleId is a required field AssumedRoleId string `min:"2" type:"string" required:"true"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumedRoleUser) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s AssumedRoleUser) GoString() string { return s.String() } // SetArn sets the Arn field's value. func (s AssumedRoleUser) SetArn(v string) AssumedRoleUser { s.Arn = &v return s } // SetAssumedRoleId sets the AssumedRoleId field's value. func (s AssumedRoleUser) SetAssumedRoleId(v string) AssumedRoleUser { s.AssumedRoleId = &v return s } // Amazon Web Services credentials for API authentication. type Credentials struct { _ struct{} `type:"structure"` // The access key ID that identifies the temporary security credentials. // // AccessKeyId is a required field AccessKeyId string `min:"16" type:"string" required:"true"` // The date on which the current credentials expire. // // Expiration is a required field Expiration time.Time `type:"timestamp" required:"true"` // The secret access key that can be used to sign requests. // // SecretAccessKey is a sensitive parameter and its value will be // replaced with "sensitive" in string returned by Credentials's // String and GoString methods. // // SecretAccessKey is a required field SecretAccessKey string `type:"string" required:"true" sensitive:"true"` // The token that users must pass to the service API to use the temporary credentials. // // SessionToken is a required field SessionToken string `type:"string" required:"true"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s Credentials) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s Credentials) GoString() string { return s.String() } // SetAccessKeyId sets the AccessKeyId field's value. func (s Credentials) SetAccessKeyId(v string) Credentials { s.AccessKeyId = &v return s } // SetExpiration sets the Expiration field's value. func (s Credentials) SetExpiration(v time.Time) Credentials { s.Expiration = &v return s } // SetSecretAccessKey sets the SecretAccessKey field's value. func (s Credentials) SetSecretAccessKey(v string) Credentials { s.SecretAccessKey = &v return s } // SetSessionToken sets the SessionToken field's value. func (s Credentials) SetSessionToken(v string) Credentials { s.SessionToken = &v return s } type DecodeAuthorizationMessageInput struct { _ struct{} `type:"structure"` // The encoded message that was returned with the response. // // EncodedMessage is a required field EncodedMessage string `min:"1" type:"string" required:"true"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s DecodeAuthorizationMessageInput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s DecodeAuthorizationMessageInput) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s DecodeAuthorizationMessageInput) Validate() error { invalidParams := request.ErrInvalidParams{Context: "DecodeAuthorizationMessageInput"} if s.EncodedMessage == nil { invalidParams.Add(request.NewErrParamRequired("EncodedMessage")) } if s.EncodedMessage != nil && len(s.EncodedMessage) < 1 { invalidParams.Add(request.NewErrParamMinLen("EncodedMessage", 1)) } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetEncodedMessage sets the EncodedMessage field's value. func (s DecodeAuthorizationMessageInput) SetEncodedMessage(v string) DecodeAuthorizationMessageInput { s.EncodedMessage = &v return s } // A document that contains additional information about the authorization status // of a request from an encoded message that is returned in response to an Amazon // Web Services request. type DecodeAuthorizationMessageOutput struct { _ struct{} `type:"structure"` // The API returns a response with the decoded message. DecodedMessage string `type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s DecodeAuthorizationMessageOutput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s DecodeAuthorizationMessageOutput) GoString() string { return s.String() } // SetDecodedMessage sets the DecodedMessage field's value. func (s DecodeAuthorizationMessageOutput) SetDecodedMessage(v string) DecodeAuthorizationMessageOutput { s.DecodedMessage = &v return s } // Identifiers for the federated user that is associated with the credentials. type FederatedUser struct { _ struct{} `type:"structure"` // The ARN that specifies the federated user that is associated with the credentials. // For more information about ARNs and how to use them in policies, see IAM // Identifiers (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html) // in the IAM User Guide. // // Arn is a required field Arn string `min:"20" type:"string" required:"true"` // The string that identifies the federated user associated with the credentials, // similar to the unique ID of an IAM user. // // FederatedUserId is a required field FederatedUserId string `min:"2" type:"string" required:"true"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s FederatedUser) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s FederatedUser) GoString() string { return s.String() } // SetArn sets the Arn field's value. func (s FederatedUser) SetArn(v string) FederatedUser { s.Arn = &v return s } // SetFederatedUserId sets the FederatedUserId field's value. func (s FederatedUser) SetFederatedUserId(v string) FederatedUser { s.FederatedUserId = &v return s } type GetAccessKeyInfoInput struct { _ struct{} `type:"structure"` // The identifier of an access key. // // This parameter allows (through its regex pattern) a string of characters // that can consist of any upper- or lowercase letter or digit. // // AccessKeyId is a required field AccessKeyId string `min:"16" type:"string" required:"true"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetAccessKeyInfoInput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetAccessKeyInfoInput) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s GetAccessKeyInfoInput) Validate() error { invalidParams := request.ErrInvalidParams{Context: "GetAccessKeyInfoInput"} if s.AccessKeyId == nil { invalidParams.Add(request.NewErrParamRequired("AccessKeyId")) } if s.AccessKeyId != nil && len(s.AccessKeyId) < 16 { invalidParams.Add(request.NewErrParamMinLen("AccessKeyId", 16)) } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetAccessKeyId sets the AccessKeyId field's value. func (s GetAccessKeyInfoInput) SetAccessKeyId(v string) GetAccessKeyInfoInput { s.AccessKeyId = &v return s } type GetAccessKeyInfoOutput struct { _ struct{} `type:"structure"` // The number used to identify the Amazon Web Services account. Account string `type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetAccessKeyInfoOutput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetAccessKeyInfoOutput) GoString() string { return s.String() } // SetAccount sets the Account field's value. func (s GetAccessKeyInfoOutput) SetAccount(v string) GetAccessKeyInfoOutput { s.Account = &v return s } type GetCallerIdentityInput struct { _ struct{} `type:"structure"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetCallerIdentityInput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetCallerIdentityInput) GoString() string { return s.String() } // Contains the response to a successful GetCallerIdentity request, including // information about the entity making the request. type GetCallerIdentityOutput struct { _ struct{} `type:"structure"` // The Amazon Web Services account ID number of the account that owns or contains // the calling entity. Account string `type:"string"` // The Amazon Web Services ARN associated with the calling entity. Arn string `min:"20" type:"string"` // The unique identifier of the calling entity. The exact value depends on the // type of entity that is making the call. The values returned are those listed // in the aws:userid column in the Principal table (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable) // found on the Policy Variables reference page in the IAM User Guide. UserId string `type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetCallerIdentityOutput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetCallerIdentityOutput) GoString() string { return s.String() } // SetAccount sets the Account field's value. func (s GetCallerIdentityOutput) SetAccount(v string) GetCallerIdentityOutput { s.Account = &v return s } // SetArn sets the Arn field's value. func (s GetCallerIdentityOutput) SetArn(v string) GetCallerIdentityOutput { s.Arn = &v return s } // SetUserId sets the UserId field's value. func (s GetCallerIdentityOutput) SetUserId(v string) GetCallerIdentityOutput { s.UserId = &v return s } type GetFederationTokenInput struct { _ struct{} `type:"structure"` // The duration, in seconds, that the session should last. Acceptable durations // for federation sessions range from 900 seconds (15 minutes) to 129,600 seconds // (36 hours), with 43,200 seconds (12 hours) as the default. Sessions obtained // using root user credentials are restricted to a maximum of 3,600 seconds // (one hour). If the specified duration is longer than one hour, the session // obtained by using root user credentials defaults to one hour. DurationSeconds int64 `min:"900" type:"integer"` // The name of the federated user. The name is used as an identifier for the // temporary security credentials (such as Bob). For example, you can reference // the federated user name in a resource-based policy, such as in an Amazon // S3 bucket policy. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@- // // Name is a required field Name string `min:"2" type:"string" required:"true"` // An IAM policy in JSON format that you want to use as an inline session policy. // // You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // to this operation. You can pass a single JSON policy document to use as an // inline session policy. You can also specify up to 10 managed policy Amazon // Resource Names (ARNs) to use as managed session policies. // // This parameter is optional. However, if you do not pass any session policies, // then the resulting federated user session has no permissions. // // When you pass session policies, the session permissions are the intersection // of the IAM user policies and the session policies that you pass. This gives // you a way to further restrict the permissions for a federated user. You cannot // use session policies to grant more permissions than those that are defined // in the permissions policy of the IAM user. For more information, see Session // Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. // // The resulting credentials can be used to access a resource that has a resource-based // policy. If that policy specifically references the federated user session // in the Principal element of the policy, the session has the permissions allowed // by the policy. These permissions are granted in addition to the permissions // that are granted by the session policies. // // The plaintext that you use for both inline and managed session policies can't // exceed 2,048 characters. The JSON policy characters can be any ASCII character // from the space character to the end of the valid character list (\u0020 through // \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage // return (\u000D) characters. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. Policy string `min:"1" type:"string"` // The Amazon Resource Names (ARNs) of the IAM managed policies that you want // to use as a managed session policy. The policies must exist in the same account // as the IAM user that is requesting federated access. // // You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // to this operation. You can pass a single JSON policy document to use as an // inline session policy. You can also specify up to 10 managed policy Amazon // Resource Names (ARNs) to use as managed session policies. The plaintext that // you use for both inline and managed session policies can't exceed 2,048 characters. // You can provide up to 10 managed policy ARNs. For more information about // ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces // (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) // in the Amazon Web Services General Reference. // // This parameter is optional. However, if you do not pass any session policies, // then the resulting federated user session has no permissions. // // When you pass session policies, the session permissions are the intersection // of the IAM user policies and the session policies that you pass. This gives // you a way to further restrict the permissions for a federated user. You cannot // use session policies to grant more permissions than those that are defined // in the permissions policy of the IAM user. For more information, see Session // Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. // // The resulting credentials can be used to access a resource that has a resource-based // policy. If that policy specifically references the federated user session // in the Principal element of the policy, the session has the permissions allowed // by the policy. These permissions are granted in addition to the permissions // that are granted by the session policies. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. PolicyArns []PolicyDescriptorType `type:"list"` // A list of session tags. Each session tag consists of a key name and an associated // value. For more information about session tags, see Passing Session Tags // in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // This parameter is optional. You can pass up to 50 session tags. The plaintext // session tag keys can’t exceed 128 characters and the values can’t exceed // 256 characters. For these and additional limits, see IAM and STS Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // An Amazon Web Services conversion compresses the passed inline session policy, // managed policy ARNs, and session tags into a packed binary format that has // a separate limit. Your request can fail for this limit even if your plaintext // meets the other requirements. The PackedPolicySize response element indicates // by percentage how close the policies and tags for your request are to the // upper size limit. // // You can pass a session tag with the same key as a tag that is already attached // to the user you are federating. When you do, session tags override a user // tag with the same key. // // Tag key–value pairs are not case sensitive, but case is preserved. This // means that you cannot have separate Department and department tag keys. Assume // that the role has the Department=Marketing tag and you pass the department=engineering // session tag. Department and department are not saved as separate tags, and // the session tag passed in the request takes precedence over the role tag. Tags []Tag `type:"list"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetFederationTokenInput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetFederationTokenInput) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s GetFederationTokenInput) Validate() error { invalidParams := request.ErrInvalidParams{Context: "GetFederationTokenInput"} if s.DurationSeconds != nil && s.DurationSeconds < 900 { invalidParams.Add(request.NewErrParamMinValue("DurationSeconds", 900)) } if s.Name == nil { invalidParams.Add(request.NewErrParamRequired("Name")) } if s.Name != nil && len(s.Name) < 2 { invalidParams.Add(request.NewErrParamMinLen("Name", 2)) } if s.Policy != nil && len(s.Policy) < 1 { invalidParams.Add(request.NewErrParamMinLen("Policy", 1)) } if s.PolicyArns != nil { for i, v := range s.PolicyArns { if v == nil { continue } if err := v.Validate(); err != nil { invalidParams.AddNested(fmt.Sprintf("%s[%v]", "PolicyArns", i), err.(request.ErrInvalidParams)) } } } if s.Tags != nil { for i, v := range s.Tags { if v == nil { continue } if err := v.Validate(); err != nil { invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams)) } } } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetDurationSeconds sets the DurationSeconds field's value. func (s GetFederationTokenInput) SetDurationSeconds(v int64) GetFederationTokenInput { s.DurationSeconds = &v return s } // SetName sets the Name field's value. func (s GetFederationTokenInput) SetName(v string) GetFederationTokenInput { s.Name = &v return s } // SetPolicy sets the Policy field's value. func (s GetFederationTokenInput) SetPolicy(v string) GetFederationTokenInput { s.Policy = &v return s } // SetPolicyArns sets the PolicyArns field's value. func (s GetFederationTokenInput) SetPolicyArns(v []PolicyDescriptorType) GetFederationTokenInput { s.PolicyArns = v return s } // SetTags sets the Tags field's value. func (s GetFederationTokenInput) SetTags(v []Tag) GetFederationTokenInput { s.Tags = v return s } // Contains the response to a successful GetFederationToken request, including // temporary Amazon Web Services credentials that can be used to make Amazon // Web Services requests. type GetFederationTokenOutput struct { _ struct{} `type:"structure"` // The temporary security credentials, which include an access key ID, a secret // access key, and a security (or session) token. // // The size of the security token that STS API operations return is not fixed. // We strongly recommend that you make no assumptions about the maximum size. Credentials Credentials `type:"structure"` // Identifiers for the federated user associated with the credentials (such // as arn:aws:sts::123456789012:federated-user/Bob or 123456789012:Bob). You // can use the federated user's ARN in your resource-based policies, such as // an Amazon S3 bucket policy. FederatedUser FederatedUser `type:"structure"` // A percentage value that indicates the packed size of the session policies // and session tags combined passed in the request. The request fails if the // packed size is greater than 100 percent, which means the policies and tags // exceeded the allowed space. PackedPolicySize int64 `type:"integer"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetFederationTokenOutput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetFederationTokenOutput) GoString() string { return s.String() } // SetCredentials sets the Credentials field's value. func (s GetFederationTokenOutput) SetCredentials(v Credentials) GetFederationTokenOutput { s.Credentials = v return s } // SetFederatedUser sets the FederatedUser field's value. func (s GetFederationTokenOutput) SetFederatedUser(v FederatedUser) GetFederationTokenOutput { s.FederatedUser = v return s } // SetPackedPolicySize sets the PackedPolicySize field's value. func (s GetFederationTokenOutput) SetPackedPolicySize(v int64) GetFederationTokenOutput { s.PackedPolicySize = &v return s } type GetSessionTokenInput struct { _ struct{} `type:"structure"` // The duration, in seconds, that the credentials should remain valid. Acceptable // durations for IAM user sessions range from 900 seconds (15 minutes) to 129,600 // seconds (36 hours), with 43,200 seconds (12 hours) as the default. Sessions // for Amazon Web Services account owners are restricted to a maximum of 3,600 // seconds (one hour). If the duration is longer than one hour, the session // for Amazon Web Services account owners defaults to one hour. DurationSeconds int64 `min:"900" type:"integer"` // The identification number of the MFA device that is associated with the IAM // user who is making the GetSessionToken call. Specify this value if the IAM // user has a policy that requires MFA authentication. The value is either the // serial number for a hardware device (such as GAHT12345678) or an Amazon Resource // Name (ARN) for a virtual device (such as arn:aws:iam::123456789012:mfa/user). // You can find the device for an IAM user by going to the Amazon Web Services // Management Console and viewing the user's security credentials. // // The regex used to validate this parameter is a string of characters consisting // of upper- and lower-case alphanumeric characters with no spaces. You can // also include underscores or any of the following characters: =,.@:/- SerialNumber string `min:"9" type:"string"` // The value provided by the MFA device, if MFA is required. If any policy requires // the IAM user to submit an MFA code, specify this value. If MFA authentication // is required, the user must provide a code when requesting a set of temporary // security credentials. A user who fails to provide the code receives an "access // denied" response when requesting resources that require MFA authentication. // // The format for this parameter, as described by its regex pattern, is a sequence // of six numeric digits. TokenCode string `min:"6" type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetSessionTokenInput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetSessionTokenInput) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s GetSessionTokenInput) Validate() error { invalidParams := request.ErrInvalidParams{Context: "GetSessionTokenInput"} if s.DurationSeconds != nil && s.DurationSeconds < 900 { invalidParams.Add(request.NewErrParamMinValue("DurationSeconds", 900)) } if s.SerialNumber != nil && len(s.SerialNumber) < 9 { invalidParams.Add(request.NewErrParamMinLen("SerialNumber", 9)) } if s.TokenCode != nil && len(s.TokenCode) < 6 { invalidParams.Add(request.NewErrParamMinLen("TokenCode", 6)) } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetDurationSeconds sets the DurationSeconds field's value. func (s GetSessionTokenInput) SetDurationSeconds(v int64) GetSessionTokenInput { s.DurationSeconds = &v return s } // SetSerialNumber sets the SerialNumber field's value. func (s GetSessionTokenInput) SetSerialNumber(v string) GetSessionTokenInput { s.SerialNumber = &v return s } // SetTokenCode sets the TokenCode field's value. func (s GetSessionTokenInput) SetTokenCode(v string) GetSessionTokenInput { s.TokenCode = &v return s } // Contains the response to a successful GetSessionToken request, including // temporary Amazon Web Services credentials that can be used to make Amazon // Web Services requests. type GetSessionTokenOutput struct { _ struct{} `type:"structure"` // The temporary security credentials, which include an access key ID, a secret // access key, and a security (or session) token. // // The size of the security token that STS API operations return is not fixed. // We strongly recommend that you make no assumptions about the maximum size. Credentials Credentials `type:"structure"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetSessionTokenOutput) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s GetSessionTokenOutput) GoString() string { return s.String() } // SetCredentials sets the Credentials field's value. func (s GetSessionTokenOutput) SetCredentials(v Credentials) GetSessionTokenOutput { s.Credentials = v return s } // A reference to the IAM managed policy that is passed as a session policy // for a role session or a federated user session. type PolicyDescriptorType struct { _ struct{} `type:"structure"` // The Amazon Resource Name (ARN) of the IAM managed policy to use as a session // policy for the role. For more information about ARNs, see Amazon Resource // Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) // in the Amazon Web Services General Reference. Arn string `locationName:"arn" min:"20" type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s PolicyDescriptorType) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s PolicyDescriptorType) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s PolicyDescriptorType) Validate() error { invalidParams := request.ErrInvalidParams{Context: "PolicyDescriptorType"} if s.Arn != nil && len(s.Arn) < 20 { invalidParams.Add(request.NewErrParamMinLen("Arn", 20)) } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetArn sets the Arn field's value. func (s PolicyDescriptorType) SetArn(v string) PolicyDescriptorType { s.Arn = &v return s } // Contains information about the provided context. This includes the signed // and encrypted trusted context assertion and the context provider ARN from // which the trusted context assertion was generated. type ProvidedContext struct { _ struct{} `type:"structure"` // The signed and encrypted trusted context assertion generated by the context // provider. The trusted context assertion is signed and encrypted by Amazon // Web Services STS. ContextAssertion string `min:"4" type:"string"` // The context provider ARN from which the trusted context assertion was generated. ProviderArn string `min:"20" type:"string"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s ProvidedContext) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s ProvidedContext) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s ProvidedContext) Validate() error { invalidParams := request.ErrInvalidParams{Context: "ProvidedContext"} if s.ContextAssertion != nil && len(s.ContextAssertion) < 4 { invalidParams.Add(request.NewErrParamMinLen("ContextAssertion", 4)) } if s.ProviderArn != nil && len(s.ProviderArn) < 20 { invalidParams.Add(request.NewErrParamMinLen("ProviderArn", 20)) } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetContextAssertion sets the ContextAssertion field's value. func (s ProvidedContext) SetContextAssertion(v string) ProvidedContext { s.ContextAssertion = &v return s } // SetProviderArn sets the ProviderArn field's value. func (s ProvidedContext) SetProviderArn(v string) ProvidedContext { s.ProviderArn = &v return s } // You can pass custom key-value pair attributes when you assume a role or federate // a user. These are called session tags. You can then use the session tags // to control access to resources. For more information, see Tagging Amazon // Web Services STS Sessions (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. type Tag struct { _ struct{} `type:"structure"` // The key for a session tag. // // You can pass up to 50 session tags. The plain text session tag keys can’t // exceed 128 characters. For these and additional limits, see IAM and STS Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // Key is a required field Key string `min:"1" type:"string" required:"true"` // The value for a session tag. // // You can pass up to 50 session tags. The plain text session tag values can’t // exceed 256 characters. For these and additional limits, see IAM and STS Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length) // in the IAM User Guide. // // Value is a required field Value string `type:"string" required:"true"` } // String returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s Tag) String() string { return awsutil.Prettify(s) } // GoString returns the string representation. // // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". func (s Tag) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. func (s Tag) Validate() error { invalidParams := request.ErrInvalidParams{Context: "Tag"} if s.Key == nil { invalidParams.Add(request.NewErrParamRequired("Key")) } if s.Key != nil && len(s.Key) < 1 { invalidParams.Add(request.NewErrParamMinLen("Key", 1)) } if s.Value == nil { invalidParams.Add(request.NewErrParamRequired("Value")) } if invalidParams.Len() > 0 { return invalidParams } return nil } // SetKey sets the Key field's value. func (s Tag) SetKey(v string) Tag { s.Key = &v return s } // SetValue sets the Value field's value. func (s Tag) SetValue(v string) *Tag { s.Value = &v return s }	159.53 KB	2025-05-25 12:27
📄 customizations.go package sts import "github.com/aws/aws-sdk-go/aws/request" func init() { initRequest = customizeRequest } func customizeRequest(r *request.Request) { r.RetryErrorCodes = append(r.RetryErrorCodes, ErrCodeIDPCommunicationErrorException) }	242 B	2025-05-25 12:27
📄 customizations_test.go package sts_test import ( "bytes" "fmt" "io/ioutil" "net/http" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/corehandlers" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/sts" ) var svc = sts.New(unit.Session, &aws.Config{ Region: aws.String("mock-region"), }) func TestUnsignedRequest_AssumeRoleWithSAML(t testing.T) { req, _ := svc.AssumeRoleWithSAMLRequest(&sts.AssumeRoleWithSAMLInput{ PrincipalArn: aws.String("ARN01234567890123456789"), RoleArn: aws.String("ARN01234567890123456789"), SAMLAssertion: aws.String("ASSERT"), }) err := req.Sign() if err != nil { t.Errorf("expect no error, got %v", err) } if e, a := "", req.HTTPRequest.Header.Get("Authorization"); e != a { t.Errorf("expect %v, got %v", e, a) } } func TestUnsignedRequest_AssumeRoleWithWebIdentity(t testing.T) { req, _ := svc.AssumeRoleWithWebIdentityRequest(&sts.AssumeRoleWithWebIdentityInput{ RoleArn: aws.String("ARN01234567890123456789"), RoleSessionName: aws.String("SESSION"), WebIdentityToken: aws.String("TOKEN"), }) err := req.Sign() if err != nil { t.Errorf("expect no error, got %v", err) } if e, a := "", req.HTTPRequest.Header.Get("Authorization"); e != a { t.Errorf("expect %v, got %v", e, a) } } func TestSTSCustomRetryErrorCodes(t testing.T) { svc := sts.New(unit.Session, &aws.Config{ MaxRetries: aws.Int(1), }) svc.Handlers.Validate.Clear() const xmlErr = `<ErrorResponse><Error><Code>%s</Code><Message>some error message</Message></Error></ErrorResponse>` var reqCount int resps := []http.Response{ { StatusCode: 400, Header: http.Header{}, Body: ioutil.NopCloser(bytes.NewReader( []byte(fmt.Sprintf(xmlErr, sts.ErrCodeIDPCommunicationErrorException)), )), }, { StatusCode: 200, Header: http.Header{}, Body: ioutil.NopCloser(bytes.NewReader([]byte{})), }, } req, _ := svc.AssumeRoleWithWebIdentityRequest(&sts.AssumeRoleWithWebIdentityInput{}) req.Handlers.Send.Swap(corehandlers.SendHandler.Name, request.NamedHandler{ Name: "custom send handler", Fn: func(r *request.Request) { r.HTTPResponse = resps[reqCount] reqCount++ }, }) if err := req.Send(); err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := 2, reqCount; e != a { t.Errorf("expect %v requests, got %v", e, a) } }	2.38 KB	2025-05-25 12:27
📄 doc.go // Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. // Package sts provides the client and types for making API // requests to AWS Security Token Service. // // Security Token Service (STS) enables you to request temporary, limited-privilege // credentials for users. This guide provides descriptions of the STS API. For // more information about using this service, see Temporary Security Credentials // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html). // // See https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15 for more information on this service. // // See sts package documentation for more information. // https://docs.aws.amazon.com/sdk-for-go/api/service/sts/ // // # Using the Client // // To contact AWS Security Token Service with the SDK use the New function to create // a new service client. With that client you can make API requests to the service. // These clients are safe to use concurrently. // // See the SDK's documentation for more information on how to use the SDK. // https://docs.aws.amazon.com/sdk-for-go/api/ // // See aws.Config documentation for more information on configuring SDK clients. // https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config // // See the AWS Security Token Service client STS for more // information on creating client for this service. // https://docs.aws.amazon.com/sdk-for-go/api/service/sts/#New package sts	1.39 KB	2025-05-25 12:27
📄 errors.go // Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. package sts const ( // ErrCodeExpiredTokenException for service response error code // "ExpiredTokenException". // // The web identity token that was passed is expired or is not valid. Get a // new identity token from the identity provider and then retry the request. ErrCodeExpiredTokenException = "ExpiredTokenException" // ErrCodeIDPCommunicationErrorException for service response error code // "IDPCommunicationError". // // The request could not be fulfilled because the identity provider (IDP) that // was asked to verify the incoming identity token could not be reached. This // is often a transient error caused by network conditions. Retry the request // a limited number of times so that you don't exceed the request rate. If the // error persists, the identity provider might be down or not responding. ErrCodeIDPCommunicationErrorException = "IDPCommunicationError" // ErrCodeIDPRejectedClaimException for service response error code // "IDPRejectedClaim". // // The identity provider (IdP) reported that authentication failed. This might // be because the claim is invalid. // // If this error is returned for the AssumeRoleWithWebIdentity operation, it // can also mean that the claim has expired or has been explicitly revoked. ErrCodeIDPRejectedClaimException = "IDPRejectedClaim" // ErrCodeInvalidAuthorizationMessageException for service response error code // "InvalidAuthorizationMessageException". // // The error returned if the message passed to DecodeAuthorizationMessage was // invalid. This can happen if the token contains invalid characters, such as // linebreaks. ErrCodeInvalidAuthorizationMessageException = "InvalidAuthorizationMessageException" // ErrCodeInvalidIdentityTokenException for service response error code // "InvalidIdentityToken". // // The web identity token that was passed could not be validated by Amazon Web // Services. Get a new identity token from the identity provider and then retry // the request. ErrCodeInvalidIdentityTokenException = "InvalidIdentityToken" // ErrCodeMalformedPolicyDocumentException for service response error code // "MalformedPolicyDocument". // // The request was rejected because the policy document was malformed. The error // message describes the specific error. ErrCodeMalformedPolicyDocumentException = "MalformedPolicyDocument" // ErrCodePackedPolicyTooLargeException for service response error code // "PackedPolicyTooLarge". // // The request was rejected because the total packed size of the session policies // and session tags combined was too large. An Amazon Web Services conversion // compresses the session policy document, session policy ARNs, and session // tags into a packed binary format that has a separate limit. The error message // indicates by percentage how close the policies and tags are to the upper // size limit. For more information, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) // in the IAM User Guide. // // You could receive this error even though you meet other defined session policy // and session tag limits. For more information, see IAM and STS Entity Character // Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length) // in the IAM User Guide. ErrCodePackedPolicyTooLargeException = "PackedPolicyTooLarge" // ErrCodeRegionDisabledException for service response error code // "RegionDisabledException". // // STS is not activated in the requested region for the account that is being // asked to generate credentials. The account administrator must use the IAM // console to activate STS in that region. For more information, see Activating // and Deactivating Amazon Web Services STS in an Amazon Web Services Region // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) // in the IAM User Guide. ErrCodeRegionDisabledException = "RegionDisabledException" )	4 KB	2025-05-25 12:27
📄 examples_test.go // Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. package sts_test import ( "fmt" "strings" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/session" "github.com/aws/aws-sdk-go/service/sts" ) var _ time.Duration var _ strings.Reader var _ aws.Config func parseTime(layout, value string) time.Time { t, err := time.Parse(layout, value) if err != nil { panic(err) } return &t } // To assume a role // func ExampleSTS_AssumeRole_shared00() { svc := sts.New(session.New()) input := &sts.AssumeRoleInput{ ExternalId: aws.String("123ABC"), Policy: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Stmt1\",\"Effect\":\"Allow\",\"Action\":\"s3:ListAllMyBuckets\",\"Resource\":\"\"}]}"), RoleArn: aws.String("arn:aws:iam::123456789012:role/demo"), RoleSessionName: aws.String("testAssumeRoleSession"), Tags: []sts.Tag{ { Key: aws.String("Project"), Value: aws.String("Unicorn"), }, { Key: aws.String("Team"), Value: aws.String("Automation"), }, { Key: aws.String("Cost-Center"), Value: aws.String("12345"), }, }, TransitiveTagKeys: []string{ aws.String("Project"), aws.String("Cost-Center"), }, } result, err := svc.AssumeRole(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { case sts.ErrCodeMalformedPolicyDocumentException: fmt.Println(sts.ErrCodeMalformedPolicyDocumentException, aerr.Error()) case sts.ErrCodePackedPolicyTooLargeException: fmt.Println(sts.ErrCodePackedPolicyTooLargeException, aerr.Error()) case sts.ErrCodeRegionDisabledException: fmt.Println(sts.ErrCodeRegionDisabledException, aerr.Error()) case sts.ErrCodeExpiredTokenException: fmt.Println(sts.ErrCodeExpiredTokenException, aerr.Error()) default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) } // To assume a role using a SAML assertion // func ExampleSTS_AssumeRoleWithSAML_shared00() { svc := sts.New(session.New()) input := &sts.AssumeRoleWithSAMLInput{ DurationSeconds: aws.Int64(3600), PrincipalArn: aws.String("arn:aws:iam::123456789012:saml-provider/SAML-test"), RoleArn: aws.String("arn:aws:iam::123456789012:role/TestSaml"), SAMLAssertion: aws.String("VERYLONGENCODEDASSERTIONEXAMPLExzYW1sOkF1ZGllbmNlPmJsYW5rPC9zYW1sOkF1ZGllbmNlPjwvc2FtbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1sOlN1YmplY3Q+PHNhbWw6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6dHJhbnNpZW50Ij5TYW1sRXhhbXBsZTwvc2FtbDpOYW1lSUQ+PHNhbWw6U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb25EYXRhIE5vdE9uT3JBZnRlcj0iMjAxOS0xMS0wMVQyMDoyNTowNS4xNDVaIiBSZWNpcGllbnQ9Imh0dHBzOi8vc2lnbmluLmF3cy5hbWF6b24uY29tL3NhbWwiLz48L3NhbWw6U3ViamVjdENvbmZpcm1hdGlvbj48L3NhbWw6U3ViamVjdD48c2FtbDpBdXRoblN0YXRlbWVudCBBdXRoPD94bWwgdmpSZXNwb25zZT4="), } result, err := svc.AssumeRoleWithSAML(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { case sts.ErrCodeMalformedPolicyDocumentException: fmt.Println(sts.ErrCodeMalformedPolicyDocumentException, aerr.Error()) case sts.ErrCodePackedPolicyTooLargeException: fmt.Println(sts.ErrCodePackedPolicyTooLargeException, aerr.Error()) case sts.ErrCodeIDPRejectedClaimException: fmt.Println(sts.ErrCodeIDPRejectedClaimException, aerr.Error()) case sts.ErrCodeInvalidIdentityTokenException: fmt.Println(sts.ErrCodeInvalidIdentityTokenException, aerr.Error()) case sts.ErrCodeExpiredTokenException: fmt.Println(sts.ErrCodeExpiredTokenException, aerr.Error()) case sts.ErrCodeRegionDisabledException: fmt.Println(sts.ErrCodeRegionDisabledException, aerr.Error()) default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) } // To assume a role as an OpenID Connect-federated user // func ExampleSTS_AssumeRoleWithWebIdentity_shared00() { svc := sts.New(session.New()) input := &sts.AssumeRoleWithWebIdentityInput{ DurationSeconds: aws.Int64(3600), Policy: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Stmt1\",\"Effect\":\"Allow\",\"Action\":\"s3:ListAllMyBuckets\",\"Resource\":\"\"}]}"), ProviderId: aws.String("www.amazon.com"), RoleArn: aws.String("arn:aws:iam::123456789012:role/FederatedWebIdentityRole"), RoleSessionName: aws.String("app1"), WebIdentityToken: aws.String("Atza%7CIQEBLjAsAhRFiXuWpUXuRvQ9PZL3GMFcYevydwIUFAHZwXZXXXXXXXXJnrulxKDHwy87oGKPznh0D6bEQZTSCzyoCtL_8S07pLpr0zMbn6w1lfVZKNTBdDansFBmtGnIsIapjI6xKR02Yc_2bQ8LZbUXSGm6Ry6_BG7PrtLZtj_dfCTj92xNGed-CrKqjG7nPBjNIL016GGvuS5gSvPRUxWES3VYfm1wl7WTI7jn-Pcb6M-buCgHhFOzTQxod27L9CqnOLio7N3gZAGpsp6n1-AJBOCJckcyXe2c6uD0srOJeZlKUm2eTDVMf8IehDVI0r1QOnTV6KzzAI3OY87Vd_cVMQ"), } result, err := svc.AssumeRoleWithWebIdentity(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { case sts.ErrCodeMalformedPolicyDocumentException: fmt.Println(sts.ErrCodeMalformedPolicyDocumentException, aerr.Error()) case sts.ErrCodePackedPolicyTooLargeException: fmt.Println(sts.ErrCodePackedPolicyTooLargeException, aerr.Error()) case sts.ErrCodeIDPRejectedClaimException: fmt.Println(sts.ErrCodeIDPRejectedClaimException, aerr.Error()) case sts.ErrCodeIDPCommunicationErrorException: fmt.Println(sts.ErrCodeIDPCommunicationErrorException, aerr.Error()) case sts.ErrCodeInvalidIdentityTokenException: fmt.Println(sts.ErrCodeInvalidIdentityTokenException, aerr.Error()) case sts.ErrCodeExpiredTokenException: fmt.Println(sts.ErrCodeExpiredTokenException, aerr.Error()) case sts.ErrCodeRegionDisabledException: fmt.Println(sts.ErrCodeRegionDisabledException, aerr.Error()) default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) } // To decode information about an authorization status of a request // func ExampleSTS_DecodeAuthorizationMessage_shared00() { svc := sts.New(session.New()) input := &sts.DecodeAuthorizationMessageInput{ EncodedMessage: aws.String("<encoded-message>"), } result, err := svc.DecodeAuthorizationMessage(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { case sts.ErrCodeInvalidAuthorizationMessageException: fmt.Println(sts.ErrCodeInvalidAuthorizationMessageException, aerr.Error()) default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) } // To get details about a calling IAM user // This example shows a request and response made with the credentials for a user named // Alice in the AWS account 123456789012. func ExampleSTS_GetCallerIdentity_shared00() { svc := sts.New(session.New()) input := &sts.GetCallerIdentityInput{} result, err := svc.GetCallerIdentity(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) } // To get details about a calling user federated with AssumeRole // This example shows a request and response made with temporary credentials created // by AssumeRole. The name of the assumed role is my-role-name, and the RoleSessionName // is set to my-role-session-name. func ExampleSTS_GetCallerIdentity_shared01() { svc := sts.New(session.New()) input := &sts.GetCallerIdentityInput{} result, err := svc.GetCallerIdentity(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) } // To get details about a calling user federated with GetFederationToken // This example shows a request and response made with temporary credentials created // by using GetFederationToken. The Name parameter is set to my-federated-user-name. func ExampleSTS_GetCallerIdentity_shared02() { svc := sts.New(session.New()) input := &sts.GetCallerIdentityInput{} result, err := svc.GetCallerIdentity(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) } // To get temporary credentials for a role by using GetFederationToken // func ExampleSTS_GetFederationToken_shared00() { svc := sts.New(session.New()) input := &sts.GetFederationTokenInput{ DurationSeconds: aws.Int64(3600), Name: aws.String("testFedUserSession"), Policy: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Stmt1\",\"Effect\":\"Allow\",\"Action\":\"s3:ListAllMyBuckets\",\"Resource\":\"\"}]}"), Tags: []*sts.Tag{ { Key: aws.String("Project"), Value: aws.String("Pegasus"), }, { Key: aws.String("Cost-Center"), Value: aws.String("98765"), }, }, } result, err := svc.GetFederationToken(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { case sts.ErrCodeMalformedPolicyDocumentException: fmt.Println(sts.ErrCodeMalformedPolicyDocumentException, aerr.Error()) case sts.ErrCodePackedPolicyTooLargeException: fmt.Println(sts.ErrCodePackedPolicyTooLargeException, aerr.Error()) case sts.ErrCodeRegionDisabledException: fmt.Println(sts.ErrCodeRegionDisabledException, aerr.Error()) default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) } // To get temporary credentials for an IAM user or an AWS account // func ExampleSTS_GetSessionToken_shared00() { svc := sts.New(session.New()) input := &sts.GetSessionTokenInput{ DurationSeconds: aws.Int64(3600), SerialNumber: aws.String("YourMFASerialNumber"), TokenCode: aws.String("123456"), } result, err := svc.GetSessionToken(input) if err != nil { if aerr, ok := err.(awserr.Error); ok { switch aerr.Code() { case sts.ErrCodeRegionDisabledException: fmt.Println(sts.ErrCodeRegionDisabledException, aerr.Error()) default: fmt.Println(aerr.Error()) } } else { // Print the error, cast err to awserr.Error to get the Code and // Message from an error. fmt.Println(err.Error()) } return } fmt.Println(result) }	11.12 KB	2025-05-25 12:27
📄 integ_test.go // Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. //go:build go1.16 && integration // +build go1.16,integration package sts_test import ( "context" "testing" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting/integration" "github.com/aws/aws-sdk-go/service/sts" ) var _ aws.Config var _ awserr.Error var _ request.Request func TestInteg_00_GetCallerIdentity(t testing.T) { ctx, cancelFn := context.WithTimeout(context.Background(), 5time.Second) defer cancelFn() sess := integration.SessionWithDefaultRegion("us-west-2") svc := sts.New(sess) params := &sts.GetCallerIdentityInput{} _, err := svc.GetCallerIdentityWithContext(ctx, params, func(r request.Request) { r.Handlers.Validate.RemoveByName("core.ValidateParametersHandler") }) if err != nil { t.Errorf("expect no error, got %v", err) } } func TestInteg_01_GetFederationToken(t testing.T) { ctx, cancelFn := context.WithTimeout(context.Background(), 5time.Second) defer cancelFn() sess := integration.SessionWithDefaultRegion("us-west-2") svc := sts.New(sess) params := &sts.GetFederationTokenInput{ Name: aws.String("temp"), Policy: aws.String("{\\\"temp\\\":true}"), } _, err := svc.GetFederationTokenWithContext(ctx, params, func(r request.Request) { r.Handlers.Validate.RemoveByName("core.ValidateParametersHandler") }) if err == nil { t.Fatalf("expect request to fail") } aerr, ok := err.(awserr.RequestFailure) if !ok { t.Fatalf("expect awserr, was %T", err) } if len(aerr.Code()) == 0 { t.Errorf("expect non-empty error code") } if len(aerr.Message()) == 0 { t.Errorf("expect non-empty error message") } if v := aerr.Code(); v == request.ErrCodeSerialization { t.Errorf("expect API error code got serialization failure") } }	1.84 KB	2025-05-25 12:27
📄 service.go // Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT. package sts import ( "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/client/metadata" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/aws/signer/v4" "github.com/aws/aws-sdk-go/private/protocol/query" ) // STS provides the API operation methods for making requests to // AWS Security Token Service. See this package's package overview docs // for details on the service. // // STS methods are safe to use concurrently. It is not safe to // modify mutate any of the struct's properties though. type STS struct { client.Client } // Used for custom client initialization logic var initClient func(client.Client) // Used for custom request initialization logic var initRequest func(request.Request) // Service information constants const ( ServiceName = "sts" // Name of service. EndpointsID = ServiceName // ID to lookup a service endpoint with. ServiceID = "STS" // ServiceID is a unique identifier of a specific service. ) // New creates a new instance of the STS client with a session. // If additional configuration is needed for the client instance use the optional // aws.Config parameter to add your extra config. // // Example: // // mySession := session.Must(session.NewSession()) // // // Create a STS client from just a session. // svc := sts.New(mySession) // // // Create a STS client with additional configuration // svc := sts.New(mySession, aws.NewConfig().WithRegion("us-west-2")) func New(p client.ConfigProvider, cfgs ...aws.Config) STS { c := p.ClientConfig(EndpointsID, cfgs...) if c.SigningNameDerived \|\| len(c.SigningName) == 0 { c.SigningName = EndpointsID // No Fallback } return newClient(c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName, c.ResolvedRegion) } // newClient creates, initializes and returns a new service client instance. func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint, signingRegion, signingName, resolvedRegion string) STS { svc := &STS{ Client: client.New( cfg, metadata.ClientInfo{ ServiceName: ServiceName, ServiceID: ServiceID, SigningName: signingName, SigningRegion: signingRegion, PartitionID: partitionID, Endpoint: endpoint, APIVersion: "2011-06-15", ResolvedRegion: resolvedRegion, }, handlers, ), } // Handlers svc.Handlers.Sign.PushBackNamed(v4.SignRequestHandler) svc.Handlers.Build.PushBackNamed(query.BuildHandler) svc.Handlers.Unmarshal.PushBackNamed(query.UnmarshalHandler) svc.Handlers.UnmarshalMeta.PushBackNamed(query.UnmarshalMetaHandler) svc.Handlers.UnmarshalError.PushBackNamed(query.UnmarshalErrorHandler) // Run custom client initialization if present if initClient != nil { initClient(svc.Client) } return svc } // newRequest creates a new request for a STS operation and runs any // custom request initialization. func (c STS) newRequest(op request.Operation, params, data interface{}) request.Request { req := c.NewRequest(op, params, data) // Run custom request initialization if present if initRequest != nil { initRequest(req) } return req }	3.19 KB	2025-05-25 12:27
📁 stsiface	-	2025-05-25 12:27

Terminal