aws-sdk-core 3.121.1 → 3.174.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +491 -0
- data/VERSION +1 -1
- data/lib/aws-defaults/default_configuration.rb +153 -0
- data/lib/aws-defaults/defaults_mode_config_resolver.rb +107 -0
- data/lib/aws-defaults.rb +3 -0
- data/lib/aws-sdk-core/arn.rb +13 -0
- data/lib/aws-sdk-core/assume_role_credentials.rb +21 -7
- data/lib/aws-sdk-core/assume_role_web_identity_credentials.rb +14 -10
- data/lib/aws-sdk-core/binary/encode_handler.rb +12 -1
- data/lib/aws-sdk-core/client_stubs.rb +5 -1
- data/lib/aws-sdk-core/credential_provider_chain.rb +8 -5
- data/lib/aws-sdk-core/ec2_metadata.rb +3 -2
- data/lib/aws-sdk-core/ecs_credentials.rb +121 -53
- data/lib/aws-sdk-core/endpoints/condition.rb +41 -0
- data/lib/aws-sdk-core/endpoints/endpoint.rb +17 -0
- data/lib/aws-sdk-core/endpoints/endpoint_rule.rb +75 -0
- data/lib/aws-sdk-core/endpoints/error_rule.rb +42 -0
- data/lib/aws-sdk-core/endpoints/function.rb +80 -0
- data/lib/aws-sdk-core/endpoints/matchers.rb +127 -0
- data/lib/aws-sdk-core/endpoints/reference.rb +31 -0
- data/lib/aws-sdk-core/endpoints/rule.rb +25 -0
- data/lib/aws-sdk-core/endpoints/rule_set.rb +52 -0
- data/lib/aws-sdk-core/endpoints/rules_provider.rb +37 -0
- data/lib/aws-sdk-core/endpoints/templater.rb +58 -0
- data/lib/aws-sdk-core/endpoints/tree_rule.rb +45 -0
- data/lib/aws-sdk-core/endpoints/url.rb +60 -0
- data/lib/aws-sdk-core/endpoints.rb +74 -0
- data/lib/aws-sdk-core/errors.rb +14 -1
- data/lib/aws-sdk-core/instance_profile_credentials.rb +85 -14
- data/lib/aws-sdk-core/json/error_handler.rb +20 -1
- data/lib/aws-sdk-core/log/formatter.rb +6 -0
- data/lib/aws-sdk-core/pageable_response.rb +81 -32
- data/lib/aws-sdk-core/plugins/bearer_authorization.rb +67 -0
- data/lib/aws-sdk-core/plugins/checksum_algorithm.rb +340 -0
- data/lib/aws-sdk-core/plugins/credentials_configuration.rb +27 -1
- data/lib/aws-sdk-core/plugins/defaults_mode.rb +40 -0
- data/lib/aws-sdk-core/plugins/endpoint_discovery.rb +6 -2
- data/lib/aws-sdk-core/plugins/http_checksum.rb +8 -1
- data/lib/aws-sdk-core/plugins/jsonvalue_converter.rb +34 -6
- data/lib/aws-sdk-core/plugins/protocols/api_gateway.rb +17 -0
- data/lib/aws-sdk-core/plugins/protocols/rest_json.rb +16 -1
- data/lib/aws-sdk-core/plugins/recursion_detection.rb +38 -0
- data/lib/aws-sdk-core/plugins/regional_endpoint.rb +52 -1
- data/lib/aws-sdk-core/plugins/response_paging.rb +1 -1
- data/lib/aws-sdk-core/plugins/retries/error_inspector.rb +7 -4
- data/lib/aws-sdk-core/plugins/retry_errors.rb +21 -5
- data/lib/aws-sdk-core/plugins/sign.rb +200 -0
- data/lib/aws-sdk-core/plugins/signature_v2.rb +1 -0
- data/lib/aws-sdk-core/plugins/signature_v4.rb +28 -31
- data/lib/aws-sdk-core/plugins/stub_responses.rb +5 -1
- data/lib/aws-sdk-core/plugins/user_agent.rb +117 -14
- data/lib/aws-sdk-core/process_credentials.rb +9 -11
- data/lib/aws-sdk-core/refreshing_credentials.rb +42 -11
- data/lib/aws-sdk-core/refreshing_token.rb +71 -0
- data/lib/aws-sdk-core/rest/handler.rb +1 -1
- data/lib/aws-sdk-core/rest/request/body.rb +19 -1
- data/lib/aws-sdk-core/rest/request/headers.rb +14 -6
- data/lib/aws-sdk-core/rest/response/headers.rb +3 -1
- data/lib/aws-sdk-core/shared_config.rb +82 -12
- data/lib/aws-sdk-core/sso_credentials.rb +91 -50
- data/lib/aws-sdk-core/sso_token_provider.rb +135 -0
- data/lib/aws-sdk-core/static_token_provider.rb +14 -0
- data/lib/aws-sdk-core/structure.rb +6 -4
- data/lib/aws-sdk-core/token.rb +31 -0
- data/lib/aws-sdk-core/token_provider.rb +15 -0
- data/lib/aws-sdk-core/token_provider_chain.rb +51 -0
- data/lib/aws-sdk-core/waiters/poller.rb +3 -1
- data/lib/aws-sdk-core/xml/error_handler.rb +7 -0
- data/lib/aws-sdk-core/xml/parser/engines/oga.rb +2 -0
- data/lib/aws-sdk-core/xml/parser/engines/ox.rb +1 -1
- data/lib/aws-sdk-core.rb +20 -0
- data/lib/aws-sdk-sso/client.rb +82 -15
- data/lib/aws-sdk-sso/endpoint_parameters.rb +66 -0
- data/lib/aws-sdk-sso/endpoint_provider.rb +51 -0
- data/lib/aws-sdk-sso/endpoints.rb +71 -0
- data/lib/aws-sdk-sso/plugins/endpoints.rb +76 -0
- data/lib/aws-sdk-sso/types.rb +8 -43
- data/lib/aws-sdk-sso.rb +5 -1
- data/lib/aws-sdk-ssooidc/client.rb +611 -0
- data/lib/aws-sdk-ssooidc/client_api.rb +216 -0
- data/lib/aws-sdk-ssooidc/customizations.rb +1 -0
- data/lib/aws-sdk-ssooidc/endpoint_parameters.rb +66 -0
- data/lib/aws-sdk-ssooidc/endpoint_provider.rb +51 -0
- data/lib/aws-sdk-ssooidc/endpoints.rb +57 -0
- data/lib/aws-sdk-ssooidc/errors.rb +290 -0
- data/lib/aws-sdk-ssooidc/plugins/endpoints.rb +74 -0
- data/lib/aws-sdk-ssooidc/resource.rb +26 -0
- data/lib/aws-sdk-ssooidc/types.rb +502 -0
- data/lib/aws-sdk-ssooidc.rb +59 -0
- data/lib/aws-sdk-sts/client.rb +377 -361
- data/lib/aws-sdk-sts/endpoint_parameters.rb +78 -0
- data/lib/aws-sdk-sts/endpoint_provider.rb +112 -0
- data/lib/aws-sdk-sts/endpoints.rb +135 -0
- data/lib/aws-sdk-sts/plugins/endpoints.rb +84 -0
- data/lib/aws-sdk-sts/plugins/sts_regional_endpoints.rb +5 -1
- data/lib/aws-sdk-sts/presigner.rb +13 -9
- data/lib/aws-sdk-sts/types.rb +127 -225
- data/lib/aws-sdk-sts.rb +5 -1
- data/lib/seahorse/client/async_base.rb +0 -1
- data/lib/seahorse/client/configuration.rb +6 -2
- data/lib/seahorse/client/h2/connection.rb +12 -11
- data/lib/seahorse/client/net_http/connection_pool.rb +7 -0
- data/lib/seahorse/client/net_http/handler.rb +15 -7
- data/lib/seahorse/client/net_http/patches.rb +16 -0
- data/lib/seahorse/client/plugins/content_length.rb +11 -5
- data/lib/seahorse/client/plugins/net_http.rb +33 -2
- data/lib/seahorse/client/plugins/request_callback.rb +9 -9
- data/lib/seahorse/model/operation.rb +3 -0
- data/lib/seahorse/util.rb +4 -0
- metadata +61 -9
- data/lib/aws-sdk-sso/plugins/content_type.rb +0 -25
@@ -0,0 +1,135 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module Aws
|
4
|
+
class SSOTokenProvider
|
5
|
+
|
6
|
+
include TokenProvider
|
7
|
+
include RefreshingToken
|
8
|
+
|
9
|
+
# @api private
|
10
|
+
SSO_REQUIRED_OPTS = [:sso_region, :sso_session].freeze
|
11
|
+
|
12
|
+
# @api private
|
13
|
+
SSO_LOGIN_GUIDANCE = 'The SSO session associated with this profile has '\
|
14
|
+
'expired or is otherwise invalid. To refresh this SSO session run '\
|
15
|
+
'aws sso login with the corresponding profile.'.freeze
|
16
|
+
|
17
|
+
# @option options [required, String] :sso_region The AWS region where the
|
18
|
+
# SSO directory for the given sso_start_url is hosted.
|
19
|
+
#
|
20
|
+
# @option options [required, String] :sso_session The SSO Session used to
|
21
|
+
# for fetching this token.
|
22
|
+
#
|
23
|
+
# @option options [SSOOIDC::Client] :client Optional `SSOOIDC::Client`. If not
|
24
|
+
# provided, a client will be constructed.
|
25
|
+
#
|
26
|
+
# @option options [Callable] before_refresh Proc called before
|
27
|
+
# credentials are refreshed. `before_refresh` is called
|
28
|
+
# with an instance of this object when
|
29
|
+
# AWS credentials are required and need to be refreshed.
|
30
|
+
def initialize(options = {})
|
31
|
+
|
32
|
+
missing_keys = SSO_REQUIRED_OPTS.select { |k| options[k].nil? }
|
33
|
+
unless missing_keys.empty?
|
34
|
+
raise ArgumentError, "Missing required keys: #{missing_keys}"
|
35
|
+
end
|
36
|
+
|
37
|
+
@sso_session = options.delete(:sso_session)
|
38
|
+
@sso_region = options.delete(:sso_region)
|
39
|
+
|
40
|
+
options[:region] = @sso_region
|
41
|
+
options[:credentials] = nil
|
42
|
+
options[:token_provider] = nil
|
43
|
+
@client = options[:client] || Aws::SSOOIDC::Client.new(options)
|
44
|
+
|
45
|
+
super
|
46
|
+
end
|
47
|
+
|
48
|
+
# @return [SSOOIDC::Client]
|
49
|
+
attr_reader :client
|
50
|
+
|
51
|
+
private
|
52
|
+
|
53
|
+
def refresh
|
54
|
+
# token is valid and not in refresh window - do not refresh it.
|
55
|
+
return if @token && @token.expiration && !near_expiration?
|
56
|
+
|
57
|
+
# token may not exist or is out of the expiration window
|
58
|
+
# attempt to refresh from disk first (another process/application may have refreshed already)
|
59
|
+
token_json = read_cached_token
|
60
|
+
@token = Token.new(token_json['accessToken'], token_json['expiresAt'])
|
61
|
+
return if @token && @token.expiration && !near_expiration?
|
62
|
+
|
63
|
+
# The token is expired and needs to be refreshed
|
64
|
+
if can_refresh_token?(token_json)
|
65
|
+
begin
|
66
|
+
current_time = Time.now
|
67
|
+
resp = @client.create_token(
|
68
|
+
grant_type: 'refresh_token',
|
69
|
+
client_id: token_json['clientId'],
|
70
|
+
client_secret: token_json['clientSecret'],
|
71
|
+
refresh_token: token_json['refreshToken']
|
72
|
+
)
|
73
|
+
token_json['accessToken'] = resp.access_token
|
74
|
+
token_json['expiresAt'] = current_time + resp.expires_in
|
75
|
+
@token = Token.new(token_json['accessToken'], token_json['expiresAt'])
|
76
|
+
|
77
|
+
if resp.refresh_token
|
78
|
+
token_json['refreshToken'] = resp.refresh_token
|
79
|
+
else
|
80
|
+
token_json.delete('refreshToken')
|
81
|
+
end
|
82
|
+
|
83
|
+
update_token_cache(token_json)
|
84
|
+
rescue
|
85
|
+
# refresh has failed, continue attempting to use the token if its not hard expired
|
86
|
+
end
|
87
|
+
end
|
88
|
+
|
89
|
+
if !@token.expiration || @token.expiration < Time.now
|
90
|
+
# Token is hard expired, raise an exception
|
91
|
+
raise Errors::InvalidSSOToken, 'Token is invalid and failed to refresh.'
|
92
|
+
end
|
93
|
+
end
|
94
|
+
|
95
|
+
def read_cached_token
|
96
|
+
cached_token = Json.load(File.read(sso_cache_file))
|
97
|
+
# validation
|
98
|
+
unless cached_token['accessToken'] && cached_token['expiresAt']
|
99
|
+
raise ArgumentError, 'Missing required field(s)'
|
100
|
+
end
|
101
|
+
cached_token['expiresAt'] = Time.parse(cached_token['expiresAt'])
|
102
|
+
cached_token
|
103
|
+
rescue Errno::ENOENT, Aws::Json::ParseError, ArgumentError
|
104
|
+
raise Errors::InvalidSSOToken, SSO_LOGIN_GUIDANCE
|
105
|
+
end
|
106
|
+
|
107
|
+
def update_token_cache(token_json)
|
108
|
+
cached_token = token_json.dup
|
109
|
+
cached_token['expiresAt'] = cached_token['expiresAt'].iso8601
|
110
|
+
File.write(sso_cache_file, Json.dump(cached_token))
|
111
|
+
end
|
112
|
+
|
113
|
+
def sso_cache_file
|
114
|
+
sso_session_sha1 = OpenSSL::Digest::SHA1.hexdigest(@sso_session.encode('utf-8'))
|
115
|
+
File.join(Dir.home, '.aws', 'sso', 'cache', "#{sso_session_sha1}.json")
|
116
|
+
rescue ArgumentError
|
117
|
+
# Dir.home raises ArgumentError when ENV['home'] is not set
|
118
|
+
raise ArgumentError, "Unable to load sso_cache_file: ENV['HOME'] is not set."
|
119
|
+
end
|
120
|
+
|
121
|
+
# return true if all required fields are present
|
122
|
+
# return false if registrationExpiresAt exists and is later than now
|
123
|
+
def can_refresh_token?(token_json)
|
124
|
+
if token_json['clientId'] &&
|
125
|
+
token_json['clientSecret'] &&
|
126
|
+
token_json['refreshToken']
|
127
|
+
|
128
|
+
return !token_json['registrationExpiresAt'] ||
|
129
|
+
Time.parse(token_json['registrationExpiresAt']) > Time.now
|
130
|
+
else
|
131
|
+
false
|
132
|
+
end
|
133
|
+
end
|
134
|
+
end
|
135
|
+
end
|
@@ -0,0 +1,14 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module Aws
|
4
|
+
class StaticTokenProvider
|
5
|
+
|
6
|
+
include TokenProvider
|
7
|
+
|
8
|
+
# @param [String] token
|
9
|
+
# @param [Time] expiration
|
10
|
+
def initialize(token, expiration=nil)
|
11
|
+
@token = Token.new(token, expiration)
|
12
|
+
end
|
13
|
+
end
|
14
|
+
end
|
@@ -28,18 +28,20 @@ module Aws
|
|
28
28
|
# in stdlib Struct.
|
29
29
|
#
|
30
30
|
# @return [Hash]
|
31
|
-
def to_h(obj = self)
|
31
|
+
def to_h(obj = self, options = {})
|
32
32
|
case obj
|
33
33
|
when Struct
|
34
34
|
obj.each_pair.with_object({}) do |(member, value), hash|
|
35
|
-
|
35
|
+
member = member.to_s if options[:as_json]
|
36
|
+
hash[member] = to_hash(value, options) unless value.nil?
|
36
37
|
end
|
37
38
|
when Hash
|
38
39
|
obj.each.with_object({}) do |(key, value), hash|
|
39
|
-
|
40
|
+
key = key.to_s if options[:as_json]
|
41
|
+
hash[key] = to_hash(value, options)
|
40
42
|
end
|
41
43
|
when Array
|
42
|
-
obj.collect { |value| to_hash(value) }
|
44
|
+
obj.collect { |value| to_hash(value, options) }
|
43
45
|
else
|
44
46
|
obj
|
45
47
|
end
|
@@ -0,0 +1,31 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module Aws
|
4
|
+
class Token
|
5
|
+
|
6
|
+
# @param [String] token
|
7
|
+
# @param [Time] expiration
|
8
|
+
def initialize(token, expiration=nil)
|
9
|
+
@token = token
|
10
|
+
@expiration = expiration
|
11
|
+
end
|
12
|
+
|
13
|
+
# @return [String, nil]
|
14
|
+
attr_reader :token
|
15
|
+
|
16
|
+
# @return [Time, nil]
|
17
|
+
attr_reader :expiration
|
18
|
+
|
19
|
+
# @return [Boolean] Returns `true` if token is set
|
20
|
+
def set?
|
21
|
+
!token.nil? && !token.empty?
|
22
|
+
end
|
23
|
+
|
24
|
+
# Removing the token from the default inspect string.
|
25
|
+
# @api private
|
26
|
+
def inspect
|
27
|
+
"#<#{self.class.name} token=[FILTERED]> expiration=#{expiration}>"
|
28
|
+
end
|
29
|
+
|
30
|
+
end
|
31
|
+
end
|
@@ -0,0 +1,51 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module Aws
|
4
|
+
# @api private
|
5
|
+
class TokenProviderChain
|
6
|
+
def initialize(config = nil)
|
7
|
+
@config = config
|
8
|
+
end
|
9
|
+
|
10
|
+
# @return [TokenProvider, nil]
|
11
|
+
def resolve
|
12
|
+
providers.each do |method_name, options|
|
13
|
+
provider = send(method_name, options.merge(config: @config))
|
14
|
+
return provider if provider && provider.set?
|
15
|
+
end
|
16
|
+
nil
|
17
|
+
end
|
18
|
+
|
19
|
+
private
|
20
|
+
|
21
|
+
def providers
|
22
|
+
[
|
23
|
+
[:static_profile_sso_token, {}],
|
24
|
+
[:sso_token, {}]
|
25
|
+
]
|
26
|
+
end
|
27
|
+
|
28
|
+
def static_profile_sso_token(options)
|
29
|
+
if Aws.shared_config.config_enabled? && options[:config] && options[:config].profile
|
30
|
+
Aws.shared_config.sso_token_from_config(
|
31
|
+
profile: options[:config].profile
|
32
|
+
)
|
33
|
+
end
|
34
|
+
end
|
35
|
+
|
36
|
+
|
37
|
+
def sso_token(options)
|
38
|
+
profile_name = determine_profile_name(options)
|
39
|
+
if Aws.shared_config.config_enabled?
|
40
|
+
Aws.shared_config.sso_token_from_config(profile: profile_name)
|
41
|
+
end
|
42
|
+
rescue Errors::NoSuchProfileError
|
43
|
+
nil
|
44
|
+
end
|
45
|
+
|
46
|
+
def determine_profile_name(options)
|
47
|
+
(options[:config] && options[:config].profile) || ENV['AWS_PROFILE'] || ENV['AWS_DEFAULT_PROFILE'] || 'default'
|
48
|
+
end
|
49
|
+
|
50
|
+
end
|
51
|
+
end
|
@@ -62,7 +62,9 @@ module Aws
|
|
62
62
|
def send_request(options)
|
63
63
|
req = options[:client].build_request(@operation_name, options[:params])
|
64
64
|
req.handlers.remove(RAISE_HANDLER)
|
65
|
-
|
65
|
+
Aws::Plugins::UserAgent.feature('waiter') do
|
66
|
+
req.send_request
|
67
|
+
end
|
66
68
|
end
|
67
69
|
|
68
70
|
def acceptor_matches?(acceptor, response)
|
@@ -24,6 +24,7 @@ module Aws
|
|
24
24
|
else
|
25
25
|
code, message, data = extract_error(body, context)
|
26
26
|
end
|
27
|
+
context[:request_id] = request_id(body)
|
27
28
|
errors_module = context.client.class.errors_module
|
28
29
|
error_class = errors_module.error_class(code).new(context, message, data)
|
29
30
|
error_class
|
@@ -94,6 +95,12 @@ module Aws
|
|
94
95
|
end
|
95
96
|
end
|
96
97
|
|
98
|
+
def request_id(body)
|
99
|
+
if matches = body.match(/<RequestId>(.+?)<\/RequestId>/m)
|
100
|
+
matches[1]
|
101
|
+
end
|
102
|
+
end
|
103
|
+
|
97
104
|
def unescape(str)
|
98
105
|
CGI.unescapeHTML(str)
|
99
106
|
end
|
data/lib/aws-sdk-core.rb
CHANGED
@@ -20,6 +20,15 @@ require_relative 'aws-sdk-core/shared_credentials'
|
|
20
20
|
require_relative 'aws-sdk-core/process_credentials'
|
21
21
|
require_relative 'aws-sdk-core/sso_credentials'
|
22
22
|
|
23
|
+
# tokens and token providers
|
24
|
+
require_relative 'aws-sdk-core/token'
|
25
|
+
require_relative 'aws-sdk-core/token_provider'
|
26
|
+
require_relative 'aws-sdk-core/static_token_provider'
|
27
|
+
require_relative 'aws-sdk-core/refreshing_token'
|
28
|
+
require_relative 'aws-sdk-core/sso_token_provider'
|
29
|
+
require_relative 'aws-sdk-core/token_provider_chain'
|
30
|
+
require_relative 'aws-sdk-core/plugins/bearer_authorization'
|
31
|
+
|
23
32
|
# client modules
|
24
33
|
|
25
34
|
require_relative 'aws-sdk-core/client_stubs'
|
@@ -88,11 +97,22 @@ require_relative 'aws-sdk-core/arn'
|
|
88
97
|
require_relative 'aws-sdk-core/arn_parser'
|
89
98
|
require_relative 'aws-sdk-core/ec2_metadata'
|
90
99
|
|
100
|
+
# dynamic endpoints
|
101
|
+
require_relative 'aws-sdk-core/endpoints'
|
102
|
+
require_relative 'aws-sdk-core/plugins/signature_v4'
|
103
|
+
|
104
|
+
# defaults
|
105
|
+
require_relative 'aws-defaults'
|
106
|
+
|
107
|
+
# plugins
|
108
|
+
# loaded through building STS or SSO ..
|
109
|
+
|
91
110
|
# aws-sdk-sts is included to support Aws::AssumeRoleCredentials
|
92
111
|
require_relative 'aws-sdk-sts'
|
93
112
|
|
94
113
|
# aws-sdk-sso is included to support Aws::SSOCredentials
|
95
114
|
require_relative 'aws-sdk-sso'
|
115
|
+
require_relative 'aws-sdk-ssooidc'
|
96
116
|
|
97
117
|
module Aws
|
98
118
|
|
data/lib/aws-sdk-sso/client.rb
CHANGED
@@ -27,9 +27,11 @@ require 'aws-sdk-core/plugins/client_metrics_plugin.rb'
|
|
27
27
|
require 'aws-sdk-core/plugins/client_metrics_send_plugin.rb'
|
28
28
|
require 'aws-sdk-core/plugins/transfer_encoding.rb'
|
29
29
|
require 'aws-sdk-core/plugins/http_checksum.rb'
|
30
|
-
require 'aws-sdk-core/plugins/
|
30
|
+
require 'aws-sdk-core/plugins/checksum_algorithm.rb'
|
31
|
+
require 'aws-sdk-core/plugins/defaults_mode.rb'
|
32
|
+
require 'aws-sdk-core/plugins/recursion_detection.rb'
|
33
|
+
require 'aws-sdk-core/plugins/sign.rb'
|
31
34
|
require 'aws-sdk-core/plugins/protocols/rest_json.rb'
|
32
|
-
require 'aws-sdk-sso/plugins/content_type.rb'
|
33
35
|
|
34
36
|
Aws::Plugins::GlobalConfiguration.add_identifier(:sso)
|
35
37
|
|
@@ -74,9 +76,12 @@ module Aws::SSO
|
|
74
76
|
add_plugin(Aws::Plugins::ClientMetricsSendPlugin)
|
75
77
|
add_plugin(Aws::Plugins::TransferEncoding)
|
76
78
|
add_plugin(Aws::Plugins::HttpChecksum)
|
77
|
-
add_plugin(Aws::Plugins::
|
79
|
+
add_plugin(Aws::Plugins::ChecksumAlgorithm)
|
80
|
+
add_plugin(Aws::Plugins::DefaultsMode)
|
81
|
+
add_plugin(Aws::Plugins::RecursionDetection)
|
82
|
+
add_plugin(Aws::Plugins::Sign)
|
78
83
|
add_plugin(Aws::Plugins::Protocols::RestJson)
|
79
|
-
add_plugin(Aws::SSO::Plugins::
|
84
|
+
add_plugin(Aws::SSO::Plugins::Endpoints)
|
80
85
|
|
81
86
|
# @overload initialize(options)
|
82
87
|
# @param [Hash] options
|
@@ -121,7 +126,9 @@ module Aws::SSO
|
|
121
126
|
# * EC2/ECS IMDS instance profile - When used by default, the timeouts
|
122
127
|
# are very aggressive. Construct and pass an instance of
|
123
128
|
# `Aws::InstanceProfileCredentails` or `Aws::ECSCredentials` to
|
124
|
-
# enable retries and extended timeouts.
|
129
|
+
# enable retries and extended timeouts. Instance profile credential
|
130
|
+
# fetching can be disabled by setting ENV['AWS_EC2_METADATA_DISABLED']
|
131
|
+
# to true.
|
125
132
|
#
|
126
133
|
# @option options [required, String] :region
|
127
134
|
# The AWS region to connect to. The configured `:region` is
|
@@ -175,6 +182,10 @@ module Aws::SSO
|
|
175
182
|
# Used only in `standard` and adaptive retry modes. Specifies whether to apply
|
176
183
|
# a clock skew correction and retry requests with skewed client clocks.
|
177
184
|
#
|
185
|
+
# @option options [String] :defaults_mode ("legacy")
|
186
|
+
# See {Aws::DefaultsModeConfiguration} for a list of the
|
187
|
+
# accepted modes and the configuration defaults that are included.
|
188
|
+
#
|
178
189
|
# @option options [Boolean] :disable_host_prefix_injection (false)
|
179
190
|
# Set to true to disable SDK automatically adding host prefix
|
180
191
|
# to default service endpoint when available.
|
@@ -264,6 +275,11 @@ module Aws::SSO
|
|
264
275
|
# in the future.
|
265
276
|
#
|
266
277
|
#
|
278
|
+
# @option options [String] :sdk_ua_app_id
|
279
|
+
# A unique and opaque application ID that is appended to the
|
280
|
+
# User-Agent header as app/<sdk_ua_app_id>. It should have a
|
281
|
+
# maximum length of 50.
|
282
|
+
#
|
267
283
|
# @option options [String] :secret_access_key
|
268
284
|
#
|
269
285
|
# @option options [String] :session_token
|
@@ -277,10 +293,35 @@ module Aws::SSO
|
|
277
293
|
# ** Please note ** When response stubbing is enabled, no HTTP
|
278
294
|
# requests are made, and retries are disabled.
|
279
295
|
#
|
296
|
+
# @option options [Aws::TokenProvider] :token_provider
|
297
|
+
# A Bearer Token Provider. This can be an instance of any one of the
|
298
|
+
# following classes:
|
299
|
+
#
|
300
|
+
# * `Aws::StaticTokenProvider` - Used for configuring static, non-refreshing
|
301
|
+
# tokens.
|
302
|
+
#
|
303
|
+
# * `Aws::SSOTokenProvider` - Used for loading tokens from AWS SSO using an
|
304
|
+
# access token generated from `aws login`.
|
305
|
+
#
|
306
|
+
# When `:token_provider` is not configured directly, the `Aws::TokenProviderChain`
|
307
|
+
# will be used to search for tokens configured for your profile in shared configuration files.
|
308
|
+
#
|
309
|
+
# @option options [Boolean] :use_dualstack_endpoint
|
310
|
+
# When set to `true`, dualstack enabled endpoints (with `.aws` TLD)
|
311
|
+
# will be used if available.
|
312
|
+
#
|
313
|
+
# @option options [Boolean] :use_fips_endpoint
|
314
|
+
# When set to `true`, fips compatible endpoints will be used if available.
|
315
|
+
# When a `fips` region is used, the region is normalized and this config
|
316
|
+
# is set to `true`.
|
317
|
+
#
|
280
318
|
# @option options [Boolean] :validate_params (true)
|
281
319
|
# When `true`, request parameters are validated before
|
282
320
|
# sending the request.
|
283
321
|
#
|
322
|
+
# @option options [Aws::SSO::EndpointProvider] :endpoint_provider
|
323
|
+
# The endpoint provider used to resolve endpoints. Any object that responds to `#resolve_endpoint(parameters)` where `parameters` is a Struct similar to `Aws::SSO::EndpointParameters`
|
324
|
+
#
|
284
325
|
# @option options [URI::HTTP,String] :http_proxy A proxy to send
|
285
326
|
# requests through. Formatted like 'http://proxy.com:123'.
|
286
327
|
#
|
@@ -288,7 +329,7 @@ module Aws::SSO
|
|
288
329
|
# seconds to wait when opening a HTTP session before raising a
|
289
330
|
# `Timeout::Error`.
|
290
331
|
#
|
291
|
-
# @option options [
|
332
|
+
# @option options [Float] :http_read_timeout (60) The default
|
292
333
|
# number of seconds to wait for response data. This value can
|
293
334
|
# safely be set per-request on the session.
|
294
335
|
#
|
@@ -304,6 +345,9 @@ module Aws::SSO
|
|
304
345
|
# disables this behaviour. This value can safely be set per
|
305
346
|
# request on the session.
|
306
347
|
#
|
348
|
+
# @option options [Float] :ssl_timeout (nil) Sets the SSL timeout
|
349
|
+
# in seconds.
|
350
|
+
#
|
307
351
|
# @option options [Boolean] :http_wire_trace (false) When `true`,
|
308
352
|
# HTTP debug output will be sent to the `:logger`.
|
309
353
|
#
|
@@ -340,7 +384,8 @@ module Aws::SSO
|
|
340
384
|
#
|
341
385
|
# @option params [required, String] :access_token
|
342
386
|
# The token issued by the `CreateToken` API call. For more information,
|
343
|
-
# see [CreateToken][1] in the *
|
387
|
+
# see [CreateToken][1] in the *IAM Identity Center OIDC API Reference
|
388
|
+
# Guide*.
|
344
389
|
#
|
345
390
|
#
|
346
391
|
#
|
@@ -385,7 +430,8 @@ module Aws::SSO
|
|
385
430
|
#
|
386
431
|
# @option params [required, String] :access_token
|
387
432
|
# The token issued by the `CreateToken` API call. For more information,
|
388
|
-
# see [CreateToken][1] in the *
|
433
|
+
# see [CreateToken][1] in the *IAM Identity Center OIDC API Reference
|
434
|
+
# Guide*.
|
389
435
|
#
|
390
436
|
#
|
391
437
|
#
|
@@ -428,8 +474,8 @@ module Aws::SSO
|
|
428
474
|
|
429
475
|
# Lists all AWS accounts assigned to the user. These AWS accounts are
|
430
476
|
# assigned by the administrator of the account. For more information,
|
431
|
-
# see [Assign User Access][1] in the *
|
432
|
-
# operation returns a paginated response.
|
477
|
+
# see [Assign User Access][1] in the *IAM Identity Center User Guide*.
|
478
|
+
# This operation returns a paginated response.
|
433
479
|
#
|
434
480
|
#
|
435
481
|
#
|
@@ -444,7 +490,8 @@ module Aws::SSO
|
|
444
490
|
#
|
445
491
|
# @option params [required, String] :access_token
|
446
492
|
# The token issued by the `CreateToken` API call. For more information,
|
447
|
-
# see [CreateToken][1] in the *
|
493
|
+
# see [CreateToken][1] in the *IAM Identity Center OIDC API Reference
|
494
|
+
# Guide*.
|
448
495
|
#
|
449
496
|
#
|
450
497
|
#
|
@@ -482,12 +529,32 @@ module Aws::SSO
|
|
482
529
|
req.send_request(options)
|
483
530
|
end
|
484
531
|
|
485
|
-
# Removes the
|
486
|
-
# the
|
532
|
+
# Removes the locally stored SSO tokens from the client-side cache and
|
533
|
+
# sends an API call to the IAM Identity Center service to invalidate the
|
534
|
+
# corresponding server-side IAM Identity Center sign in session.
|
535
|
+
#
|
536
|
+
# <note markdown="1"> If a user uses IAM Identity Center to access the AWS CLI, the user’s
|
537
|
+
# IAM Identity Center sign in session is used to obtain an IAM session,
|
538
|
+
# as specified in the corresponding IAM Identity Center permission set.
|
539
|
+
# More specifically, IAM Identity Center assumes an IAM role in the
|
540
|
+
# target account on behalf of the user, and the corresponding temporary
|
541
|
+
# AWS credentials are returned to the client.
|
542
|
+
#
|
543
|
+
# After user logout, any existing IAM role sessions that were created by
|
544
|
+
# using IAM Identity Center permission sets continue based on the
|
545
|
+
# duration configured in the permission set. For more information, see
|
546
|
+
# [User authentications][1] in the *IAM Identity Center User Guide*.
|
547
|
+
#
|
548
|
+
# </note>
|
549
|
+
#
|
550
|
+
#
|
551
|
+
#
|
552
|
+
# [1]: https://docs.aws.amazon.com/singlesignon/latest/userguide/authconcept.html
|
487
553
|
#
|
488
554
|
# @option params [required, String] :access_token
|
489
555
|
# The token issued by the `CreateToken` API call. For more information,
|
490
|
-
# see [CreateToken][1] in the *
|
556
|
+
# see [CreateToken][1] in the *IAM Identity Center OIDC API Reference
|
557
|
+
# Guide*.
|
491
558
|
#
|
492
559
|
#
|
493
560
|
#
|
@@ -523,7 +590,7 @@ module Aws::SSO
|
|
523
590
|
params: params,
|
524
591
|
config: config)
|
525
592
|
context[:gem_name] = 'aws-sdk-core'
|
526
|
-
context[:gem_version] = '3.
|
593
|
+
context[:gem_version] = '3.174.0'
|
527
594
|
Seahorse::Client::Request.new(handlers, context)
|
528
595
|
end
|
529
596
|
|
@@ -0,0 +1,66 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
# WARNING ABOUT GENERATED CODE
|
4
|
+
#
|
5
|
+
# This file is generated. See the contributing guide for more information:
|
6
|
+
# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
|
7
|
+
#
|
8
|
+
# WARNING ABOUT GENERATED CODE
|
9
|
+
|
10
|
+
module Aws::SSO
|
11
|
+
# Endpoint parameters used to influence endpoints per request.
|
12
|
+
#
|
13
|
+
# @!attribute region
|
14
|
+
# The AWS region used to dispatch the request.
|
15
|
+
#
|
16
|
+
# @return [String]
|
17
|
+
#
|
18
|
+
# @!attribute use_dual_stack
|
19
|
+
# When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.
|
20
|
+
#
|
21
|
+
# @return [Boolean]
|
22
|
+
#
|
23
|
+
# @!attribute use_fips
|
24
|
+
# When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.
|
25
|
+
#
|
26
|
+
# @return [Boolean]
|
27
|
+
#
|
28
|
+
# @!attribute endpoint
|
29
|
+
# Override the endpoint used to send this request
|
30
|
+
#
|
31
|
+
# @return [String]
|
32
|
+
#
|
33
|
+
EndpointParameters = Struct.new(
|
34
|
+
:region,
|
35
|
+
:use_dual_stack,
|
36
|
+
:use_fips,
|
37
|
+
:endpoint,
|
38
|
+
) do
|
39
|
+
include Aws::Structure
|
40
|
+
|
41
|
+
# @api private
|
42
|
+
class << self
|
43
|
+
PARAM_MAP = {
|
44
|
+
'Region' => :region,
|
45
|
+
'UseDualStack' => :use_dual_stack,
|
46
|
+
'UseFIPS' => :use_fips,
|
47
|
+
'Endpoint' => :endpoint,
|
48
|
+
}.freeze
|
49
|
+
end
|
50
|
+
|
51
|
+
def initialize(options = {})
|
52
|
+
self[:region] = options[:region]
|
53
|
+
self[:use_dual_stack] = options[:use_dual_stack]
|
54
|
+
self[:use_dual_stack] = false if self[:use_dual_stack].nil?
|
55
|
+
if self[:use_dual_stack].nil?
|
56
|
+
raise ArgumentError, "Missing required EndpointParameter: :use_dual_stack"
|
57
|
+
end
|
58
|
+
self[:use_fips] = options[:use_fips]
|
59
|
+
self[:use_fips] = false if self[:use_fips].nil?
|
60
|
+
if self[:use_fips].nil?
|
61
|
+
raise ArgumentError, "Missing required EndpointParameter: :use_fips"
|
62
|
+
end
|
63
|
+
self[:endpoint] = options[:endpoint]
|
64
|
+
end
|
65
|
+
end
|
66
|
+
end
|