aws-sdk-core 3.170.0 → 3.175.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +52 -0
- data/VERSION +1 -1
- data/lib/aws-defaults/default_configuration.rb +4 -4
- data/lib/aws-sdk-core/credential_provider_chain.rb +2 -1
- data/lib/aws-sdk-core/ecs_credentials.rb +111 -53
- data/lib/aws-sdk-core/json/error_handler.rb +15 -5
- data/lib/aws-sdk-core/log/formatter.rb +6 -0
- data/lib/aws-sdk-core/pageable_response.rb +3 -1
- data/lib/aws-sdk-core/plugins/checksum_algorithm.rb +1 -1
- data/lib/aws-sdk-core/plugins/user_agent.rb +117 -14
- data/lib/aws-sdk-core/shared_config.rb +2 -1
- data/lib/aws-sdk-core/waiters/poller.rb +3 -1
- data/lib/aws-sdk-sso/client.rb +6 -1
- data/lib/aws-sdk-sso/endpoints.rb +1 -0
- data/lib/aws-sdk-sso.rb +1 -1
- data/lib/aws-sdk-ssooidc/client.rb +6 -1
- data/lib/aws-sdk-ssooidc/endpoints.rb +1 -0
- data/lib/aws-sdk-ssooidc.rb +1 -1
- data/lib/aws-sdk-sts/client.rb +111 -110
- data/lib/aws-sdk-sts/endpoint_provider.rb +81 -78
- data/lib/aws-sdk-sts/endpoints.rb +1 -0
- data/lib/aws-sdk-sts/types.rb +8 -9
- data/lib/aws-sdk-sts.rb +1 -1
- data/lib/seahorse/client/h2/connection.rb +10 -6
- metadata +2 -2
data/lib/aws-sdk-ssooidc.rb
CHANGED
data/lib/aws-sdk-sts/client.rb
CHANGED
@@ -277,6 +277,11 @@ module Aws::STS
|
|
277
277
|
# in the future.
|
278
278
|
#
|
279
279
|
#
|
280
|
+
# @option options [String] :sdk_ua_app_id
|
281
|
+
# A unique and opaque application ID that is appended to the
|
282
|
+
# User-Agent header as app/<sdk_ua_app_id>. It should have a
|
283
|
+
# maximum length of 50.
|
284
|
+
#
|
280
285
|
# @option options [String] :secret_access_key
|
281
286
|
#
|
282
287
|
# @option options [String] :session_token
|
@@ -406,10 +411,11 @@ module Aws::STS
|
|
406
411
|
# identity-based policy of the role that is being assumed. For more
|
407
412
|
# information, see [Session Policies][3] in the *IAM User Guide*.
|
408
413
|
#
|
409
|
-
# When you create a role, you create two policies:
|
410
|
-
# that specifies *who* can assume the role and a permissions policy
|
411
|
-
# specifies *what* can be done with the role. You specify the
|
412
|
-
# principal
|
414
|
+
# When you create a role, you create two policies: a role trust policy
|
415
|
+
# that specifies *who* can assume the role, and a permissions policy
|
416
|
+
# that specifies *what* can be done with the role. You specify the
|
417
|
+
# trusted principal that is allowed to assume the role in the role trust
|
418
|
+
# policy.
|
413
419
|
#
|
414
420
|
# To assume a role from a different account, your Amazon Web Services
|
415
421
|
# account must be trusted by the role. The trust relationship is defined
|
@@ -418,10 +424,9 @@ module Aws::STS
|
|
418
424
|
# users in the account.
|
419
425
|
#
|
420
426
|
# A user who wants to access a role in a different account must also
|
421
|
-
# have permissions that are delegated from the
|
422
|
-
#
|
423
|
-
#
|
424
|
-
# account.
|
427
|
+
# have permissions that are delegated from the account administrator.
|
428
|
+
# The administrator must attach a policy that allows the user to call
|
429
|
+
# `AssumeRole` for the ARN of the role in the other account.
|
425
430
|
#
|
426
431
|
# To allow a user to assume a role in the same account, you can do
|
427
432
|
# either of the following:
|
@@ -1206,10 +1211,8 @@ module Aws::STS
|
|
1206
1211
|
# the user with a consistent identity throughout the lifetime of an
|
1207
1212
|
# application.
|
1208
1213
|
#
|
1209
|
-
# To learn more about Amazon Cognito, see [Amazon Cognito
|
1210
|
-
# in *Amazon
|
1211
|
-
# Cognito Overview][5] in the *Amazon Web Services SDK for iOS Developer
|
1212
|
-
# Guide*.
|
1214
|
+
# To learn more about Amazon Cognito, see [Amazon Cognito identity
|
1215
|
+
# pools][1] in *Amazon Cognito Developer Guide*.
|
1213
1216
|
#
|
1214
1217
|
# </note>
|
1215
1218
|
#
|
@@ -1223,8 +1226,8 @@ module Aws::STS
|
|
1223
1226
|
# a token from the web identity provider. For a comparison of
|
1224
1227
|
# `AssumeRoleWithWebIdentity` with the other API operations that produce
|
1225
1228
|
# temporary credentials, see [Requesting Temporary Security
|
1226
|
-
# Credentials][
|
1227
|
-
# operations][
|
1229
|
+
# Credentials][4] and [Comparing the Amazon Web Services STS API
|
1230
|
+
# operations][5] in the *IAM User Guide*.
|
1228
1231
|
#
|
1229
1232
|
# The temporary security credentials returned by this API consist of an
|
1230
1233
|
# access key ID, a secret access key, and a security token. Applications
|
@@ -1240,11 +1243,11 @@ module Aws::STS
|
|
1240
1243
|
# to the maximum session duration setting for the role. This setting can
|
1241
1244
|
# have a value from 1 hour to 12 hours. To learn how to view the maximum
|
1242
1245
|
# value for your role, see [View the Maximum Session Duration Setting
|
1243
|
-
# for a Role][
|
1246
|
+
# for a Role][6] in the *IAM User Guide*. The maximum session duration
|
1244
1247
|
# limit applies when you use the `AssumeRole*` API operations or the
|
1245
1248
|
# `assume-role*` CLI commands. However the limit does not apply when you
|
1246
1249
|
# use those operations to create a console URL. For more information,
|
1247
|
-
# see [Using IAM Roles][
|
1250
|
+
# see [Using IAM Roles][7] in the *IAM User Guide*.
|
1248
1251
|
#
|
1249
1252
|
# **Permissions**
|
1250
1253
|
#
|
@@ -1253,7 +1256,7 @@ module Aws::STS
|
|
1253
1256
|
# Amazon Web Services service with the following exception: you cannot
|
1254
1257
|
# call the STS `GetFederationToken` or `GetSessionToken` API operations.
|
1255
1258
|
#
|
1256
|
-
# (Optional) You can pass inline or managed [session policies][
|
1259
|
+
# (Optional) You can pass inline or managed [session policies][8] to
|
1257
1260
|
# this operation. You can pass a single JSON policy document to use as
|
1258
1261
|
# an inline session policy. You can also specify up to 10 managed policy
|
1259
1262
|
# Amazon Resource Names (ARNs) to use as managed session policies. The
|
@@ -1266,19 +1269,19 @@ module Aws::STS
|
|
1266
1269
|
# resources in the account that owns the role. You cannot use session
|
1267
1270
|
# policies to grant more permissions than those allowed by the
|
1268
1271
|
# identity-based policy of the role that is being assumed. For more
|
1269
|
-
# information, see [Session Policies][
|
1272
|
+
# information, see [Session Policies][8] in the *IAM User Guide*.
|
1270
1273
|
#
|
1271
1274
|
# **Tags**
|
1272
1275
|
#
|
1273
1276
|
# (Optional) You can configure your IdP to pass attributes into your web
|
1274
1277
|
# identity token as session tags. Each session tag consists of a key
|
1275
1278
|
# name and an associated value. For more information about session tags,
|
1276
|
-
# see [Passing Session Tags in STS][
|
1279
|
+
# see [Passing Session Tags in STS][9] in the *IAM User Guide*.
|
1277
1280
|
#
|
1278
1281
|
# You can pass up to 50 session tags. The plaintext session tag keys
|
1279
1282
|
# can’t exceed 128 characters and the values can’t exceed 256
|
1280
1283
|
# characters. For these and additional limits, see [IAM and STS
|
1281
|
-
# Character Limits][
|
1284
|
+
# Character Limits][10] in the *IAM User Guide*.
|
1282
1285
|
#
|
1283
1286
|
# <note markdown="1"> An Amazon Web Services conversion compresses the passed inline session
|
1284
1287
|
# policy, managed policy ARNs, and session tags into a packed binary
|
@@ -1296,12 +1299,12 @@ module Aws::STS
|
|
1296
1299
|
# An administrator must grant you the permissions necessary to pass
|
1297
1300
|
# session tags. The administrator can also create granular permissions
|
1298
1301
|
# to allow you to pass only specific session tags. For more information,
|
1299
|
-
# see [Tutorial: Using Tags for Attribute-Based Access Control][
|
1302
|
+
# see [Tutorial: Using Tags for Attribute-Based Access Control][11] in
|
1300
1303
|
# the *IAM User Guide*.
|
1301
1304
|
#
|
1302
1305
|
# You can set the session tags as transitive. Transitive tags persist
|
1303
1306
|
# during role chaining. For more information, see [Chaining Roles with
|
1304
|
-
# Session Tags][
|
1307
|
+
# Session Tags][12] in the *IAM User Guide*.
|
1305
1308
|
#
|
1306
1309
|
# **Identities**
|
1307
1310
|
#
|
@@ -1313,19 +1316,19 @@ module Aws::STS
|
|
1313
1316
|
# specified in the role's trust policy.
|
1314
1317
|
#
|
1315
1318
|
# Calling `AssumeRoleWithWebIdentity` can result in an entry in your
|
1316
|
-
# CloudTrail logs. The entry includes the [Subject][
|
1319
|
+
# CloudTrail logs. The entry includes the [Subject][13] of the provided
|
1317
1320
|
# web identity token. We recommend that you avoid using any personally
|
1318
1321
|
# identifiable information (PII) in this field. For example, you could
|
1319
1322
|
# instead use a GUID or a pairwise identifier, as [suggested in the OIDC
|
1320
|
-
# specification][
|
1323
|
+
# specification][14].
|
1321
1324
|
#
|
1322
1325
|
# For more information about how to use web identity federation and the
|
1323
1326
|
# `AssumeRoleWithWebIdentity` API, see the following resources:
|
1324
1327
|
#
|
1325
|
-
# * [Using Web Identity Federation API Operations for Mobile Apps][
|
1326
|
-
# and [Federation Through a Web-based Identity Provider][
|
1328
|
+
# * [Using Web Identity Federation API Operations for Mobile Apps][15]
|
1329
|
+
# and [Federation Through a Web-based Identity Provider][16].
|
1327
1330
|
#
|
1328
|
-
# * [ Web Identity Federation Playground][
|
1331
|
+
# * [ Web Identity Federation Playground][17]. Walk through the process
|
1329
1332
|
# of authenticating through Login with Amazon, Facebook, or Google,
|
1330
1333
|
# getting temporary security credentials, and then using those
|
1331
1334
|
# credentials to make a request to Amazon Web Services.
|
@@ -1336,7 +1339,7 @@ module Aws::STS
|
|
1336
1339
|
# toolkits then show how to use the information from these providers
|
1337
1340
|
# to get and use temporary security credentials.
|
1338
1341
|
#
|
1339
|
-
# * [Web Identity Federation with Mobile Applications][
|
1342
|
+
# * [Web Identity Federation with Mobile Applications][18]. This article
|
1340
1343
|
# discusses web identity federation and shows an example of how to use
|
1341
1344
|
# web identity federation to get access to content in Amazon S3.
|
1342
1345
|
#
|
@@ -1345,23 +1348,21 @@ module Aws::STS
|
|
1345
1348
|
# [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html
|
1346
1349
|
# [2]: http://aws.amazon.com/sdkforios/
|
1347
1350
|
# [3]: http://aws.amazon.com/sdkforandroid/
|
1348
|
-
# [4]: https://docs.aws.amazon.com/
|
1349
|
-
# [5]: https://docs.aws.amazon.com/
|
1350
|
-
# [6]: https://docs.aws.amazon.com/IAM/latest/UserGuide/
|
1351
|
-
# [7]: https://docs.aws.amazon.com/IAM/latest/UserGuide/
|
1352
|
-
# [8]: https://docs.aws.amazon.com/IAM/latest/UserGuide/
|
1353
|
-
# [9]: https://docs.aws.amazon.com/IAM/latest/UserGuide/
|
1354
|
-
# [10]: https://docs.aws.amazon.com/IAM/latest/UserGuide/
|
1355
|
-
# [11]: https://docs.aws.amazon.com/IAM/latest/UserGuide/
|
1356
|
-
# [12]: https://docs.aws.amazon.com/IAM/latest/UserGuide/
|
1357
|
-
# [13]:
|
1358
|
-
# [14]:
|
1359
|
-
# [15]:
|
1360
|
-
# [16]:
|
1361
|
-
# [17]: https://
|
1362
|
-
# [18]:
|
1363
|
-
# [19]: https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/
|
1364
|
-
# [20]: http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications
|
1351
|
+
# [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html
|
1352
|
+
# [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison
|
1353
|
+
# [6]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session
|
1354
|
+
# [7]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html
|
1355
|
+
# [8]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session
|
1356
|
+
# [9]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html
|
1357
|
+
# [10]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length
|
1358
|
+
# [11]: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html
|
1359
|
+
# [12]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining
|
1360
|
+
# [13]: http://openid.net/specs/openid-connect-core-1_0.html#Claims
|
1361
|
+
# [14]: http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
|
1362
|
+
# [15]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html
|
1363
|
+
# [16]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity
|
1364
|
+
# [17]: https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/
|
1365
|
+
# [18]: http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications
|
1365
1366
|
#
|
1366
1367
|
# @option params [required, String] :role_arn
|
1367
1368
|
# The Amazon Resource Name (ARN) of the role that the caller is
|
@@ -1720,11 +1721,11 @@ module Aws::STS
|
|
1720
1721
|
# to call the operation.
|
1721
1722
|
#
|
1722
1723
|
# <note markdown="1"> No permissions are required to perform this operation. If an
|
1723
|
-
# administrator
|
1724
|
+
# administrator attaches a policy to your identity that explicitly
|
1724
1725
|
# denies access to the `sts:GetCallerIdentity` action, you can still
|
1725
1726
|
# perform this operation. Permissions are not required because the same
|
1726
|
-
# information is returned when
|
1727
|
-
#
|
1727
|
+
# information is returned when access is denied. To view an example
|
1728
|
+
# response, see [I Am Not Authorized to Perform:
|
1728
1729
|
# iam:DeleteVirtualMFADevice][1] in the *IAM User Guide*.
|
1729
1730
|
#
|
1730
1731
|
# </note>
|
@@ -1801,43 +1802,43 @@ module Aws::STS
|
|
1801
1802
|
end
|
1802
1803
|
|
1803
1804
|
# Returns a set of temporary security credentials (consisting of an
|
1804
|
-
# access key ID, a secret access key, and a security token) for a
|
1805
|
-
#
|
1806
|
-
#
|
1807
|
-
#
|
1808
|
-
#
|
1809
|
-
#
|
1810
|
-
#
|
1811
|
-
#
|
1812
|
-
#
|
1805
|
+
# access key ID, a secret access key, and a security token) for a user.
|
1806
|
+
# A typical use is in a proxy application that gets temporary security
|
1807
|
+
# credentials on behalf of distributed applications inside a corporate
|
1808
|
+
# network.
|
1809
|
+
#
|
1810
|
+
# You must call the `GetFederationToken` operation using the long-term
|
1811
|
+
# security credentials of an IAM user. As a result, this call is
|
1812
|
+
# appropriate in contexts where those credentials can be safeguarded,
|
1813
|
+
# usually in a server-based application. For a comparison of
|
1814
|
+
# `GetFederationToken` with the other API operations that produce
|
1815
|
+
# temporary credentials, see [Requesting Temporary Security
|
1813
1816
|
# Credentials][1] and [Comparing the Amazon Web Services STS API
|
1814
1817
|
# operations][2] in the *IAM User Guide*.
|
1815
1818
|
#
|
1819
|
+
# Although it is possible to call `GetFederationToken` using the
|
1820
|
+
# security credentials of an Amazon Web Services account root user
|
1821
|
+
# rather than an IAM user that you create for the purpose of a proxy
|
1822
|
+
# application, we do not recommend it. For more information, see
|
1823
|
+
# [Safeguard your root user credentials and don't use them for everyday
|
1824
|
+
# tasks][3] in the *IAM User Guide*.
|
1825
|
+
#
|
1816
1826
|
# <note markdown="1"> You can create a mobile-based or browser-based app that can
|
1817
1827
|
# authenticate users using a web identity provider like Login with
|
1818
1828
|
# Amazon, Facebook, Google, or an OpenID Connect-compatible identity
|
1819
|
-
# provider. In this case, we recommend that you use [Amazon Cognito][
|
1829
|
+
# provider. In this case, we recommend that you use [Amazon Cognito][4]
|
1820
1830
|
# or `AssumeRoleWithWebIdentity`. For more information, see [Federation
|
1821
|
-
# Through a Web-based Identity Provider][
|
1831
|
+
# Through a Web-based Identity Provider][5] in the *IAM User Guide*.
|
1822
1832
|
#
|
1823
1833
|
# </note>
|
1824
1834
|
#
|
1825
|
-
# You can also call `GetFederationToken` using the security credentials
|
1826
|
-
# of an Amazon Web Services account root user, but we do not recommend
|
1827
|
-
# it. Instead, we recommend that you create an IAM user for the purpose
|
1828
|
-
# of the proxy application. Then attach a policy to the IAM user that
|
1829
|
-
# limits federated users to only the actions and resources that they
|
1830
|
-
# need to access. For more information, see [IAM Best Practices][5] in
|
1831
|
-
# the *IAM User Guide*.
|
1832
|
-
#
|
1833
1835
|
# **Session duration**
|
1834
1836
|
#
|
1835
1837
|
# The temporary credentials are valid for the specified duration, from
|
1836
1838
|
# 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36
|
1837
1839
|
# hours). The default session duration is 43,200 seconds (12 hours).
|
1838
|
-
# Temporary credentials obtained by using the
|
1839
|
-
#
|
1840
|
-
# (1 hour).
|
1840
|
+
# Temporary credentials obtained by using the root user credentials have
|
1841
|
+
# a maximum duration of 3,600 seconds (1 hour).
|
1841
1842
|
#
|
1842
1843
|
# **Permissions**
|
1843
1844
|
#
|
@@ -1887,9 +1888,9 @@ module Aws::STS
|
|
1887
1888
|
# <note markdown="1"> You can create a mobile-based or browser-based app that can
|
1888
1889
|
# authenticate users using a web identity provider like Login with
|
1889
1890
|
# Amazon, Facebook, Google, or an OpenID Connect-compatible identity
|
1890
|
-
# provider. In this case, we recommend that you use [Amazon Cognito][
|
1891
|
+
# provider. In this case, we recommend that you use [Amazon Cognito][4]
|
1891
1892
|
# or `AssumeRoleWithWebIdentity`. For more information, see [Federation
|
1892
|
-
# Through a Web-based Identity Provider][
|
1893
|
+
# Through a Web-based Identity Provider][5] in the *IAM User Guide*.
|
1893
1894
|
#
|
1894
1895
|
# </note>
|
1895
1896
|
#
|
@@ -1911,9 +1912,9 @@ module Aws::STS
|
|
1911
1912
|
#
|
1912
1913
|
# [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html
|
1913
1914
|
# [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison
|
1914
|
-
# [3]:
|
1915
|
-
# [4]:
|
1916
|
-
# [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/
|
1915
|
+
# [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials
|
1916
|
+
# [4]: http://aws.amazon.com/cognito/
|
1917
|
+
# [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity
|
1917
1918
|
# [6]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session
|
1918
1919
|
# [7]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken
|
1919
1920
|
# [8]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html
|
@@ -2030,10 +2031,10 @@ module Aws::STS
|
|
2030
2031
|
# The duration, in seconds, that the session should last. Acceptable
|
2031
2032
|
# durations for federation sessions range from 900 seconds (15 minutes)
|
2032
2033
|
# to 129,600 seconds (36 hours), with 43,200 seconds (12 hours) as the
|
2033
|
-
# default. Sessions obtained using
|
2034
|
-
#
|
2035
|
-
#
|
2036
|
-
#
|
2034
|
+
# default. Sessions obtained using root user credentials are restricted
|
2035
|
+
# to a maximum of 3,600 seconds (one hour). If the specified duration is
|
2036
|
+
# longer than one hour, the session obtained by using root user
|
2037
|
+
# credentials defaults to one hour.
|
2037
2038
|
#
|
2038
2039
|
# @option params [Array<Types::Tag>] :tags
|
2039
2040
|
# A list of session tags. Each session tag consists of a key name and an
|
@@ -2153,14 +2154,15 @@ module Aws::STS
|
|
2153
2154
|
# secret access key, and a security token. Typically, you use
|
2154
2155
|
# `GetSessionToken` if you want to use MFA to protect programmatic calls
|
2155
2156
|
# to specific Amazon Web Services API operations like Amazon EC2
|
2156
|
-
# `StopInstances`.
|
2157
|
-
#
|
2158
|
-
# MFA
|
2159
|
-
#
|
2160
|
-
#
|
2161
|
-
#
|
2162
|
-
#
|
2163
|
-
#
|
2157
|
+
# `StopInstances`.
|
2158
|
+
#
|
2159
|
+
# MFA-enabled IAM users must call `GetSessionToken` and submit an MFA
|
2160
|
+
# code that is associated with their MFA device. Using the temporary
|
2161
|
+
# security credentials that the call returns, IAM users can then make
|
2162
|
+
# programmatic calls to API operations that require MFA authentication.
|
2163
|
+
# An incorrect MFA code causes the API to return an access denied error.
|
2164
|
+
# For a comparison of `GetSessionToken` with the other API operations
|
2165
|
+
# that produce temporary credentials, see [Requesting Temporary Security
|
2164
2166
|
# Credentials][1] and [Comparing the Amazon Web Services STS API
|
2165
2167
|
# operations][2] in the *IAM User Guide*.
|
2166
2168
|
#
|
@@ -2175,13 +2177,13 @@ module Aws::STS
|
|
2175
2177
|
# **Session Duration**
|
2176
2178
|
#
|
2177
2179
|
# The `GetSessionToken` operation must be called by using the long-term
|
2178
|
-
# Amazon Web Services security credentials of
|
2179
|
-
#
|
2180
|
-
#
|
2181
|
-
#
|
2182
|
-
# (
|
2183
|
-
#
|
2184
|
-
#
|
2180
|
+
# Amazon Web Services security credentials of an IAM user. Credentials
|
2181
|
+
# that are created by IAM users are valid for the duration that you
|
2182
|
+
# specify. This duration can range from 900 seconds (15 minutes) up to a
|
2183
|
+
# maximum of 129,600 seconds (36 hours), with a default of 43,200
|
2184
|
+
# seconds (12 hours). Credentials based on account credentials can range
|
2185
|
+
# from 900 seconds (15 minutes) up to 3,600 seconds (1 hour), with a
|
2186
|
+
# default of 1 hour.
|
2185
2187
|
#
|
2186
2188
|
# **Permissions**
|
2187
2189
|
#
|
@@ -2195,24 +2197,23 @@ module Aws::STS
|
|
2195
2197
|
# * You cannot call any STS API *except* `AssumeRole` or
|
2196
2198
|
# `GetCallerIdentity`.
|
2197
2199
|
#
|
2198
|
-
#
|
2199
|
-
#
|
2200
|
-
#
|
2201
|
-
#
|
2202
|
-
# with Amazon Web Services.
|
2200
|
+
# The credentials that `GetSessionToken` returns are based on
|
2201
|
+
# permissions associated with the IAM user whose credentials were used
|
2202
|
+
# to call the operation. The temporary credentials have the same
|
2203
|
+
# permissions as the IAM user.
|
2203
2204
|
#
|
2204
|
-
#
|
2205
|
+
# <note markdown="1"> Although it is possible to call `GetSessionToken` using the security
|
2206
|
+
# credentials of an Amazon Web Services account root user rather than an
|
2207
|
+
# IAM user, we do not recommend it. If `GetSessionToken` is called using
|
2208
|
+
# root user credentials, the temporary credentials have root user
|
2209
|
+
# permissions. For more information, see [Safeguard your root user
|
2210
|
+
# credentials and don't use them for everyday tasks][4] in the *IAM
|
2211
|
+
# User Guide*
|
2205
2212
|
#
|
2206
|
-
#
|
2207
|
-
# permissions associated with the user whose credentials were used to
|
2208
|
-
# call the operation. If `GetSessionToken` is called using Amazon Web
|
2209
|
-
# Services account root user credentials, the temporary credentials have
|
2210
|
-
# root user permissions. Similarly, if `GetSessionToken` is called using
|
2211
|
-
# the credentials of an IAM user, the temporary credentials have the
|
2212
|
-
# same permissions as the IAM user.
|
2213
|
+
# </note>
|
2213
2214
|
#
|
2214
2215
|
# For more information about using `GetSessionToken` to create temporary
|
2215
|
-
# credentials,
|
2216
|
+
# credentials, see [Temporary Credentials for Users in Untrusted
|
2216
2217
|
# Environments][5] in the *IAM User Guide*.
|
2217
2218
|
#
|
2218
2219
|
#
|
@@ -2220,7 +2221,7 @@ module Aws::STS
|
|
2220
2221
|
# [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html
|
2221
2222
|
# [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison
|
2222
2223
|
# [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html
|
2223
|
-
# [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#
|
2224
|
+
# [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials
|
2224
2225
|
# [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken
|
2225
2226
|
#
|
2226
2227
|
# @option params [Integer] :duration_seconds
|
@@ -2318,7 +2319,7 @@ module Aws::STS
|
|
2318
2319
|
params: params,
|
2319
2320
|
config: config)
|
2320
2321
|
context[:gem_name] = 'aws-sdk-core'
|
2321
|
-
context[:gem_version] = '3.
|
2322
|
+
context[:gem_version] = '3.175.0'
|
2322
2323
|
Seahorse::Client::Request.new(handlers, context)
|
2323
2324
|
end
|
2324
2325
|
|