aws-sdk-core 3.249.0 → 3.252.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2aac2c3b838ca898d180060ba1aa813c6740d469757e723cc332aae9b82efa64
-  data.tar.gz: 4f82adb4f30c65c745fb87a780339735dbeb081d7c63a06410737279f13ffd64
+  metadata.gz: 96694b8f2f5836a441a97a28c54192ac0c7ecd4bc17ce0e7f38aa1979f4b44ce
+  data.tar.gz: 22beaae2d0474238fb04148a1b388ce0de31efa1f8f2ac5c7daff1315cfbb44f
 SHA512:
-  metadata.gz: 5dff30a277439874f787c39903d37c9571969fbd0f883a1039eb1ea75260d8454f6c77477917e9e660fd426905e1dee67000ac7136bd39f0d28110558aaf00d8
-  data.tar.gz: 321a1cb89e250911a05166a6d39575b099f7822c130207455091bdb76d14028ba739d6d1bbdfc9fc0e68fc7f49e6cc7a4e785533e6d156b84d68e6447f08b5cd
+  metadata.gz: 40fa25ff493916dd88b63b5bc77f18675e066fbf74a38773adee76b1ec6b4376430d03fb53697ddb0759e11c41815e54c7e30bba71cd0622571f1ae18a47a2d8
+  data.tar.gz: c81b88488d9029025ecec32d86b9fd83ae71b8e144025eaf859227e75996d8f9b1bce06ee375de7f9ac00eea06d36a48744f79b49db4ab3b636596fbcf2a8d19

data/CHANGELOG.md

@@ -1,6 +1,25 @@
 Unreleased Changes
 ------------------
 
+3.252.0 (2026-06-10)
+------------------
+
+* Feature - Updated Aws::Signin::Client with the latest API changes.
+
+* Feature - AWS Sign-In now allows customers to control access to the AWS Management Console using resource-based policies. With this release customers can restrict console access based on network perimeters such as VPC IDs, VPC endpoints, and IP addresses.
+
+3.251.0 (2026-06-02)
+------------------
+
+* Feature - Adding new BDD representation of endpoint ruleset
+
+3.250.0 (2026-05-28)
+------------------
+
+* Feature - Adding new BDD representation of endpoint ruleset
+
+* Issue - Prevent unbounded recursion in CBOR decoder that could cause process termination on malformed responses.
+
 3.249.0 (2026-05-22)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-3.249.0
+3.252.0

data/lib/aws-sdk-core/cbor/decoder.rb

@@ -7,6 +7,7 @@ module Aws
       def initialize(bytes)
         @buffer = bytes
         @pos = 0
+        @depth = 0
       end
 
       def decode
@@ -25,10 +26,14 @@ module Aws
       TAG_TYPE_BIGNUM = 2
       TAG_TYPE_NEG_BIGNUM = 3
       TAG_TYPE_BIGDEC = 4
+      MAX_DEPTH = 128 # Value chosen to match other SDKs
 
       # high level, generic decode. Based on the next type. Consumes and returns
       # the next item as a ruby object.
       def decode_item
+        @depth += 1
+        raise Error, "Maximum nesting depth (#{MAX_DEPTH}) exceeded" if @depth > MAX_DEPTH
+
         case (next_type = peek_type)
         when :array
           read_array.times.map { decode_item }
@@ -75,6 +80,8 @@ module Aws
         else
           send("read_#{next_type}")
         end
+      ensure
+        @depth -= 1
       end
 
       # low level streaming interface
@@ -121,8 +128,7 @@ module Aws
         when 0 then val
         when 1 then -1 - val
         else
-          raise Error,
-                "Expected Integer (0,1) got major type: #{major_type}"
+          raise Error, "Expected Integer (0,1) got major type: #{major_type}"
         end
       end
 
@@ -173,8 +179,7 @@ module Aws
 
       def read_reserved_undefined
         _major_type, add_info = read_info
-        raise Error,
-          "Undefined reserved additional information: #{add_info}"
+        raise Error, "Undefined reserved additional information: #{add_info}"
       end
 
       def read_boolean
@@ -183,9 +188,7 @@ module Aws
         when 20 then false
         when 21 then true
         else
-          raise Error,
-                'Invalid Boolean simple type, expected add_info of 20 or 21, ' \
-                 "got: #{add_info}"
+          raise Error, "Invalid Boolean simple type, expected add_info of 20 or 21, got: #{add_info}"
         end
       end
 
@@ -221,7 +224,7 @@ module Aws
             # exp-15-10
             Math.ldexp(1024 + mant, exp - 25)
           end
-        if (b16[15]).zero?
+        if b16[15].zero?
           val
         else
           -val
@@ -250,9 +253,7 @@ module Aws
         when 2 then v
         when 3 then -1 - v
         else
-          raise Error,
-                'Invalid Tag value for BigNum, ' \
-                "expected 2 or 3, got: #{tag_value}"
+          raise Error, "Invalid Tag value for BigNum, expected 2 or 3, got: #{tag_value}"
         end
       end
 

data/lib/aws-sdk-signin/client.rb

@@ -559,6 +559,267 @@ module Aws::Signin
       req.send_request(options)
     end
 
+    # Delete console authorization configuration with automatic scope
+    # detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::DeleteConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload delete_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def delete_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:delete_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Remove a permission statement from the account's SignIn
+    # resource-based policy
+    #
+    # @option params [required, String] :statement_id
+    #   Unique identifier of the permission statement to delete
+    #
+    # @option params [String] :client_token
+    #   Idempotency token for the request
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_resource_permission_statement({
+    #     statement_id: "StatementId", # required
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteResourcePermissionStatement AWS API Documentation
+    #
+    # @overload delete_resource_permission_statement(params = {})
+    # @param [Hash] params ({})
+    def delete_resource_permission_statement(params = {}, options = {})
+      req = build_request(:delete_resource_permission_statement, params)
+      req.send_request(options)
+    end
+
+    # Get console authorization configuration with automatic scope detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::GetConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload get_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def get_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:get_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Retrieve the account's consolidated SignIn resource-based policy
+    #
+    # @return [Types::GetResourcePolicyOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetResourcePolicyOutput#signin_resource_based_policy #signin_resource_based_policy} => Types::SigninResourceBasedPolicy
+    #
+    # @example Response structure
+    #
+    #   resp.signin_resource_based_policy.version #=> String
+    #   resp.signin_resource_based_policy.statement #=> Array
+    #   resp.signin_resource_based_policy.statement[0].effect #=> String
+    #   resp.signin_resource_based_policy.statement[0].principal #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].principal["String"] #=> String
+    #   resp.signin_resource_based_policy.statement[0].action #=> Array
+    #   resp.signin_resource_based_policy.statement[0].action[0] #=> String
+    #   resp.signin_resource_based_policy.statement[0].resource #=> String
+    #   resp.signin_resource_based_policy.statement[0].condition #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"] #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"]["String"] #=> Array
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"]["String"][0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetResourcePolicy AWS API Documentation
+    #
+    # @overload get_resource_policy(params = {})
+    # @param [Hash] params ({})
+    def get_resource_policy(params = {}, options = {})
+      req = build_request(:get_resource_policy, params)
+      req.send_request(options)
+    end
+
+    # Retrieve all permission statements in the account's SignIn
+    # resource-based policy
+    #
+    # @option params [Integer] :max_results
+    #   Maximum number of results to return
+    #
+    # @option params [String] :next_token
+    #   Token for pagination
+    #
+    # @return [Types::ListResourcePermissionStatementsOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListResourcePermissionStatementsOutput#permission_statements #permission_statements} => Array<Types::PermissionStatementSummary>
+    #   * {Types::ListResourcePermissionStatementsOutput#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_resource_permission_statements({
+    #     max_results: 1,
+    #     next_token: "NextToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.permission_statements #=> Array
+    #   resp.permission_statements[0].sid #=> String
+    #   resp.permission_statements[0].condition #=> Hash
+    #   resp.permission_statements[0].condition["ConditionType"] #=> Hash
+    #   resp.permission_statements[0].condition["ConditionType"]["String"] #=> Array
+    #   resp.permission_statements[0].condition["ConditionType"]["String"][0] #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ListResourcePermissionStatements AWS API Documentation
+    #
+    # @overload list_resource_permission_statements(params = {})
+    # @param [Hash] params ({})
+    def list_resource_permission_statements(params = {}, options = {})
+      req = build_request(:list_resource_permission_statements, params)
+      req.send_request(options)
+    end
+
+    # Enable console authorization configuration with automatic scope
+    # detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::PutConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.put_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload put_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def put_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:put_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Create a permission statement in the account's SignIn resource-based
+    # policy
+    #
+    # @option params [String] :source_vpc
+    #   VPC identifier to restrict console access
+    #
+    # @option params [String] :signin_source_vpce
+    #   SignIn VPC endpoint identifier
+    #
+    # @option params [String] :console_source_vpce
+    #   Console VPC endpoint identifier
+    #
+    # @option params [String] :vpc_source_ip
+    #   Source IP address within VPC
+    #
+    # @option params [String] :source_ip
+    #   Source IP address
+    #
+    # @option params [String] :requested_region
+    #   AWS region where the VPC and VPC endpoint reside Required when
+    #   sourceVpc or signinSourceVpce/consoleSourceVpce is provided
+    #
+    # @option params [String] :excluded_principal
+    #   Principal to exclude from the permission statement
+    #
+    # @option params [String] :client_token
+    #   Idempotency token for the request
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Types::PutResourcePermissionStatementOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::PutResourcePermissionStatementOutput#statement_id #statement_id} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.put_resource_permission_statement({
+    #     source_vpc: "SourceVpc",
+    #     signin_source_vpce: "SourceVpce",
+    #     console_source_vpce: "SourceVpce",
+    #     vpc_source_ip: "VpcSourceIp",
+    #     source_ip: "SourceIp",
+    #     requested_region: "RequestedRegion",
+    #     excluded_principal: "ExcludedPrincipal",
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.statement_id #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutResourcePermissionStatement AWS API Documentation
+    #
+    # @overload put_resource_permission_statement(params = {})
+    # @param [Hash] params ({})
+    def put_resource_permission_statement(params = {}, options = {})
+      req = build_request(:put_resource_permission_statement, params)
+      req.send_request(options)
+    end
+
     # @!endgroup
 
     # @param params ({})
@@ -577,7 +838,7 @@ module Aws::Signin
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.249.0'
+      context[:gem_version] = '3.252.0'
       Seahorse::Client::Request.new(handlers, context)
     end