aws-sdk-core 3.251.0 → 3.253.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ecf99427b1716ed51214604de9538ab9901b0d17fb5a5d62282740b7925de8aa
-  data.tar.gz: 238136e308696d22945157ca92be189295ff42b716a9bed22861e1361c8c052c
+  metadata.gz: 1247f6da5460ed459d1ac0f815b87533c392520ead96493388af7bf93b416d6c
+  data.tar.gz: 0a12db04017a03fb85be3f57f36230ffb09ce880374147c99acf41526779a2cd
 SHA512:
-  metadata.gz: ddd7a5d0d8fb62f8e7d3dd612ff2a2b4231ee18ac317a1061d13ada4526d1fc05e7c4323344fe0c4c06437b72e1e6e1e2212bf4f424710668afdcbb9c22a38d6
-  data.tar.gz: 0d3d1b1109b28de4900a27c6e3955bddaa651a2031c238dee600f923d0dda6eff1cdd970100ef40edf945aa28be85130becc4893adcf28256a11a5500658d675
+  metadata.gz: 37ebe8075e08b7f183fc59920a4ae8d16b434644bd43f0e99110787548e4742ce3816d461a80519517581282a23f3de149202dc9e1a0bba9b81e7d75acaf5153
+  data.tar.gz: fb38b7be043ef6ba002a8d90b26dfd8d6ef4b97f02a3135f2ee434816fd9151d56d033df646880665482eed580a58438859a90df4257d7e2bdeefc8c92fcedf8

data/CHANGELOG.md

@@ -1,6 +1,20 @@
 Unreleased Changes
 ------------------
 
+3.253.0 (2026-07-08)
+------------------
+
+* Feature - Updated Aws::Signin::Client with the latest API changes.
+
+* Feature - Adds support for OAuth 2.0 token operations in AWS Sign-In, CreateOAuth2TokenWithIAM (client credentials flow), IntrospectOAuth2TokenWithIAM (token inspection), and RevokeOAuth2TokenWithIAM (token revocation).
+
+3.252.0 (2026-06-10)
+------------------
+
+* Feature - Updated Aws::Signin::Client with the latest API changes.
+
+* Feature - AWS Sign-In now allows customers to control access to the AWS Management Console using resource-based policies. With this release customers can restrict console access based on network perimeters such as VPC IDs, VPC endpoints, and IP addresses.
+
 3.251.0 (2026-06-02)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-3.251.0
+3.253.0

data/lib/aws-sdk-signin/client.rb

@@ -559,6 +559,412 @@ module Aws::Signin
       req.send_request(options)
     end
 
+    # Grants permission to exchange client credentials for an OAuth 2.0
+    # access token scoped to a resource that can be used to access AWS
+    # services from applications
+    #
+    # @option params [required, String] :grant_type
+    #   OAuth 2.0 grant type. Must be "client\_credentials".
+    #
+    # @option params [required, String] :resource
+    #   The OAuth resource for which the access token is requested. Example:
+    #   "aws-mcp.amazonaws.com".
+    #
+    # @return [Types::CreateOAuth2TokenWithIAMResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#access_token #access_token} => String
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#token_type #token_type} => String
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#expires_in #expires_in} => Integer
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.create_o_auth_2_token_with_iam({
+    #     grant_type: "ClientCredentialsGrantType", # required
+    #     resource: "CreateOAuth2TokenWithIAMRequestResourceString", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.access_token #=> String
+    #   resp.token_type #=> String
+    #   resp.expires_in #=> Integer
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload create_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def create_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:create_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
+    # Delete console authorization configuration with automatic scope
+    # detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::DeleteConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload delete_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def delete_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:delete_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Remove a permission statement from the account's SignIn
+    # resource-based policy
+    #
+    # @option params [required, String] :statement_id
+    #   Unique identifier of the permission statement to delete
+    #
+    # @option params [String] :client_token
+    #   Idempotency token for the request
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_resource_permission_statement({
+    #     statement_id: "StatementId", # required
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteResourcePermissionStatement AWS API Documentation
+    #
+    # @overload delete_resource_permission_statement(params = {})
+    # @param [Hash] params ({})
+    def delete_resource_permission_statement(params = {}, options = {})
+      req = build_request(:delete_resource_permission_statement, params)
+      req.send_request(options)
+    end
+
+    # Get console authorization configuration with automatic scope detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::GetConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload get_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def get_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:get_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Retrieve the account's consolidated SignIn resource-based policy
+    #
+    # @return [Types::GetResourcePolicyOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetResourcePolicyOutput#signin_resource_based_policy #signin_resource_based_policy} => Types::SigninResourceBasedPolicy
+    #
+    # @example Response structure
+    #
+    #   resp.signin_resource_based_policy.version #=> String
+    #   resp.signin_resource_based_policy.statement #=> Array
+    #   resp.signin_resource_based_policy.statement[0].effect #=> String
+    #   resp.signin_resource_based_policy.statement[0].principal #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].principal["String"] #=> String
+    #   resp.signin_resource_based_policy.statement[0].action #=> Array
+    #   resp.signin_resource_based_policy.statement[0].action[0] #=> String
+    #   resp.signin_resource_based_policy.statement[0].resource #=> String
+    #   resp.signin_resource_based_policy.statement[0].condition #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"] #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"]["String"] #=> Array
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"]["String"][0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetResourcePolicy AWS API Documentation
+    #
+    # @overload get_resource_policy(params = {})
+    # @param [Hash] params ({})
+    def get_resource_policy(params = {}, options = {})
+      req = build_request(:get_resource_policy, params)
+      req.send_request(options)
+    end
+
+    # Grants permission to inspect the metadata and state of an OAuth 2.0
+    # access token or refresh token
+    #
+    # Implements RFC 7662 OAuth 2.0 Token Introspection over a
+    # SigV4-authenticated endpoint. Inspects the metadata of an
+    # access\_token or refresh\_token issued by AWS Sign-In and returns the
+    # claims associated with it.
+    #
+    # Inactive token semantics (RFC 7662 §2.2): when the supplied token is
+    # unknown, expired, revoked, malformed, or owned by a different account,
+    # the response body is exactly \{ "active": false } with all other
+    # claims omitted.
+    #
+    # @option params [required, String] :token
+    #   The string value of the token to introspect. May be either an
+    #   access\_token or a refresh\_token issued by AWS Sign-In.
+    #
+    # @option params [String] :token_type_hint
+    #   Optional hint about the type of the token submitted for introspection.
+    #   The server uses this hint to optimize lookup, but still falls back to
+    #   the other token type on miss. Allowed values: access\_token,
+    #   refresh\_token.
+    #
+    # @return [Types::IntrospectOAuth2TokenWithIAMResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#active #active} => Boolean
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#client_id #client_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#user_id #user_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#token_type #token_type} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#exp #exp} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#iat #iat} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#nbf #nbf} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#sub #sub} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#aud #aud} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#iss #iss} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#jti #jti} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#account_id #account_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#signin_session #signin_session} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#resource #resource} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.introspect_o_auth_2_token_with_iam({
+    #     token: "IntrospectionToken", # required
+    #     token_type_hint: "TokenTypeHint",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.active #=> Boolean
+    #   resp.client_id #=> String
+    #   resp.user_id #=> String
+    #   resp.token_type #=> String
+    #   resp.exp #=> Integer
+    #   resp.iat #=> Integer
+    #   resp.nbf #=> Integer
+    #   resp.sub #=> String
+    #   resp.aud #=> String
+    #   resp.iss #=> String
+    #   resp.jti #=> String
+    #   resp.account_id #=> String
+    #   resp.signin_session #=> String
+    #   resp.resource #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload introspect_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def introspect_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:introspect_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
+    # Retrieve all permission statements in the account's SignIn
+    # resource-based policy
+    #
+    # @option params [Integer] :max_results
+    #   Maximum number of results to return
+    #
+    # @option params [String] :next_token
+    #   Token for pagination
+    #
+    # @return [Types::ListResourcePermissionStatementsOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListResourcePermissionStatementsOutput#permission_statements #permission_statements} => Array<Types::PermissionStatementSummary>
+    #   * {Types::ListResourcePermissionStatementsOutput#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_resource_permission_statements({
+    #     max_results: 1,
+    #     next_token: "NextToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.permission_statements #=> Array
+    #   resp.permission_statements[0].sid #=> String
+    #   resp.permission_statements[0].condition #=> Hash
+    #   resp.permission_statements[0].condition["ConditionType"] #=> Hash
+    #   resp.permission_statements[0].condition["ConditionType"]["String"] #=> Array
+    #   resp.permission_statements[0].condition["ConditionType"]["String"][0] #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ListResourcePermissionStatements AWS API Documentation
+    #
+    # @overload list_resource_permission_statements(params = {})
+    # @param [Hash] params ({})
+    def list_resource_permission_statements(params = {}, options = {})
+      req = build_request(:list_resource_permission_statements, params)
+      req.send_request(options)
+    end
+
+    # Enable console authorization configuration with automatic scope
+    # detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::PutConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.put_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload put_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def put_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:put_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Create a permission statement in the account's SignIn resource-based
+    # policy
+    #
+    # @option params [String] :source_vpc
+    #   VPC identifier to restrict console access
+    #
+    # @option params [String] :signin_source_vpce
+    #   SignIn VPC endpoint identifier
+    #
+    # @option params [String] :console_source_vpce
+    #   Console VPC endpoint identifier
+    #
+    # @option params [String] :vpc_source_ip
+    #   Source IP address within VPC
+    #
+    # @option params [String] :source_ip
+    #   Source IP address
+    #
+    # @option params [String] :requested_region
+    #   AWS region where the VPC and VPC endpoint reside Required when
+    #   sourceVpc or signinSourceVpce/consoleSourceVpce is provided
+    #
+    # @option params [String] :excluded_principal
+    #   Principal to exclude from the permission statement
+    #
+    # @option params [String] :client_token
+    #   Idempotency token for the request
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Types::PutResourcePermissionStatementOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::PutResourcePermissionStatementOutput#statement_id #statement_id} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.put_resource_permission_statement({
+    #     source_vpc: "SourceVpc",
+    #     signin_source_vpce: "SourceVpce",
+    #     console_source_vpce: "SourceVpce",
+    #     vpc_source_ip: "VpcSourceIp",
+    #     source_ip: "SourceIp",
+    #     requested_region: "RequestedRegion",
+    #     excluded_principal: "ExcludedPrincipal",
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.statement_id #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutResourcePermissionStatement AWS API Documentation
+    #
+    # @overload put_resource_permission_statement(params = {})
+    # @param [Hash] params ({})
+    def put_resource_permission_statement(params = {}, options = {})
+      req = build_request(:put_resource_permission_statement, params)
+      req.send_request(options)
+    end
+
+    # Grants permission to revoke an OAuth 2.0 refresh token and its
+    # associated refresh tokens
+    #
+    # Revokes a refresh\_token issued by AWS Sign-In, invalidating the
+    # entire token chain so that the refresh\_token can no longer be used to
+    # mint new access\_tokens.
+    #
+    # Idempotency: revoking an already-revoked, expired, or otherwise
+    # invalid token still returns 200 OK with an empty body. Only the
+    # refresh\_token type is accepted.
+    #
+    # @option params [required, String] :token
+    #   The refresh\_token to revoke. Must be a refresh\_token issued by AWS
+    #   Sign-In (prefix "ASOR"); access\_tokens are not accepted for
+    #   revocation.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.revoke_o_auth_2_token_with_iam({
+    #     token: "RevocationToken", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/RevokeOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload revoke_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def revoke_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:revoke_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
     # @!endgroup
 
     # @param params ({})
@@ -577,7 +983,7 @@ module Aws::Signin
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.251.0'
+      context[:gem_version] = '3.253.0'
       Seahorse::Client::Request.new(handlers, context)
     end