aws-sdk-core 3.251.0 → 3.253.0

data/lib/aws-sdk-signin/types.rb

@@ -45,9 +45,7 @@ module Aws::Signin
 
     # AWS credentials structure containing temporary access credentials
     #
-    # The scoped-down, 15 minute duration AWS credentials. Scoping down will
-    # be based on CLI policy (CLI team needs to create it). Similar to cloud
-    # shell implementation.
+    # Scoped, temporary AWS credentials with a 15-minute duration.
     #
     # @!attribute [rw] access_key_id
     #   AWS access key ID for temporary credentials
@@ -71,6 +69,30 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # Error thrown when request conflicts with current state
+    #
+    # HTTP Status Code: 409 Conflict
+    #
+    # Used when the request conflicts with the current state of the resource
+    #
+    # @!attribute [rw] error
+    #   OAuth 2.0 error code indicating conflict Will be CONFLICT
+    #   @return [String]
+    #
+    # @!attribute [rw] message
+    #   Detailed message explaining the conflict Provides specific
+    #   information about what caused the conflict
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ConflictException AWS API Documentation
+    #
+    class ConflictException < Struct.new(
+      :error,
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Input structure for CreateOAuth2Token operation
     #
     # Contains flattened token operation inputs for both authorization code
@@ -208,6 +230,181 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # Input structure for CreateOAuth2TokenWithIAM operation
+    #
+    # @!attribute [rw] grant_type
+    #   OAuth 2.0 grant type. Must be "client\_credentials".
+    #   @return [String]
+    #
+    # @!attribute [rw] resource
+    #   The OAuth resource for which the access token is requested. Example:
+    #   "aws-mcp.amazonaws.com".
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithIAMRequest AWS API Documentation
+    #
+    class CreateOAuth2TokenWithIAMRequest < Struct.new(
+      :grant_type,
+      :resource)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Output structure for CreateOAuth2TokenWithIAM operation
+    #
+    # Contains the JWT access token, token type, and expiration per RFC 6749
+    # §5.1.
+    #
+    # @!attribute [rw] access_token
+    #   JWT access token containing principal identity, resource scope, and
+    #   session metadata
+    #   @return [String]
+    #
+    # @!attribute [rw] token_type
+    #   Always "Bearer" per OAuth 2.1 specification
+    #   @return [String]
+    #
+    # @!attribute [rw] expires_in
+    #   Token lifetime in seconds. Value is the minimum of session validity
+    #   and 1 hour.
+    #   @return [Integer]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithIAMResponse AWS API Documentation
+    #
+    class CreateOAuth2TokenWithIAMResponse < Struct.new(
+      :access_token,
+      :token_type,
+      :expires_in)
+      SENSITIVE = [:access_token]
+      include Aws::Structure
+    end
+
+    # Input for DeleteConsoleAuthorizationConfiguration operation
+    #
+    # @!attribute [rw] target_id
+    #   Target account identifier
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteConsoleAuthorizationConfigurationInput AWS API Documentation
+    #
+    class DeleteConsoleAuthorizationConfigurationInput < Struct.new(
+      :target_id)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Output for DeleteConsoleAuthorizationConfiguration operation
+    #
+    # @!attribute [rw] target_id
+    #   Target account identifier
+    #   @return [String]
+    #
+    # @!attribute [rw] scope
+    #   Authorization scope
+    #   @return [String]
+    #
+    # @!attribute [rw] console_authorization_enabled
+    #   Whether console authorization is enabled
+    #   @return [Boolean]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteConsoleAuthorizationConfigurationOutput AWS API Documentation
+    #
+    class DeleteConsoleAuthorizationConfigurationOutput < Struct.new(
+      :target_id,
+      :scope,
+      :console_authorization_enabled)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Input for DeleteResourcePermissionStatement operation
+    #
+    # @!attribute [rw] statement_id
+    #   Unique identifier of the permission statement to delete
+    #   @return [String]
+    #
+    # @!attribute [rw] client_token
+    #   Idempotency token for the request
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteResourcePermissionStatementInput AWS API Documentation
+    #
+    class DeleteResourcePermissionStatementInput < Struct.new(
+      :statement_id,
+      :client_token)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Output for DeleteResourcePermissionStatement operation
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteResourcePermissionStatementOutput AWS API Documentation
+    #
+    class DeleteResourcePermissionStatementOutput < Aws::EmptyStructure; end
+
+    # Input for GetConsoleAuthorizationConfiguration operation
+    #
+    # @!attribute [rw] target_id
+    #   Target account identifier
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetConsoleAuthorizationConfigurationInput AWS API Documentation
+    #
+    class GetConsoleAuthorizationConfigurationInput < Struct.new(
+      :target_id)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Output for GetConsoleAuthorizationConfiguration operation
+    #
+    # @!attribute [rw] target_id
+    #   Target account identifier
+    #   @return [String]
+    #
+    # @!attribute [rw] scope
+    #   Authorization scope
+    #   @return [String]
+    #
+    # @!attribute [rw] console_authorization_enabled
+    #   Whether console authorization is enabled
+    #   @return [Boolean]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetConsoleAuthorizationConfigurationOutput AWS API Documentation
+    #
+    class GetConsoleAuthorizationConfigurationOutput < Struct.new(
+      :target_id,
+      :scope,
+      :console_authorization_enabled)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Input for GetResourcePolicy operation
+    #
+    # @api private
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetResourcePolicyInput AWS API Documentation
+    #
+    class GetResourcePolicyInput < Aws::EmptyStructure; end
+
+    # Output for GetResourcePolicy operation
+    #
+    # @!attribute [rw] signin_resource_based_policy
+    #   The account's SignIn resource-based policy
+    #   @return [Types::SigninResourceBasedPolicy]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetResourcePolicyOutput AWS API Documentation
+    #
+    class GetResourcePolicyOutput < Struct.new(
+      :signin_resource_based_policy)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Error thrown when an internal server error occurs
     #
     # HTTP Status Code: 500 Internal Server Error
@@ -234,6 +431,419 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # Input structure for IntrospectOAuth2TokenWithIAM operation
+    #
+    # RFC 7662 §2.1 introspection request. Contains the token to inspect and
+    # an optional hint about the token's type.
+    #
+    # @!attribute [rw] token
+    #   The string value of the token to introspect. May be either an
+    #   access\_token or a refresh\_token issued by AWS Sign-In.
+    #   @return [String]
+    #
+    # @!attribute [rw] token_type_hint
+    #   Optional hint about the type of the token submitted for
+    #   introspection. The server uses this hint to optimize lookup, but
+    #   still falls back to the other token type on miss. Allowed values:
+    #   access\_token, refresh\_token.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAMRequest AWS API Documentation
+    #
+    class IntrospectOAuth2TokenWithIAMRequest < Struct.new(
+      :token,
+      :token_type_hint)
+      SENSITIVE = [:token]
+      include Aws::Structure
+    end
+
+    # Output structure for IntrospectOAuth2TokenWithIAM operation
+    #
+    # RFC 7662 §2.2 introspection response. Only `active` is required; all
+    # other claims are omitted when the token is inactive.
+    #
+    # @!attribute [rw] active
+    #   Indicates whether the token is currently active. `true` only when
+    #   the token is valid, has not expired, has not been revoked, and
+    #   belongs to the caller's account.
+    #   @return [Boolean]
+    #
+    # @!attribute [rw] client_id
+    #   Client identifier for the OAuth 2.0 client that requested the token.
+    #   @return [String]
+    #
+    # @!attribute [rw] user_id
+    #   User identifier matching sts:GetCallerIdentity's `UserId` field for
+    #   the token's subject principal (e.g. "AIDAEXAMPLE" for an IAM user,
+    #   or "AROAEXAMPLE:session-name" for an assumed role).
+    #   @return [String]
+    #
+    # @!attribute [rw] token_type
+    #   Indicates which kind of token was introspected. One of
+    #   "access\_token" or "refresh\_token".
+    #   @return [String]
+    #
+    # @!attribute [rw] exp
+    #   Token expiration time as a NumericDate (Unix epoch seconds).
+    #   @return [Integer]
+    #
+    # @!attribute [rw] iat
+    #   Token issuance time as a NumericDate (Unix epoch seconds).
+    #   @return [Integer]
+    #
+    # @!attribute [rw] nbf
+    #   Token "not before" time as a NumericDate (Unix epoch seconds).
+    #   @return [Integer]
+    #
+    # @!attribute [rw] sub
+    #   Subject of the token: the IAM principal ARN. For assumed-role
+    #   sessions, this is the session ARN (matches sts:GetCallerIdentity's
+    #   `Arn` field), e.g.
+    #   arn:aws:sts::123456789012:assumed-role/MyRole/session-name.
+    #   @return [String]
+    #
+    # @!attribute [rw] aud
+    #   Audience of the token: the OAuth resource the token is scoped to
+    #   (for example, "aws-mcp.amazonaws.com"). Omitted for refresh tokens.
+    #   @return [String]
+    #
+    # @!attribute [rw] iss
+    #   Issuer of the token. Always "signin.amazonaws.com" for AWS Sign-In.
+    #   @return [String]
+    #
+    # @!attribute [rw] jti
+    #   Unique identifier for the token.
+    #   @return [String]
+    #
+    # @!attribute [rw] account_id
+    #   12-digit AWS account ID of the token's subject principal.
+    #   @return [String]
+    #
+    # @!attribute [rw] signin_session
+    #   AWS Sign-In session ARN bound to the token, of the form
+    #   arn:aws:signin:\{region}:\{account}:session/\{uuid}.
+    #   @return [String]
+    #
+    # @!attribute [rw] resource
+    #   The OAuth resource the token is scoped to during Human OAuth flow.
+    #   Only present for refresh token introspection.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAMResponse AWS API Documentation
+    #
+    class IntrospectOAuth2TokenWithIAMResponse < Struct.new(
+      :active,
+      :client_id,
+      :user_id,
+      :token_type,
+      :exp,
+      :iat,
+      :nbf,
+      :sub,
+      :aud,
+      :iss,
+      :jti,
+      :account_id,
+      :signin_session,
+      :resource)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Input for ListResourcePermissionStatements operation
+    #
+    # @!attribute [rw] max_results
+    #   Maximum number of results to return
+    #   @return [Integer]
+    #
+    # @!attribute [rw] next_token
+    #   Token for pagination
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ListResourcePermissionStatementsInput AWS API Documentation
+    #
+    class ListResourcePermissionStatementsInput < Struct.new(
+      :max_results,
+      :next_token)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Output for ListResourcePermissionStatements operation
+    #
+    # @!attribute [rw] permission_statements
+    #   List of permission statement summaries
+    #   @return [Array<Types::PermissionStatementSummary>]
+    #
+    # @!attribute [rw] next_token
+    #   Token for next page of results
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ListResourcePermissionStatementsOutput AWS API Documentation
+    #
+    class ListResourcePermissionStatementsOutput < Struct.new(
+      :permission_statements,
+      :next_token)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Summary of a permission statement
+    #
+    # @!attribute [rw] sid
+    #   Unique identifier for the permission statement
+    #   @return [String]
+    #
+    # @!attribute [rw] condition
+    #   Condition block for the permission statement
+    #   @return [Hash<String,Hash<String,Array<String>>>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PermissionStatementSummary AWS API Documentation
+    #
+    class PermissionStatementSummary < Struct.new(
+      :sid,
+      :condition)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Individual policy statement within a resource-based policy
+    #
+    # @!attribute [rw] effect
+    #   Effect of the policy statement (Allow/Deny)
+    #   @return [String]
+    #
+    # @!attribute [rw] principal
+    #   Principal the statement applies to
+    #   @return [Hash<String,String>]
+    #
+    # @!attribute [rw] action
+    #   Actions the statement controls
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] resource
+    #   Resource the statement applies to
+    #   @return [String]
+    #
+    # @!attribute [rw] condition
+    #   Condition block for the statement
+    #   @return [Hash<String,Hash<String,Array<String>>>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PolicyStatement AWS API Documentation
+    #
+    class PolicyStatement < Struct.new(
+      :effect,
+      :principal,
+      :action,
+      :resource,
+      :condition)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Input for PutConsoleAuthorizationConfiguration operation
+    #
+    # @!attribute [rw] target_id
+    #   Target account identifier
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutConsoleAuthorizationConfigurationInput AWS API Documentation
+    #
+    class PutConsoleAuthorizationConfigurationInput < Struct.new(
+      :target_id)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Output for PutConsoleAuthorizationConfiguration operation
+    #
+    # @!attribute [rw] target_id
+    #   Target account identifier
+    #   @return [String]
+    #
+    # @!attribute [rw] scope
+    #   Authorization scope
+    #   @return [String]
+    #
+    # @!attribute [rw] console_authorization_enabled
+    #   Whether console authorization is enabled
+    #   @return [Boolean]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutConsoleAuthorizationConfigurationOutput AWS API Documentation
+    #
+    class PutConsoleAuthorizationConfigurationOutput < Struct.new(
+      :target_id,
+      :scope,
+      :console_authorization_enabled)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Input for PutResourcePermissionStatement operation
+    #
+    # @!attribute [rw] source_vpc
+    #   VPC identifier to restrict console access
+    #   @return [String]
+    #
+    # @!attribute [rw] signin_source_vpce
+    #   SignIn VPC endpoint identifier
+    #   @return [String]
+    #
+    # @!attribute [rw] console_source_vpce
+    #   Console VPC endpoint identifier
+    #   @return [String]
+    #
+    # @!attribute [rw] vpc_source_ip
+    #   Source IP address within VPC
+    #   @return [String]
+    #
+    # @!attribute [rw] source_ip
+    #   Source IP address
+    #   @return [String]
+    #
+    # @!attribute [rw] requested_region
+    #   AWS region where the VPC and VPC endpoint reside Required when
+    #   sourceVpc or signinSourceVpce/consoleSourceVpce is provided
+    #   @return [String]
+    #
+    # @!attribute [rw] excluded_principal
+    #   Principal to exclude from the permission statement
+    #   @return [String]
+    #
+    # @!attribute [rw] client_token
+    #   Idempotency token for the request
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutResourcePermissionStatementInput AWS API Documentation
+    #
+    class PutResourcePermissionStatementInput < Struct.new(
+      :source_vpc,
+      :signin_source_vpce,
+      :console_source_vpce,
+      :vpc_source_ip,
+      :source_ip,
+      :requested_region,
+      :excluded_principal,
+      :client_token)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Output for PutResourcePermissionStatement operation
+    #
+    # @!attribute [rw] statement_id
+    #   Unique identifier for the created permission statement
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutResourcePermissionStatementOutput AWS API Documentation
+    #
+    class PutResourcePermissionStatementOutput < Struct.new(
+      :statement_id)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Error thrown when requested resource is not found
+    #
+    # HTTP Status Code: 404 Not Found
+    #
+    # Used when the specified resource does not exist
+    #
+    # @!attribute [rw] error
+    #   OAuth 2.0 error code indicating resource not found Will be
+    #   RESOURCE\_NOT\_FOUND
+    #   @return [String]
+    #
+    # @!attribute [rw] message
+    #   Detailed message explaining which resource was not found Provides
+    #   specific information about the missing resource
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ResourceNotFoundException AWS API Documentation
+    #
+    class ResourceNotFoundException < Struct.new(
+      :error,
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Input structure for RevokeOAuth2TokenWithIAM operation
+    #
+    # RFC 7009 §2.1 revocation request. Contains the refresh\_token to
+    # revoke.
+    #
+    # @!attribute [rw] token
+    #   The refresh\_token to revoke. Must be a refresh\_token issued by AWS
+    #   Sign-In (prefix "ASOR"); access\_tokens are not accepted for
+    #   revocation.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/RevokeOAuth2TokenWithIAMRequest AWS API Documentation
+    #
+    class RevokeOAuth2TokenWithIAMRequest < Struct.new(
+      :token)
+      SENSITIVE = [:token]
+      include Aws::Structure
+    end
+
+    # Output structure for RevokeOAuth2TokenWithIAM operation
+    #
+    # RFC 7009 §2.2 revocation response. The endpoint returns 200 OK with an
+    # empty body on success; there are no response fields.
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/RevokeOAuth2TokenWithIAMResponse AWS API Documentation
+    #
+    class RevokeOAuth2TokenWithIAMResponse < Aws::EmptyStructure; end
+
+    # Error thrown when service quota is exceeded
+    #
+    # HTTP Status Code: 402 Payment Required (used as quota exceeded
+    # indicator)
+    #
+    # Used when the request would cause a service quota to be exceeded
+    #
+    # @!attribute [rw] error
+    #   OAuth 2.0 error code indicating service quota exceeded Will be
+    #   SERVICE\_QUOTA\_EXCEEDED
+    #   @return [String]
+    #
+    # @!attribute [rw] message
+    #   Detailed message explaining which quota was exceeded Provides
+    #   specific information about the limit and current usage
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ServiceQuotaExceededException AWS API Documentation
+    #
+    class ServiceQuotaExceededException < Struct.new(
+      :error,
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # SignIn resource-based policy document
+    #
+    # @!attribute [rw] version
+    #   Policy version
+    #   @return [String]
+    #
+    # @!attribute [rw] statement
+    #   Policy statements
+    #   @return [Array<Types::PolicyStatement>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/SigninResourceBasedPolicy AWS API Documentation
+    #
+    class SigninResourceBasedPolicy < Struct.new(
+      :version,
+      :statement)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Error thrown when rate limit is exceeded
     #
     # HTTP Status Code: 429 Too Many Requests

data/lib/aws-sdk-signin.rb

@@ -56,7 +56,7 @@ module Aws::Signin
   autoload :EndpointProvider, 'aws-sdk-signin/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-signin/endpoints'
 
-  GEM_VERSION = '3.251.0'
+  GEM_VERSION = '3.253.0'
 
 end
 

data/lib/aws-sdk-sso/client.rb

@@ -696,7 +696,7 @@ module Aws::SSO
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.251.0'
+      context[:gem_version] = '3.253.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sso.rb

@@ -56,7 +56,7 @@ module Aws::SSO
   autoload :EndpointProvider, 'aws-sdk-sso/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-sso/endpoints'
 
-  GEM_VERSION = '3.251.0'
+  GEM_VERSION = '3.253.0'
 
 end
 

data/lib/aws-sdk-ssooidc/client.rb

@@ -1079,7 +1079,7 @@ module Aws::SSOOIDC
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.251.0'
+      context[:gem_version] = '3.253.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-ssooidc.rb

@@ -56,7 +56,7 @@ module Aws::SSOOIDC
   autoload :EndpointProvider, 'aws-sdk-ssooidc/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-ssooidc/endpoints'
 
-  GEM_VERSION = '3.251.0'
+  GEM_VERSION = '3.253.0'
 
 end
 

data/lib/aws-sdk-sts/client.rb

@@ -2723,7 +2723,7 @@ module Aws::STS
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.251.0'
+      context[:gem_version] = '3.253.0'
       Seahorse::Client::Request.new(handlers, context)
     end