aws-sdk-core 3.251.0 → 3.257.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ecf99427b1716ed51214604de9538ab9901b0d17fb5a5d62282740b7925de8aa
-  data.tar.gz: 238136e308696d22945157ca92be189295ff42b716a9bed22861e1361c8c052c
+  metadata.gz: 645b4cf51bdbd1caea40a95ef787ee6e25c221a79a14387382bb7b3573e50b51
+  data.tar.gz: 3bf3895885beab2d6e0997098a670190aa41e717c686ac77841878627bca7f8a
 SHA512:
-  metadata.gz: ddd7a5d0d8fb62f8e7d3dd612ff2a2b4231ee18ac317a1061d13ada4526d1fc05e7c4323344fe0c4c06437b72e1e6e1e2212bf4f424710668afdcbb9c22a38d6
-  data.tar.gz: 0d3d1b1109b28de4900a27c6e3955bddaa651a2031c238dee600f923d0dda6eff1cdd970100ef40edf945aa28be85130becc4893adcf28256a11a5500658d675
+  metadata.gz: be11f00d1aed112e0721dc127af5d0bbfdae42158b75be7bd74a44df75bfedb2ce61b96f5ea0a9a394d3f886364dcd62782d3538ebcdf04f2f9473b173ccdef5
+  data.tar.gz: bc1d1b585f4602f83fe7e6b1523c7168d36d4c6ed64a61294ae243c2bbcd52c4b1777d2d093db3aa80a608b73bce7900ef559575a51754e7535049348956e07a

data/CHANGELOG.md

@@ -1,6 +1,47 @@
 Unreleased Changes
 ------------------
 
+3.257.0 (2026-09-14)
+------------------
+
+* Feature - Updated Aws::STS::Client with the latest API changes.
+
+* Feature - Increases the maximum session token size to 4,096 bytes and removes the packed policy size limit. Adds SessionTokenSize and SessionTokenUtilization fields and a new MinimumSessionTokenSize parameter. PackedPolicySize is deprecated.
+
+3.256.0 (2026-09-11)
+------------------
+
+* Feature - Preserve millisecond precision when serializing `Time` values on the request path, instead of truncating to whole seconds.
+
+3.255.0 (2026-09-09)
+------------------
+
+* Feature - Add `rexml` as a dependency.
+
+3.254.1 (2026-08-06)
+------------------
+
+* Issue - Fix a double space appearing in the frameworks section of the User-Agent header.
+
+3.254.0 (2026-07-09)
+------------------
+
+* Feature - Serialize `BigDecimal` values as JSON numbers in document types for REST-JSON and JSON protocols.
+
+3.253.0 (2026-07-08)
+------------------
+
+* Feature - Updated Aws::Signin::Client with the latest API changes.
+
+* Feature - Adds support for OAuth 2.0 token operations in AWS Sign-In, CreateOAuth2TokenWithIAM (client credentials flow), IntrospectOAuth2TokenWithIAM (token inspection), and RevokeOAuth2TokenWithIAM (token revocation).
+
+3.252.0 (2026-06-10)
+------------------
+
+* Feature - Updated Aws::Signin::Client with the latest API changes.
+
+* Feature - AWS Sign-In now allows customers to control access to the AWS Management Console using resource-based policies. With this release customers can restrict console access based on network perimeters such as VPC IDs, VPC endpoints, and IP addresses.
+
 3.251.0 (2026-06-02)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-3.251.0
+3.257.0

data/lib/aws-sdk-core/json/builder.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'base64'
+require 'bigdecimal'
 
 module Aws
   module Json
@@ -56,21 +57,35 @@ module Aws
         when TimestampShape then timestamp(ref, value)
         when BlobShape      then encode(value)
         when FloatShape     then Util.serialize_number(value)
+        when DocumentShape  then document(value)
         else value
         end
       end
 
+      def document(value)
+        case value
+        when Hash
+          value.transform_values { |v| document(v) }
+        when Array
+          value.map { |v| document(v) }
+        when BigDecimal, Float
+          Util.serialize_number(value.to_f)
+        else
+          value
+        end
+      end
+
       def encode(blob)
         Base64.strict_encode64(String === blob ? blob : blob.read)
       end
 
       def timestamp(ref, value)
         case ref['timestampFormat'] || ref.shape['timestampFormat']
-        when 'iso8601' then value.utc.iso8601
+        when 'iso8601' then Util.serialize_date_time(value)
         when 'rfc822' then value.utc.httpdate
         else
           # rest-json and jsonrpc default to unixTimestamp
-          value.to_i
+          Util.serialize_epoch_seconds(value)
         end
       end
 

data/lib/aws-sdk-core/plugins/user_agent.rb

@@ -211,7 +211,7 @@ variable AWS_SDK_UA_APP_ID or the shared config profile attribute sdk_ua_app_id.
 
               frameworks[match[:name]] = match[:version]
             end
-            frameworks.map { |n, v| "lib/#{n}##{v}" }.join(' ')
+            frameworks.map { |n, v| "lib/#{n}##{v}" }.join(' ') unless frameworks.empty?
           end
 
           def metric_metadata

data/lib/aws-sdk-core/query/ec2_param_builder.rb

@@ -70,11 +70,11 @@ module Aws
 
       def timestamp(ref, value)
         case ref['timestampFormat'] || ref.shape['timestampFormat']
-        when 'unixTimestamp' then value.to_i
+        when 'unixTimestamp' then Util.serialize_epoch_seconds(value)
         when 'rfc822' then value.utc.httpdate
         else
           # ec2 defaults to iso8601
-          value.utc.iso8601
+          Util.serialize_date_time(value)
         end
       end
 

data/lib/aws-sdk-core/query/param_builder.rb

@@ -87,11 +87,11 @@ module Aws
 
       def timestamp(ref, value)
         case ref['timestampFormat'] || ref.shape['timestampFormat']
-        when 'unixTimestamp' then value.to_i
+        when 'unixTimestamp' then Util.serialize_epoch_seconds(value)
         when 'rfc822' then value.utc.httpdate
         else
           # query defaults to iso8601
-          value.utc.iso8601
+          Util.serialize_date_time(value)
         end
       end
 

data/lib/aws-sdk-core/rest/request/endpoint.rb

@@ -66,11 +66,11 @@ module Aws
 
         def timestamp(ref, value)
           case ref['timestampFormat']
-          when 'unixTimestamp' then value.to_i
+          when 'unixTimestamp' then Util.serialize_epoch_seconds(value)
           when 'rfc822' then value.utc.httpdate
           else
             # serializing as RFC 3399 date-time is the default
-            value.utc.iso8601
+            Util.serialize_date_time(value)
           end
         end
 

data/lib/aws-sdk-core/rest/request/headers.rb

@@ -42,8 +42,8 @@ module Aws
 
         def timestamp(ref, value)
           case ref['timestampFormat'] || ref.shape['timestampFormat']
-          when 'unixTimestamp' then value.to_i
-          when 'iso8601' then value.utc.iso8601
+          when 'unixTimestamp' then Util.serialize_epoch_seconds(value)
+          when 'iso8601' then Util.serialize_date_time(value)
           else
             # header default to rfc822
             value.utc.httpdate

data/lib/aws-sdk-core/rest/request/querystring_builder.rb

@@ -63,11 +63,11 @@ module Aws
 
         def timestamp(ref, value)
           case ref['timestampFormat'] || ref.shape['timestampFormat']
-          when 'unixTimestamp' then value.to_i
+          when 'unixTimestamp' then Util.serialize_epoch_seconds(value)
           when 'rfc822' then value.utc.httpdate
           else
             # querystring defaults to iso8601
-            value.utc.iso8601
+            Util.serialize_date_time(value)
           end
         end
 

data/lib/aws-sdk-core/util.rb

@@ -91,6 +91,30 @@ module Aws
         end
       end
 
+      # Serializes a {Time} to the Smithy `epoch-seconds` format: seconds
+      # since the Unix epoch with optional millisecond precision. Whole-second
+      # values are returned as an Integer so the wire format is unchanged for
+      # the common case; sub-millisecond precision is truncated to milliseconds.
+      # @see https://smithy.io/2.0/spec/protocol-traits.html#timestamp-formats
+      # @param [Time] value
+      # @return [Integer, Float]
+      def serialize_epoch_seconds(value)
+        return value.to_i if value.nsec.zero?
+
+        value.to_i + value.nsec / 1_000_000 / 1000.0
+      end
+
+      # Serializes a {Time} to the Smithy `date-time` format: an RFC 3339
+      # (ISO 8601) string with optional millisecond precision and no UTC
+      # offset. Fractional seconds are included only when present, and
+      # sub-millisecond precision is truncated to milliseconds.
+      # @see https://smithy.io/2.0/spec/protocol-traits.html#timestamp-formats
+      # @param [Time] value
+      # @return [String]
+      def serialize_date_time(value)
+        value.nsec.zero? ? value.utc.iso8601 : value.utc.iso8601(3)
+      end
+
       # @param [String] value
       # @return [Time]
       def deserialize_time(value)

data/lib/aws-sdk-core/xml/builder.rb

@@ -106,11 +106,11 @@ module Aws
 
       def timestamp(ref, value)
         case ref['timestampFormat'] || ref.shape['timestampFormat']
-        when 'unixTimestamp' then value.to_i
+        when 'unixTimestamp' then Util.serialize_epoch_seconds(value)
         when 'rfc822' then value.utc.httpdate
         else
           # xml defaults to iso8601
-          value.utc.iso8601
+          Util.serialize_date_time(value)
         end
       end
 

data/lib/aws-sdk-signin/client.rb

@@ -559,6 +559,412 @@ module Aws::Signin
       req.send_request(options)
     end
 
+    # Grants permission to exchange client credentials for an OAuth 2.0
+    # access token scoped to a resource that can be used to access AWS
+    # services from applications
+    #
+    # @option params [required, String] :grant_type
+    #   OAuth 2.0 grant type. Must be "client\_credentials".
+    #
+    # @option params [required, String] :resource
+    #   The OAuth resource for which the access token is requested. Example:
+    #   "aws-mcp.amazonaws.com".
+    #
+    # @return [Types::CreateOAuth2TokenWithIAMResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#access_token #access_token} => String
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#token_type #token_type} => String
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#expires_in #expires_in} => Integer
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.create_o_auth_2_token_with_iam({
+    #     grant_type: "ClientCredentialsGrantType", # required
+    #     resource: "CreateOAuth2TokenWithIAMRequestResourceString", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.access_token #=> String
+    #   resp.token_type #=> String
+    #   resp.expires_in #=> Integer
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload create_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def create_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:create_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
+    # Delete console authorization configuration with automatic scope
+    # detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::DeleteConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::DeleteConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload delete_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def delete_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:delete_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Remove a permission statement from the account's SignIn
+    # resource-based policy
+    #
+    # @option params [required, String] :statement_id
+    #   Unique identifier of the permission statement to delete
+    #
+    # @option params [String] :client_token
+    #   Idempotency token for the request
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_resource_permission_statement({
+    #     statement_id: "StatementId", # required
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/DeleteResourcePermissionStatement AWS API Documentation
+    #
+    # @overload delete_resource_permission_statement(params = {})
+    # @param [Hash] params ({})
+    def delete_resource_permission_statement(params = {}, options = {})
+      req = build_request(:delete_resource_permission_statement, params)
+      req.send_request(options)
+    end
+
+    # Get console authorization configuration with automatic scope detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::GetConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::GetConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload get_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def get_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:get_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Retrieve the account's consolidated SignIn resource-based policy
+    #
+    # @return [Types::GetResourcePolicyOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetResourcePolicyOutput#signin_resource_based_policy #signin_resource_based_policy} => Types::SigninResourceBasedPolicy
+    #
+    # @example Response structure
+    #
+    #   resp.signin_resource_based_policy.version #=> String
+    #   resp.signin_resource_based_policy.statement #=> Array
+    #   resp.signin_resource_based_policy.statement[0].effect #=> String
+    #   resp.signin_resource_based_policy.statement[0].principal #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].principal["String"] #=> String
+    #   resp.signin_resource_based_policy.statement[0].action #=> Array
+    #   resp.signin_resource_based_policy.statement[0].action[0] #=> String
+    #   resp.signin_resource_based_policy.statement[0].resource #=> String
+    #   resp.signin_resource_based_policy.statement[0].condition #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"] #=> Hash
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"]["String"] #=> Array
+    #   resp.signin_resource_based_policy.statement[0].condition["ConditionType"]["String"][0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/GetResourcePolicy AWS API Documentation
+    #
+    # @overload get_resource_policy(params = {})
+    # @param [Hash] params ({})
+    def get_resource_policy(params = {}, options = {})
+      req = build_request(:get_resource_policy, params)
+      req.send_request(options)
+    end
+
+    # Grants permission to inspect the metadata and state of an OAuth 2.0
+    # access token or refresh token
+    #
+    # Implements RFC 7662 OAuth 2.0 Token Introspection over a
+    # SigV4-authenticated endpoint. Inspects the metadata of an
+    # access\_token or refresh\_token issued by AWS Sign-In and returns the
+    # claims associated with it.
+    #
+    # Inactive token semantics (RFC 7662 §2.2): when the supplied token is
+    # unknown, expired, revoked, malformed, or owned by a different account,
+    # the response body is exactly \{ "active": false } with all other
+    # claims omitted.
+    #
+    # @option params [required, String] :token
+    #   The string value of the token to introspect. May be either an
+    #   access\_token or a refresh\_token issued by AWS Sign-In.
+    #
+    # @option params [String] :token_type_hint
+    #   Optional hint about the type of the token submitted for introspection.
+    #   The server uses this hint to optimize lookup, but still falls back to
+    #   the other token type on miss. Allowed values: access\_token,
+    #   refresh\_token.
+    #
+    # @return [Types::IntrospectOAuth2TokenWithIAMResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#active #active} => Boolean
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#client_id #client_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#user_id #user_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#token_type #token_type} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#exp #exp} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#iat #iat} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#nbf #nbf} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#sub #sub} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#aud #aud} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#iss #iss} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#jti #jti} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#account_id #account_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#signin_session #signin_session} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#resource #resource} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.introspect_o_auth_2_token_with_iam({
+    #     token: "IntrospectionToken", # required
+    #     token_type_hint: "TokenTypeHint",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.active #=> Boolean
+    #   resp.client_id #=> String
+    #   resp.user_id #=> String
+    #   resp.token_type #=> String
+    #   resp.exp #=> Integer
+    #   resp.iat #=> Integer
+    #   resp.nbf #=> Integer
+    #   resp.sub #=> String
+    #   resp.aud #=> String
+    #   resp.iss #=> String
+    #   resp.jti #=> String
+    #   resp.account_id #=> String
+    #   resp.signin_session #=> String
+    #   resp.resource #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload introspect_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def introspect_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:introspect_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
+    # Retrieve all permission statements in the account's SignIn
+    # resource-based policy
+    #
+    # @option params [Integer] :max_results
+    #   Maximum number of results to return
+    #
+    # @option params [String] :next_token
+    #   Token for pagination
+    #
+    # @return [Types::ListResourcePermissionStatementsOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListResourcePermissionStatementsOutput#permission_statements #permission_statements} => Array<Types::PermissionStatementSummary>
+    #   * {Types::ListResourcePermissionStatementsOutput#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_resource_permission_statements({
+    #     max_results: 1,
+    #     next_token: "NextToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.permission_statements #=> Array
+    #   resp.permission_statements[0].sid #=> String
+    #   resp.permission_statements[0].condition #=> Hash
+    #   resp.permission_statements[0].condition["ConditionType"] #=> Hash
+    #   resp.permission_statements[0].condition["ConditionType"]["String"] #=> Array
+    #   resp.permission_statements[0].condition["ConditionType"]["String"][0] #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ListResourcePermissionStatements AWS API Documentation
+    #
+    # @overload list_resource_permission_statements(params = {})
+    # @param [Hash] params ({})
+    def list_resource_permission_statements(params = {}, options = {})
+      req = build_request(:list_resource_permission_statements, params)
+      req.send_request(options)
+    end
+
+    # Enable console authorization configuration with automatic scope
+    # detection
+    #
+    # @option params [String] :target_id
+    #   Target account identifier
+    #
+    # @return [Types::PutConsoleAuthorizationConfigurationOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#target_id #target_id} => String
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#scope #scope} => String
+    #   * {Types::PutConsoleAuthorizationConfigurationOutput#console_authorization_enabled #console_authorization_enabled} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.put_console_authorization_configuration({
+    #     target_id: "TargetId",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.target_id #=> String
+    #   resp.scope #=> String
+    #   resp.console_authorization_enabled #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutConsoleAuthorizationConfiguration AWS API Documentation
+    #
+    # @overload put_console_authorization_configuration(params = {})
+    # @param [Hash] params ({})
+    def put_console_authorization_configuration(params = {}, options = {})
+      req = build_request(:put_console_authorization_configuration, params)
+      req.send_request(options)
+    end
+
+    # Create a permission statement in the account's SignIn resource-based
+    # policy
+    #
+    # @option params [String] :source_vpc
+    #   VPC identifier to restrict console access
+    #
+    # @option params [String] :signin_source_vpce
+    #   SignIn VPC endpoint identifier
+    #
+    # @option params [String] :console_source_vpce
+    #   Console VPC endpoint identifier
+    #
+    # @option params [String] :vpc_source_ip
+    #   Source IP address within VPC
+    #
+    # @option params [String] :source_ip
+    #   Source IP address
+    #
+    # @option params [String] :requested_region
+    #   AWS region where the VPC and VPC endpoint reside Required when
+    #   sourceVpc or signinSourceVpce/consoleSourceVpce is provided
+    #
+    # @option params [String] :excluded_principal
+    #   Principal to exclude from the permission statement
+    #
+    # @option params [String] :client_token
+    #   Idempotency token for the request
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Types::PutResourcePermissionStatementOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::PutResourcePermissionStatementOutput#statement_id #statement_id} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.put_resource_permission_statement({
+    #     source_vpc: "SourceVpc",
+    #     signin_source_vpce: "SourceVpce",
+    #     console_source_vpce: "SourceVpce",
+    #     vpc_source_ip: "VpcSourceIp",
+    #     source_ip: "SourceIp",
+    #     requested_region: "RequestedRegion",
+    #     excluded_principal: "ExcludedPrincipal",
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.statement_id #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/PutResourcePermissionStatement AWS API Documentation
+    #
+    # @overload put_resource_permission_statement(params = {})
+    # @param [Hash] params ({})
+    def put_resource_permission_statement(params = {}, options = {})
+      req = build_request(:put_resource_permission_statement, params)
+      req.send_request(options)
+    end
+
+    # Grants permission to revoke an OAuth 2.0 refresh token and its
+    # associated refresh tokens
+    #
+    # Revokes a refresh\_token issued by AWS Sign-In, invalidating the
+    # entire token chain so that the refresh\_token can no longer be used to
+    # mint new access\_tokens.
+    #
+    # Idempotency: revoking an already-revoked, expired, or otherwise
+    # invalid token still returns 200 OK with an empty body. Only the
+    # refresh\_token type is accepted.
+    #
+    # @option params [required, String] :token
+    #   The refresh\_token to revoke. Must be a refresh\_token issued by AWS
+    #   Sign-In (prefix "ASOR"); access\_tokens are not accepted for
+    #   revocation.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.revoke_o_auth_2_token_with_iam({
+    #     token: "RevocationToken", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/RevokeOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload revoke_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def revoke_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:revoke_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
     # @!endgroup
 
     # @param params ({})
@@ -577,7 +983,7 @@ module Aws::Signin
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.251.0'
+      context[:gem_version] = '3.257.0'
       Seahorse::Client::Request.new(handlers, context)
     end