aws-sdk-core 3.252.0 → 3.253.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96694b8f2f5836a441a97a28c54192ac0c7ecd4bc17ce0e7f38aa1979f4b44ce
-  data.tar.gz: 22beaae2d0474238fb04148a1b388ce0de31efa1f8f2ac5c7daff1315cfbb44f
+  metadata.gz: 1247f6da5460ed459d1ac0f815b87533c392520ead96493388af7bf93b416d6c
+  data.tar.gz: 0a12db04017a03fb85be3f57f36230ffb09ce880374147c99acf41526779a2cd
 SHA512:
-  metadata.gz: 40fa25ff493916dd88b63b5bc77f18675e066fbf74a38773adee76b1ec6b4376430d03fb53697ddb0759e11c41815e54c7e30bba71cd0622571f1ae18a47a2d8
-  data.tar.gz: c81b88488d9029025ecec32d86b9fd83ae71b8e144025eaf859227e75996d8f9b1bce06ee375de7f9ac00eea06d36a48744f79b49db4ab3b636596fbcf2a8d19
+  metadata.gz: 37ebe8075e08b7f183fc59920a4ae8d16b434644bd43f0e99110787548e4742ce3816d461a80519517581282a23f3de149202dc9e1a0bba9b81e7d75acaf5153
+  data.tar.gz: fb38b7be043ef6ba002a8d90b26dfd8d6ef4b97f02a3135f2ee434816fd9151d56d033df646880665482eed580a58438859a90df4257d7e2bdeefc8c92fcedf8

data/CHANGELOG.md

@@ -1,6 +1,13 @@
 Unreleased Changes
 ------------------
 
+3.253.0 (2026-07-08)
+------------------
+
+* Feature - Updated Aws::Signin::Client with the latest API changes.
+
+* Feature - Adds support for OAuth 2.0 token operations in AWS Sign-In, CreateOAuth2TokenWithIAM (client credentials flow), IntrospectOAuth2TokenWithIAM (token inspection), and RevokeOAuth2TokenWithIAM (token revocation).
+
 3.252.0 (2026-06-10)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-3.252.0
+3.253.0

data/lib/aws-sdk-signin/client.rb

@@ -559,6 +559,45 @@ module Aws::Signin
       req.send_request(options)
     end
 
+    # Grants permission to exchange client credentials for an OAuth 2.0
+    # access token scoped to a resource that can be used to access AWS
+    # services from applications
+    #
+    # @option params [required, String] :grant_type
+    #   OAuth 2.0 grant type. Must be "client\_credentials".
+    #
+    # @option params [required, String] :resource
+    #   The OAuth resource for which the access token is requested. Example:
+    #   "aws-mcp.amazonaws.com".
+    #
+    # @return [Types::CreateOAuth2TokenWithIAMResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#access_token #access_token} => String
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#token_type #token_type} => String
+    #   * {Types::CreateOAuth2TokenWithIAMResponse#expires_in #expires_in} => Integer
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.create_o_auth_2_token_with_iam({
+    #     grant_type: "ClientCredentialsGrantType", # required
+    #     resource: "CreateOAuth2TokenWithIAMRequestResourceString", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.access_token #=> String
+    #   resp.token_type #=> String
+    #   resp.expires_in #=> Integer
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload create_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def create_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:create_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
     # Delete console authorization configuration with automatic scope
     # detection
     #
@@ -684,6 +723,79 @@ module Aws::Signin
       req.send_request(options)
     end
 
+    # Grants permission to inspect the metadata and state of an OAuth 2.0
+    # access token or refresh token
+    #
+    # Implements RFC 7662 OAuth 2.0 Token Introspection over a
+    # SigV4-authenticated endpoint. Inspects the metadata of an
+    # access\_token or refresh\_token issued by AWS Sign-In and returns the
+    # claims associated with it.
+    #
+    # Inactive token semantics (RFC 7662 §2.2): when the supplied token is
+    # unknown, expired, revoked, malformed, or owned by a different account,
+    # the response body is exactly \{ "active": false } with all other
+    # claims omitted.
+    #
+    # @option params [required, String] :token
+    #   The string value of the token to introspect. May be either an
+    #   access\_token or a refresh\_token issued by AWS Sign-In.
+    #
+    # @option params [String] :token_type_hint
+    #   Optional hint about the type of the token submitted for introspection.
+    #   The server uses this hint to optimize lookup, but still falls back to
+    #   the other token type on miss. Allowed values: access\_token,
+    #   refresh\_token.
+    #
+    # @return [Types::IntrospectOAuth2TokenWithIAMResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#active #active} => Boolean
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#client_id #client_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#user_id #user_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#token_type #token_type} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#exp #exp} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#iat #iat} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#nbf #nbf} => Integer
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#sub #sub} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#aud #aud} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#iss #iss} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#jti #jti} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#account_id #account_id} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#signin_session #signin_session} => String
+    #   * {Types::IntrospectOAuth2TokenWithIAMResponse#resource #resource} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.introspect_o_auth_2_token_with_iam({
+    #     token: "IntrospectionToken", # required
+    #     token_type_hint: "TokenTypeHint",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.active #=> Boolean
+    #   resp.client_id #=> String
+    #   resp.user_id #=> String
+    #   resp.token_type #=> String
+    #   resp.exp #=> Integer
+    #   resp.iat #=> Integer
+    #   resp.nbf #=> Integer
+    #   resp.sub #=> String
+    #   resp.aud #=> String
+    #   resp.iss #=> String
+    #   resp.jti #=> String
+    #   resp.account_id #=> String
+    #   resp.signin_session #=> String
+    #   resp.resource #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload introspect_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def introspect_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:introspect_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
     # Retrieve all permission statements in the account's SignIn
     # resource-based policy
     #
@@ -820,6 +932,39 @@ module Aws::Signin
       req.send_request(options)
     end
 
+    # Grants permission to revoke an OAuth 2.0 refresh token and its
+    # associated refresh tokens
+    #
+    # Revokes a refresh\_token issued by AWS Sign-In, invalidating the
+    # entire token chain so that the refresh\_token can no longer be used to
+    # mint new access\_tokens.
+    #
+    # Idempotency: revoking an already-revoked, expired, or otherwise
+    # invalid token still returns 200 OK with an empty body. Only the
+    # refresh\_token type is accepted.
+    #
+    # @option params [required, String] :token
+    #   The refresh\_token to revoke. Must be a refresh\_token issued by AWS
+    #   Sign-In (prefix "ASOR"); access\_tokens are not accepted for
+    #   revocation.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.revoke_o_auth_2_token_with_iam({
+    #     token: "RevocationToken", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/RevokeOAuth2TokenWithIAM AWS API Documentation
+    #
+    # @overload revoke_o_auth_2_token_with_iam(params = {})
+    # @param [Hash] params ({})
+    def revoke_o_auth_2_token_with_iam(params = {}, options = {})
+      req = build_request(:revoke_o_auth_2_token_with_iam, params)
+      req.send_request(options)
+    end
+
     # @!endgroup
 
     # @param params ({})
@@ -838,7 +983,7 @@ module Aws::Signin
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.252.0'
+      context[:gem_version] = '3.253.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-signin/client_api.rb

@@ -16,8 +16,11 @@ module Aws::Signin
 
     AccessDeniedException = Shapes::StructureShape.new(name: 'AccessDeniedException')
     AccessToken = Shapes::StructureShape.new(name: 'AccessToken')
+    AccountId = Shapes::StringShape.new(name: 'AccountId')
     AuthorizationCode = Shapes::StringShape.new(name: 'AuthorizationCode')
+    BearerTokenType = Shapes::StringShape.new(name: 'BearerTokenType')
     Boolean = Shapes::BooleanShape.new(name: 'Boolean')
+    ClientCredentialsGrantType = Shapes::StringShape.new(name: 'ClientCredentialsGrantType')
     ClientId = Shapes::StringShape.new(name: 'ClientId')
     ClientToken = Shapes::StringShape.new(name: 'ClientToken')
     CodeVerifier = Shapes::StringShape.new(name: 'CodeVerifier')
@@ -31,6 +34,9 @@ module Aws::Signin
     CreateOAuth2TokenRequestBody = Shapes::StructureShape.new(name: 'CreateOAuth2TokenRequestBody')
     CreateOAuth2TokenResponse = Shapes::StructureShape.new(name: 'CreateOAuth2TokenResponse')
     CreateOAuth2TokenResponseBody = Shapes::StructureShape.new(name: 'CreateOAuth2TokenResponseBody')
+    CreateOAuth2TokenWithIAMRequest = Shapes::StructureShape.new(name: 'CreateOAuth2TokenWithIAMRequest')
+    CreateOAuth2TokenWithIAMRequestResourceString = Shapes::StringShape.new(name: 'CreateOAuth2TokenWithIAMRequestResourceString')
+    CreateOAuth2TokenWithIAMResponse = Shapes::StructureShape.new(name: 'CreateOAuth2TokenWithIAMResponse')
     DeleteConsoleAuthorizationConfigurationInput = Shapes::StructureShape.new(name: 'DeleteConsoleAuthorizationConfigurationInput')
     DeleteConsoleAuthorizationConfigurationOutput = Shapes::StructureShape.new(name: 'DeleteConsoleAuthorizationConfigurationOutput')
     DeleteResourcePermissionStatementInput = Shapes::StructureShape.new(name: 'DeleteResourcePermissionStatementInput')
@@ -44,10 +50,16 @@ module Aws::Signin
     GrantType = Shapes::StringShape.new(name: 'GrantType')
     IdToken = Shapes::StringShape.new(name: 'IdToken')
     InternalServerException = Shapes::StructureShape.new(name: 'InternalServerException')
+    IntrospectOAuth2TokenWithIAMRequest = Shapes::StructureShape.new(name: 'IntrospectOAuth2TokenWithIAMRequest')
+    IntrospectOAuth2TokenWithIAMResponse = Shapes::StructureShape.new(name: 'IntrospectOAuth2TokenWithIAMResponse')
+    IntrospectedTokenType = Shapes::StringShape.new(name: 'IntrospectedTokenType')
+    IntrospectionToken = Shapes::StringShape.new(name: 'IntrospectionToken')
     ListResourcePermissionStatementsInput = Shapes::StructureShape.new(name: 'ListResourcePermissionStatementsInput')
     ListResourcePermissionStatementsOutput = Shapes::StructureShape.new(name: 'ListResourcePermissionStatementsOutput')
+    Long = Shapes::IntegerShape.new(name: 'Long')
     NextToken = Shapes::StringShape.new(name: 'NextToken')
     OAuth2ErrorCode = Shapes::StringShape.new(name: 'OAuth2ErrorCode')
+    OAuthAccessToken = Shapes::StringShape.new(name: 'OAuthAccessToken')
     PermissionStatementSummaries = Shapes::ListShape.new(name: 'PermissionStatementSummaries')
     PermissionStatementSummary = Shapes::StructureShape.new(name: 'PermissionStatementSummary')
     PolicyActions = Shapes::ListShape.new(name: 'PolicyActions')
@@ -62,6 +74,9 @@ module Aws::Signin
     RefreshToken = Shapes::StringShape.new(name: 'RefreshToken')
     RequestedRegion = Shapes::StringShape.new(name: 'RequestedRegion')
     ResourceNotFoundException = Shapes::StructureShape.new(name: 'ResourceNotFoundException')
+    RevocationToken = Shapes::StringShape.new(name: 'RevocationToken')
+    RevokeOAuth2TokenWithIAMRequest = Shapes::StructureShape.new(name: 'RevokeOAuth2TokenWithIAMRequest')
+    RevokeOAuth2TokenWithIAMResponse = Shapes::StructureShape.new(name: 'RevokeOAuth2TokenWithIAMResponse')
     ServiceQuotaExceededException = Shapes::StructureShape.new(name: 'ServiceQuotaExceededException')
     SigninResourceBasedPolicy = Shapes::StructureShape.new(name: 'SigninResourceBasedPolicy')
     SourceIp = Shapes::StringShape.new(name: 'SourceIp')
@@ -70,7 +85,9 @@ module Aws::Signin
     StatementId = Shapes::StringShape.new(name: 'StatementId')
     String = Shapes::StringShape.new(name: 'String')
     TargetId = Shapes::StringShape.new(name: 'TargetId')
+    TokenExpiresIn = Shapes::IntegerShape.new(name: 'TokenExpiresIn')
     TokenType = Shapes::StringShape.new(name: 'TokenType')
+    TokenTypeHint = Shapes::StringShape.new(name: 'TokenTypeHint')
     TooManyRequestsError = Shapes::StructureShape.new(name: 'TooManyRequestsError')
     ValidationException = Shapes::StructureShape.new(name: 'ValidationException')
     VpcSourceIp = Shapes::StringShape.new(name: 'VpcSourceIp')
@@ -121,6 +138,15 @@ module Aws::Signin
     CreateOAuth2TokenResponseBody.add_member(:id_token, Shapes::ShapeRef.new(shape: IdToken, location_name: "idToken"))
     CreateOAuth2TokenResponseBody.struct_class = Types::CreateOAuth2TokenResponseBody
 
+    CreateOAuth2TokenWithIAMRequest.add_member(:grant_type, Shapes::ShapeRef.new(shape: ClientCredentialsGrantType, required: true, location_name: "grant_type"))
+    CreateOAuth2TokenWithIAMRequest.add_member(:resource, Shapes::ShapeRef.new(shape: CreateOAuth2TokenWithIAMRequestResourceString, required: true, location_name: "resource"))
+    CreateOAuth2TokenWithIAMRequest.struct_class = Types::CreateOAuth2TokenWithIAMRequest
+
+    CreateOAuth2TokenWithIAMResponse.add_member(:access_token, Shapes::ShapeRef.new(shape: OAuthAccessToken, required: true, location_name: "access_token"))
+    CreateOAuth2TokenWithIAMResponse.add_member(:token_type, Shapes::ShapeRef.new(shape: BearerTokenType, required: true, location_name: "token_type"))
+    CreateOAuth2TokenWithIAMResponse.add_member(:expires_in, Shapes::ShapeRef.new(shape: TokenExpiresIn, required: true, location_name: "expires_in"))
+    CreateOAuth2TokenWithIAMResponse.struct_class = Types::CreateOAuth2TokenWithIAMResponse
+
     DeleteConsoleAuthorizationConfigurationInput.add_member(:target_id, Shapes::ShapeRef.new(shape: TargetId, location_name: "targetId"))
     DeleteConsoleAuthorizationConfigurationInput.struct_class = Types::DeleteConsoleAuthorizationConfigurationInput
 
@@ -152,6 +178,26 @@ module Aws::Signin
     InternalServerException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "message"))
     InternalServerException.struct_class = Types::InternalServerException
 
+    IntrospectOAuth2TokenWithIAMRequest.add_member(:token, Shapes::ShapeRef.new(shape: IntrospectionToken, required: true, location_name: "token"))
+    IntrospectOAuth2TokenWithIAMRequest.add_member(:token_type_hint, Shapes::ShapeRef.new(shape: TokenTypeHint, location_name: "token_type_hint"))
+    IntrospectOAuth2TokenWithIAMRequest.struct_class = Types::IntrospectOAuth2TokenWithIAMRequest
+
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:active, Shapes::ShapeRef.new(shape: Boolean, required: true, location_name: "active"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:client_id, Shapes::ShapeRef.new(shape: String, location_name: "client_id"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:user_id, Shapes::ShapeRef.new(shape: String, location_name: "user_id"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:token_type, Shapes::ShapeRef.new(shape: IntrospectedTokenType, location_name: "token_type"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:exp, Shapes::ShapeRef.new(shape: Long, location_name: "exp"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:iat, Shapes::ShapeRef.new(shape: Long, location_name: "iat"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:nbf, Shapes::ShapeRef.new(shape: Long, location_name: "nbf"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:sub, Shapes::ShapeRef.new(shape: String, location_name: "sub"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:aud, Shapes::ShapeRef.new(shape: String, location_name: "aud"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:iss, Shapes::ShapeRef.new(shape: String, location_name: "iss"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:jti, Shapes::ShapeRef.new(shape: String, location_name: "jti"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:account_id, Shapes::ShapeRef.new(shape: AccountId, location_name: "account_id"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:signin_session, Shapes::ShapeRef.new(shape: String, location_name: "signin_session"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:resource, Shapes::ShapeRef.new(shape: String, location_name: "resource"))
+    IntrospectOAuth2TokenWithIAMResponse.struct_class = Types::IntrospectOAuth2TokenWithIAMResponse
+
     ListResourcePermissionStatementsInput.add_member(:max_results, Shapes::ShapeRef.new(shape: ConsolePermissionMaxResults, location_name: "maxResults"))
     ListResourcePermissionStatementsInput.add_member(:next_token, Shapes::ShapeRef.new(shape: NextToken, location_name: "nextToken"))
     ListResourcePermissionStatementsInput.struct_class = Types::ListResourcePermissionStatementsInput
@@ -205,6 +251,11 @@ module Aws::Signin
     ResourceNotFoundException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "message"))
     ResourceNotFoundException.struct_class = Types::ResourceNotFoundException
 
+    RevokeOAuth2TokenWithIAMRequest.add_member(:token, Shapes::ShapeRef.new(shape: RevocationToken, required: true, location_name: "token"))
+    RevokeOAuth2TokenWithIAMRequest.struct_class = Types::RevokeOAuth2TokenWithIAMRequest
+
+    RevokeOAuth2TokenWithIAMResponse.struct_class = Types::RevokeOAuth2TokenWithIAMResponse
+
     ServiceQuotaExceededException.add_member(:error, Shapes::ShapeRef.new(shape: OAuth2ErrorCode, required: true, location_name: "error"))
     ServiceQuotaExceededException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "message"))
     ServiceQuotaExceededException.struct_class = Types::ServiceQuotaExceededException
@@ -254,6 +305,18 @@ module Aws::Signin
         o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
       end)
 
+      api.add_operation(:create_o_auth_2_token_with_iam, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "CreateOAuth2TokenWithIAM"
+        o.http_method = "POST"
+        o.http_request_uri = "/v1/token?x-amz-client-auth-method=iam"
+        o.input = Shapes::ShapeRef.new(shape: CreateOAuth2TokenWithIAMRequest)
+        o.output = Shapes::ShapeRef.new(shape: CreateOAuth2TokenWithIAMResponse)
+        o.errors << Shapes::ShapeRef.new(shape: TooManyRequestsError)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
+        o.errors << Shapes::ShapeRef.new(shape: ValidationException)
+        o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
+      end)
+
       api.add_operation(:delete_console_authorization_configuration, Seahorse::Model::Operation.new.tap do |o|
         o.name = "DeleteConsoleAuthorizationConfiguration"
         o.http_method = "POST"
@@ -305,6 +368,18 @@ module Aws::Signin
         o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
       end)
 
+      api.add_operation(:introspect_o_auth_2_token_with_iam, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "IntrospectOAuth2TokenWithIAM"
+        o.http_method = "POST"
+        o.http_request_uri = "/v1/introspect?x-amz-client-auth-method=iam"
+        o.input = Shapes::ShapeRef.new(shape: IntrospectOAuth2TokenWithIAMRequest)
+        o.output = Shapes::ShapeRef.new(shape: IntrospectOAuth2TokenWithIAMResponse)
+        o.errors << Shapes::ShapeRef.new(shape: TooManyRequestsError)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
+        o.errors << Shapes::ShapeRef.new(shape: ValidationException)
+        o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
+      end)
+
       api.add_operation(:list_resource_permission_statements, Seahorse::Model::Operation.new.tap do |o|
         o.name = "ListResourcePermissionStatements"
         o.http_method = "POST"
@@ -351,6 +426,18 @@ module Aws::Signin
         o.errors << Shapes::ShapeRef.new(shape: ValidationException)
         o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
       end)
+
+      api.add_operation(:revoke_o_auth_2_token_with_iam, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "RevokeOAuth2TokenWithIAM"
+        o.http_method = "POST"
+        o.http_request_uri = "/v1/revoke?x-amz-client-auth-method=iam"
+        o.input = Shapes::ShapeRef.new(shape: RevokeOAuth2TokenWithIAMRequest)
+        o.output = Shapes::ShapeRef.new(shape: RevokeOAuth2TokenWithIAMResponse)
+        o.errors << Shapes::ShapeRef.new(shape: TooManyRequestsError)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
+        o.errors << Shapes::ShapeRef.new(shape: ValidationException)
+        o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
+      end)
     end
 
   end

data/lib/aws-sdk-signin/endpoint_parameters.rb

@@ -35,12 +35,18 @@ module Aws::Signin
   #
   #   @return [boolean]
   #
+  # @!attribute is_o_auth_endpoint
+  #   Indicates if the operation targets the OAuth token endpoint
+  #
+  #   @return [boolean]
+  #
   EndpointParameters = Struct.new(
     :use_dual_stack,
     :use_fips,
     :endpoint,
     :region,
     :is_control_plane,
+    :is_o_auth_endpoint,
   ) do
     include Aws::Structure
 
@@ -52,6 +58,7 @@ module Aws::Signin
         'Endpoint' => :endpoint,
         'Region' => :region,
         'IsControlPlane' => :is_control_plane,
+        'IsOAuthEndpoint' => :is_o_auth_endpoint,
       }.freeze
     end
 
@@ -63,6 +70,7 @@ module Aws::Signin
       self[:endpoint] = options[:endpoint]
       self[:region] = options[:region]
       self[:is_control_plane] = options[:is_control_plane]
+      self[:is_o_auth_endpoint] = options[:is_o_auth_endpoint]
     end
 
     def self.create(config, options={})

data/lib/aws-sdk-signin/endpoint_provider.rb

@@ -19,6 +19,12 @@ module Aws::Signin
         end
         return Aws::Endpoints::Endpoint.new(url: "https://signin.#{parameters.region}.#{partition_result['dualStackDnsSuffix']}", headers: {}, properties: {"authSchemes" => [{"name" => "sigv4", "signingName" => "signin", "signingRegion" => "#{parameters.region}"}]})
       end
+      if Aws::Endpoints::Matchers.set?(parameters.is_o_auth_endpoint) && Aws::Endpoints::Matchers.boolean_equals?(parameters.is_o_auth_endpoint, true) && Aws::Endpoints::Matchers.boolean_equals?(parameters.use_fips, true)
+        raise ArgumentError, "FIPS endpoints are not supported for OAuth operations. Disable FIPS or use a non-OAuth operation."
+      end
+      if Aws::Endpoints::Matchers.set?(parameters.is_o_auth_endpoint) && Aws::Endpoints::Matchers.boolean_equals?(parameters.is_o_auth_endpoint, true) && Aws::Endpoints::Matchers.set?(parameters.region) && Aws::Endpoints::Matchers.not(Aws::Endpoints::Matchers.set?(parameters.endpoint)) && (partition_result = Aws::Endpoints::Matchers.aws_partition(parameters.region)) && Aws::Endpoints::Matchers.string_equals?(Aws::Endpoints::Matchers.attr(partition_result, "name"), "aws")
+        return Aws::Endpoints::Endpoint.new(url: "https://#{parameters.region}.oauth.signin.aws", headers: {}, properties: {"authSchemes" => [{"name" => "sigv4", "signingName" => "signin", "signingRegion" => "#{parameters.region}"}]})
+      end
       if Aws::Endpoints::Matchers.set?(parameters.region) && Aws::Endpoints::Matchers.not(Aws::Endpoints::Matchers.set?(parameters.endpoint)) && Aws::Endpoints::Matchers.boolean_equals?(parameters.use_fips, false) && Aws::Endpoints::Matchers.boolean_equals?(parameters.use_dual_stack, false) && (partition_result = Aws::Endpoints::Matchers.aws_partition(parameters.region)) && Aws::Endpoints::Matchers.string_equals?(Aws::Endpoints::Matchers.attr(partition_result, "name"), "aws")
         return Aws::Endpoints::Endpoint.new(url: "https://#{parameters.region}.signin.aws.amazon.com", headers: {}, properties: {})
       end

data/lib/aws-sdk-signin/endpoints.rb

@@ -12,6 +12,15 @@ module Aws::Signin
   # @api private
   module Endpoints
 
+    class CreateOAuth2TokenWithIAM
+      def self.build(context)
+        Aws::Signin::EndpointParameters.create(
+          context.config,
+          is_o_auth_endpoint: true,
+        )
+      end
+    end
+
     class DeleteConsoleAuthorizationConfiguration
       def self.build(context)
         Aws::Signin::EndpointParameters.create(
@@ -48,6 +57,15 @@ module Aws::Signin
       end
     end
 
+    class IntrospectOAuth2TokenWithIAM
+      def self.build(context)
+        Aws::Signin::EndpointParameters.create(
+          context.config,
+          is_o_auth_endpoint: true,
+        )
+      end
+    end
+
     class ListResourcePermissionStatements
       def self.build(context)
         Aws::Signin::EndpointParameters.create(
@@ -75,9 +93,20 @@ module Aws::Signin
       end
     end
 
+    class RevokeOAuth2TokenWithIAM
+      def self.build(context)
+        Aws::Signin::EndpointParameters.create(
+          context.config,
+          is_o_auth_endpoint: true,
+        )
+      end
+    end
+
 
     def self.parameters_for_operation(context)
       case context.operation_name
+      when :create_o_auth_2_token_with_iam
+        CreateOAuth2TokenWithIAM.build(context)
       when :delete_console_authorization_configuration
         DeleteConsoleAuthorizationConfiguration.build(context)
       when :delete_resource_permission_statement
@@ -86,12 +115,16 @@ module Aws::Signin
         GetConsoleAuthorizationConfiguration.build(context)
       when :get_resource_policy
         GetResourcePolicy.build(context)
+      when :introspect_o_auth_2_token_with_iam
+        IntrospectOAuth2TokenWithIAM.build(context)
       when :list_resource_permission_statements
         ListResourcePermissionStatements.build(context)
       when :put_console_authorization_configuration
         PutConsoleAuthorizationConfiguration.build(context)
       when :put_resource_permission_statement
         PutResourcePermissionStatement.build(context)
+      when :revoke_o_auth_2_token_with_iam
+        RevokeOAuth2TokenWithIAM.build(context)
       else
         Aws::Signin::EndpointParameters.create(context.config)
       end

data/lib/aws-sdk-signin/types.rb

@@ -45,9 +45,7 @@ module Aws::Signin
 
     # AWS credentials structure containing temporary access credentials
     #
-    # The scoped-down, 15 minute duration AWS credentials. Scoping down will
-    # be based on CLI policy (CLI team needs to create it). Similar to cloud
-    # shell implementation.
+    # Scoped, temporary AWS credentials with a 15-minute duration.
     #
     # @!attribute [rw] access_key_id
     #   AWS access key ID for temporary credentials
@@ -232,6 +230,55 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # Input structure for CreateOAuth2TokenWithIAM operation
+    #
+    # @!attribute [rw] grant_type
+    #   OAuth 2.0 grant type. Must be "client\_credentials".
+    #   @return [String]
+    #
+    # @!attribute [rw] resource
+    #   The OAuth resource for which the access token is requested. Example:
+    #   "aws-mcp.amazonaws.com".
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithIAMRequest AWS API Documentation
+    #
+    class CreateOAuth2TokenWithIAMRequest < Struct.new(
+      :grant_type,
+      :resource)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Output structure for CreateOAuth2TokenWithIAM operation
+    #
+    # Contains the JWT access token, token type, and expiration per RFC 6749
+    # §5.1.
+    #
+    # @!attribute [rw] access_token
+    #   JWT access token containing principal identity, resource scope, and
+    #   session metadata
+    #   @return [String]
+    #
+    # @!attribute [rw] token_type
+    #   Always "Bearer" per OAuth 2.1 specification
+    #   @return [String]
+    #
+    # @!attribute [rw] expires_in
+    #   Token lifetime in seconds. Value is the minimum of session validity
+    #   and 1 hour.
+    #   @return [Integer]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithIAMResponse AWS API Documentation
+    #
+    class CreateOAuth2TokenWithIAMResponse < Struct.new(
+      :access_token,
+      :token_type,
+      :expires_in)
+      SENSITIVE = [:access_token]
+      include Aws::Structure
+    end
+
     # Input for DeleteConsoleAuthorizationConfiguration operation
     #
     # @!attribute [rw] target_id
@@ -384,6 +431,125 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # Input structure for IntrospectOAuth2TokenWithIAM operation
+    #
+    # RFC 7662 §2.1 introspection request. Contains the token to inspect and
+    # an optional hint about the token's type.
+    #
+    # @!attribute [rw] token
+    #   The string value of the token to introspect. May be either an
+    #   access\_token or a refresh\_token issued by AWS Sign-In.
+    #   @return [String]
+    #
+    # @!attribute [rw] token_type_hint
+    #   Optional hint about the type of the token submitted for
+    #   introspection. The server uses this hint to optimize lookup, but
+    #   still falls back to the other token type on miss. Allowed values:
+    #   access\_token, refresh\_token.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAMRequest AWS API Documentation
+    #
+    class IntrospectOAuth2TokenWithIAMRequest < Struct.new(
+      :token,
+      :token_type_hint)
+      SENSITIVE = [:token]
+      include Aws::Structure
+    end
+
+    # Output structure for IntrospectOAuth2TokenWithIAM operation
+    #
+    # RFC 7662 §2.2 introspection response. Only `active` is required; all
+    # other claims are omitted when the token is inactive.
+    #
+    # @!attribute [rw] active
+    #   Indicates whether the token is currently active. `true` only when
+    #   the token is valid, has not expired, has not been revoked, and
+    #   belongs to the caller's account.
+    #   @return [Boolean]
+    #
+    # @!attribute [rw] client_id
+    #   Client identifier for the OAuth 2.0 client that requested the token.
+    #   @return [String]
+    #
+    # @!attribute [rw] user_id
+    #   User identifier matching sts:GetCallerIdentity's `UserId` field for
+    #   the token's subject principal (e.g. "AIDAEXAMPLE" for an IAM user,
+    #   or "AROAEXAMPLE:session-name" for an assumed role).
+    #   @return [String]
+    #
+    # @!attribute [rw] token_type
+    #   Indicates which kind of token was introspected. One of
+    #   "access\_token" or "refresh\_token".
+    #   @return [String]
+    #
+    # @!attribute [rw] exp
+    #   Token expiration time as a NumericDate (Unix epoch seconds).
+    #   @return [Integer]
+    #
+    # @!attribute [rw] iat
+    #   Token issuance time as a NumericDate (Unix epoch seconds).
+    #   @return [Integer]
+    #
+    # @!attribute [rw] nbf
+    #   Token "not before" time as a NumericDate (Unix epoch seconds).
+    #   @return [Integer]
+    #
+    # @!attribute [rw] sub
+    #   Subject of the token: the IAM principal ARN. For assumed-role
+    #   sessions, this is the session ARN (matches sts:GetCallerIdentity's
+    #   `Arn` field), e.g.
+    #   arn:aws:sts::123456789012:assumed-role/MyRole/session-name.
+    #   @return [String]
+    #
+    # @!attribute [rw] aud
+    #   Audience of the token: the OAuth resource the token is scoped to
+    #   (for example, "aws-mcp.amazonaws.com"). Omitted for refresh tokens.
+    #   @return [String]
+    #
+    # @!attribute [rw] iss
+    #   Issuer of the token. Always "signin.amazonaws.com" for AWS Sign-In.
+    #   @return [String]
+    #
+    # @!attribute [rw] jti
+    #   Unique identifier for the token.
+    #   @return [String]
+    #
+    # @!attribute [rw] account_id
+    #   12-digit AWS account ID of the token's subject principal.
+    #   @return [String]
+    #
+    # @!attribute [rw] signin_session
+    #   AWS Sign-In session ARN bound to the token, of the form
+    #   arn:aws:signin:\{region}:\{account}:session/\{uuid}.
+    #   @return [String]
+    #
+    # @!attribute [rw] resource
+    #   The OAuth resource the token is scoped to during Human OAuth flow.
+    #   Only present for refresh token introspection.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAMResponse AWS API Documentation
+    #
+    class IntrospectOAuth2TokenWithIAMResponse < Struct.new(
+      :active,
+      :client_id,
+      :user_id,
+      :token_type,
+      :exp,
+      :iat,
+      :nbf,
+      :sub,
+      :aud,
+      :iss,
+      :jti,
+      :account_id,
+      :signin_session,
+      :resource)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Input for ListResourcePermissionStatements operation
     #
     # @!attribute [rw] max_results
@@ -605,6 +771,34 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # Input structure for RevokeOAuth2TokenWithIAM operation
+    #
+    # RFC 7009 §2.1 revocation request. Contains the refresh\_token to
+    # revoke.
+    #
+    # @!attribute [rw] token
+    #   The refresh\_token to revoke. Must be a refresh\_token issued by AWS
+    #   Sign-In (prefix "ASOR"); access\_tokens are not accepted for
+    #   revocation.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/RevokeOAuth2TokenWithIAMRequest AWS API Documentation
+    #
+    class RevokeOAuth2TokenWithIAMRequest < Struct.new(
+      :token)
+      SENSITIVE = [:token]
+      include Aws::Structure
+    end
+
+    # Output structure for RevokeOAuth2TokenWithIAM operation
+    #
+    # RFC 7009 §2.2 revocation response. The endpoint returns 200 OK with an
+    # empty body on success; there are no response fields.
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/RevokeOAuth2TokenWithIAMResponse AWS API Documentation
+    #
+    class RevokeOAuth2TokenWithIAMResponse < Aws::EmptyStructure; end
+
     # Error thrown when service quota is exceeded
     #
     # HTTP Status Code: 402 Payment Required (used as quota exceeded

data/lib/aws-sdk-signin.rb

@@ -56,7 +56,7 @@ module Aws::Signin
   autoload :EndpointProvider, 'aws-sdk-signin/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-signin/endpoints'
 
-  GEM_VERSION = '3.252.0'
+  GEM_VERSION = '3.253.0'
 
 end
 

data/lib/aws-sdk-sso/client.rb

@@ -696,7 +696,7 @@ module Aws::SSO
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.252.0'
+      context[:gem_version] = '3.253.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sso.rb

@@ -56,7 +56,7 @@ module Aws::SSO
   autoload :EndpointProvider, 'aws-sdk-sso/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-sso/endpoints'
 
-  GEM_VERSION = '3.252.0'
+  GEM_VERSION = '3.253.0'
 
 end
 

data/lib/aws-sdk-ssooidc/client.rb

@@ -1079,7 +1079,7 @@ module Aws::SSOOIDC
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.252.0'
+      context[:gem_version] = '3.253.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-ssooidc.rb

@@ -56,7 +56,7 @@ module Aws::SSOOIDC
   autoload :EndpointProvider, 'aws-sdk-ssooidc/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-ssooidc/endpoints'
 
-  GEM_VERSION = '3.252.0'
+  GEM_VERSION = '3.253.0'
 
 end
 

data/lib/aws-sdk-sts/client.rb

@@ -2723,7 +2723,7 @@ module Aws::STS
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.252.0'
+      context[:gem_version] = '3.253.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sts.rb

@@ -56,7 +56,7 @@ module Aws::STS
   autoload :EndpointProvider, 'aws-sdk-sts/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-sts/endpoints'
 
-  GEM_VERSION = '3.252.0'
+  GEM_VERSION = '3.253.0'
 
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-core
 version: !ruby/object:Gem::Version
-  version: 3.252.0
+  version: 3.253.0
 platform: ruby
 authors:
 - Amazon Web Services