aws-sdk-core 3.259.0 → 3.261.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93ccf3840b0f63a4c858a86e32b3ffd0da53987ca07d9a676dd25b5cfd16099f
-  data.tar.gz: cb11cf24f734a8c4ddb5c8cfefa4f1d82d3ad568f1a3fa9689dae93657d08f95
+  metadata.gz: 20963c4ba4573dca660c592bc7996d2fd17aa339c20aa91421a4aed2de76f591
+  data.tar.gz: 812e6f68eeb111cf9ce4bb7952038fac6a06fc9aad14d787657bc8eafca3b4aa
 SHA512:
-  metadata.gz: 303005da1d6dace6cd1beede5b11f80f9104ab67908138f2b3af3ec084aa2b2e935097a9dad2cb9934ff4a41e2034577232d077d96ba967acbdab143eda63a3c
-  data.tar.gz: 6d38ba80f43df46dbb0771b10a823d99b0a38b9c6b6c4e274e240940b458b8a25eba499b81e0c1fdb7c630270fe3d268ef09d9749b121b9e1ec681834a8f674b
+  metadata.gz: ca2d95bc30f9cbb1a2a8fab0423b1a59a765995d2203925a755d822920e371c29cb2951f8b97a515388671f54bf7f00f96c76477f9e0d5034165323158eed23f
+  data.tar.gz: 35a7731340719f2a9fa90275e7ee00b3081f161e3d98c423ad2545ad9b2d9c9c395b1b757e1bf0e35832ffd18499a8f41a7762eced0f21d2175090e33f48b975

data/CHANGELOG.md

@@ -1,6 +1,20 @@
 Unreleased Changes
 ------------------
 
+3.261.0 (2026-10-26)
+------------------
+
+* Feature - Updated Aws::Signin::Client with the latest API changes.
+
+* Feature - Adds support for the OAuth 2.0 Token Exchange grant (RFC 8693), enabling applications to exchange identity provider issued JSON Web Tokens (JWTs) for short-lived OAuth access tokens to access supported AWS services without managing separate AWS credentials.
+
+3.260.0 (2026-10-21)
+------------------
+
+* Issue - Remove the `AAA Certificate Services` root from the bundled CA file. It cross-signed eMudhra intermediate CAs whose private keys were compromised. This only affects applications that opt in with `Aws.use_bundled_cert!` and use it to reach non-AWS endpoints; AWS service endpoints are not affected.
+
+* Feature - Bump the minimum version of the aws-eventstream dependency.
+
 3.259.0 (2026-10-20)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-3.259.0
+3.261.0

data/ca-bundle.crt

@@ -851,32 +851,6 @@ fhiYtUU79nm06PcaewaD+9CL2rvHvRirCG88gGtAPxkZumWK5r7VXNM21+9AUiRg
 OGcEMeyP84LG3rlV8zsxkVrctQgVrXYlCg17LofiDKYGvCYQbTed7N14jHyAxfDZ
 d0jQ
 -----END CERTIFICATE-----
-# CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
------BEGIN CERTIFICATE-----
-MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
-MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
-GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
-YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
-MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
-BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
-GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
-BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
-3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
-YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
-rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
-ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
-oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
-MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
-QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
-b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
-AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
-GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
-Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
-G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
-l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
-smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
------END CERTIFICATE-----
 # CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 -----BEGIN CERTIFICATE-----
 MIIEHTCCAwWgAwIBAgIQToEtioJl4AsC7j41AkblPTANBgkqhkiG9w0BAQUFADCB

data/lib/aws-sdk-signin/client.rb

@@ -481,54 +481,12 @@ module Aws::Signin
 
     # @!group API Operations
 
-    # CreateOAuth2Token API
-    #
-    # Path: /v1/token Request Method: POST Content-Type: application/json or
-    # application/x-www-form-urlencoded
-    #
-    # This API implements OAuth 2.0 flows for AWS Sign-In CLI clients,
-    # supporting both:
-    #
-    # 1.  Authorization code redemption (grant\_type=authorization\_code) -
-    #     NOT idempotent
-    # 2.  Token refresh (grant\_type=refresh\_token) - Idempotent within
-    #     token validity window
-    #
-    # The operation behavior is determined by the grant\_type parameter in
-    # the request body:
-    #
-    # **Authorization Code Flow (NOT Idempotent):**
-    #
-    # * JSON or form-encoded body with client\_id,
-    #   grant\_type=authorization\_code, code, redirect\_uri, code\_verifier
-    # * Returns access\_token, token\_type, expires\_in, refresh\_token, and
-    #   id\_token
-    # * Each authorization code can only be used ONCE for security (prevents
-    #   replay attacks)
-    #
-    # **Token Refresh Flow (Idempotent):**
-    #
-    # * JSON or form-encoded body with client\_id,
-    #   grant\_type=refresh\_token, refresh\_token
-    # * Returns access\_token, token\_type, expires\_in, and refresh\_token
-    #   (no id\_token)
-    # * Multiple calls with same refresh\_token return consistent results
-    #   within validity window
-    #
-    # Authentication and authorization:
-    #
-    # * Confidential clients: sigv4 signing required with
-    #   signin:ExchangeToken permissions
-    # * CLI clients (public): authn/authz skipped based on client\_id &
-    #   grant\_type
-    #
-    # Note: This operation cannot be marked as @idempotent because it
-    # handles both idempotent (token refresh) and non-idempotent (auth code
-    # redemption) flows in a single endpoint.
+    # Exchanges an authorization code or refresh token for an OAuth 2.0
+    # access token and refresh token.
     #
     # @option params [required, Types::CreateOAuth2TokenRequestBody] :token_input
-    #   Flattened token operation inputs The specific operation is determined
-    #   by grant\_type in the request body
+    #   Flattened token operation inputs. The "grant\_type" in the request
+    #   body determines the specific operation.
     #
     # @return [Types::CreateOAuth2TokenResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -566,12 +524,11 @@ module Aws::Signin
       req.send_request(options)
     end
 
-    # Grants permission to exchange client credentials for an OAuth 2.0
-    # access token scoped to a resource that can be used to access AWS
-    # services from applications
+    # Exchanges client credentials for an OAuth 2.0 access token scoped to a
+    # resource, which you can use to access AWS services from applications.
     #
     # @option params [required, String] :grant_type
-    #   OAuth 2.0 grant type. Must be "client\_credentials".
+    #   The OAuth 2.0 grant type. Must be "client\_credentials".
     #
     # @option params [required, String] :resource
     #   The OAuth resource for which the access token is requested. Example:
@@ -587,7 +544,7 @@ module Aws::Signin
     #
     #   resp = client.create_o_auth_2_token_with_iam({
     #     grant_type: "ClientCredentialsGrantType", # required
-    #     resource: "CreateOAuth2TokenWithIAMRequestResourceString", # required
+    #     resource: "Resource", # required
     #   })
     #
     # @example Response structure
@@ -605,6 +562,67 @@ module Aws::Signin
       req.send_request(options)
     end
 
+    # Exchanges a supported token for an OAuth 2.0 access token scoped to a
+    # resource, which you can use to access AWS services from applications.
+    #
+    # @option params [required, String] :grant_type
+    #   The OAuth 2.0 grant type. Currently only supports
+    #   "urn:ietf:params:oauth:grant-type:token-exchange".
+    #
+    # @option params [String] :subject_token
+    #   The subject token that represents the identity of the party on whose
+    #   behalf the request is made. Required when
+    #   "grant\_type=urn:ietf:params:oauth:grant-type:token-exchange".
+    #
+    # @option params [String] :subject_token_type
+    #   The token type of the subject token. Currently only supports
+    #   "urn:ietf:params:oauth:token-type:jwt". Required when
+    #   "grant\_type=urn:ietf:params:oauth:grant-type:token-exchange".
+    #
+    # @option params [String] :resource
+    #   The OAuth resource for which the access token is requested. Required
+    #   when "grant\_type=urn:ietf:params:oauth:grant-type:token-exchange".
+    #   Example: "glue.amazonaws.com".
+    #
+    # @option params [String] :scope
+    #   IAM managed policy Amazon Resource Names (ARNs) to apply as session
+    #   policies that further scope down the permissions of the issued access
+    #   token, provided as a space-delimited list. Example:
+    #   "arn:aws:iam::444455556666:policy/MyPolicy".
+    #
+    # @return [Types::CreateOAuth2TokenWithTokenExchangeResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CreateOAuth2TokenWithTokenExchangeResponse#access_token #access_token} => String
+    #   * {Types::CreateOAuth2TokenWithTokenExchangeResponse#issued_token_type #issued_token_type} => String
+    #   * {Types::CreateOAuth2TokenWithTokenExchangeResponse#token_type #token_type} => String
+    #   * {Types::CreateOAuth2TokenWithTokenExchangeResponse#expires_in #expires_in} => Integer
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.create_o_auth_2_token_with_token_exchange({
+    #     grant_type: "TokenExchangeGrantType", # required
+    #     subject_token: "SubjectToken",
+    #     subject_token_type: "SubjectTokenType",
+    #     resource: "Resource",
+    #     scope: "Scope",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.access_token #=> String
+    #   resp.issued_token_type #=> String
+    #   resp.token_type #=> String
+    #   resp.expires_in #=> Integer
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithTokenExchange AWS API Documentation
+    #
+    # @overload create_o_auth_2_token_with_token_exchange(params = {})
+    # @param [Hash] params ({})
+    def create_o_auth_2_token_with_token_exchange(params = {}, options = {})
+      req = build_request(:create_o_auth_2_token_with_token_exchange, params)
+      req.send_request(options)
+    end
+
     # Delete console authorization configuration with automatic scope
     # detection
     #
@@ -730,28 +748,21 @@ module Aws::Signin
       req.send_request(options)
     end
 
-    # Grants permission to inspect the metadata and state of an OAuth 2.0
-    # access token or refresh token
+    # Inspects the metadata and active state of an OAuth 2.0 access token or
+    # refresh token.
     #
     # Implements RFC 7662 OAuth 2.0 Token Introspection over a
-    # SigV4-authenticated endpoint. Inspects the metadata of an
-    # access\_token or refresh\_token issued by AWS Sign-In and returns the
-    # claims associated with it.
-    #
-    # Inactive token semantics (RFC 7662 §2.2): when the supplied token is
-    # unknown, expired, revoked, malformed, or owned by a different account,
-    # the response body is exactly \{ "active": false } with all other
-    # claims omitted.
+    # SigV4-authenticated endpoint. Returns the claims associated with a
+    # token issued by AWS Sign-In.
     #
     # @option params [required, String] :token
-    #   The string value of the token to introspect. May be either an
-    #   access\_token or a refresh\_token issued by AWS Sign-In.
+    #   The access token or refresh token issued by AWS Sign-In.
     #
     # @option params [String] :token_type_hint
-    #   Optional hint about the type of the token submitted for introspection.
-    #   The server uses this hint to optimize lookup, but still falls back to
-    #   the other token type on miss. Allowed values: access\_token,
-    #   refresh\_token.
+    #   An optional hint about the type of the token submitted for
+    #   introspection, as defined in RFC 7662 §2.1. The server checks both
+    #   token types regardless of the hint. Allowed values: "access\_token",
+    #   "refresh\_token".
     #
     # @return [Types::IntrospectOAuth2TokenWithIAMResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -939,21 +950,11 @@ module Aws::Signin
       req.send_request(options)
     end
 
-    # Grants permission to revoke an OAuth 2.0 refresh token and its
-    # associated refresh tokens
-    #
-    # Revokes a refresh\_token issued by AWS Sign-In, invalidating the
-    # entire token chain so that the refresh\_token can no longer be used to
-    # mint new access\_tokens.
-    #
-    # Idempotency: revoking an already-revoked, expired, or otherwise
-    # invalid token still returns 200 OK with an empty body. Only the
-    # refresh\_token type is accepted.
+    # Revokes an OAuth 2.0 refresh token and its associated token chain.
     #
     # @option params [required, String] :token
-    #   The refresh\_token to revoke. Must be a refresh\_token issued by AWS
-    #   Sign-In (prefix "ASOR"); access\_tokens are not accepted for
-    #   revocation.
+    #   The refresh token to revoke. Must be a refresh token issued by AWS
+    #   Sign-In. Access tokens are not accepted for revocation.
     #
     # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
     #
@@ -990,7 +991,7 @@ module Aws::Signin
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.259.0'
+      context[:gem_version] = '3.261.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-signin/client_api.rb

@@ -35,8 +35,9 @@ module Aws::Signin
     CreateOAuth2TokenResponse = Shapes::StructureShape.new(name: 'CreateOAuth2TokenResponse')
     CreateOAuth2TokenResponseBody = Shapes::StructureShape.new(name: 'CreateOAuth2TokenResponseBody')
     CreateOAuth2TokenWithIAMRequest = Shapes::StructureShape.new(name: 'CreateOAuth2TokenWithIAMRequest')
-    CreateOAuth2TokenWithIAMRequestResourceString = Shapes::StringShape.new(name: 'CreateOAuth2TokenWithIAMRequestResourceString')
     CreateOAuth2TokenWithIAMResponse = Shapes::StructureShape.new(name: 'CreateOAuth2TokenWithIAMResponse')
+    CreateOAuth2TokenWithTokenExchangeRequest = Shapes::StructureShape.new(name: 'CreateOAuth2TokenWithTokenExchangeRequest')
+    CreateOAuth2TokenWithTokenExchangeResponse = Shapes::StructureShape.new(name: 'CreateOAuth2TokenWithTokenExchangeResponse')
     DeleteConsoleAuthorizationConfigurationInput = Shapes::StructureShape.new(name: 'DeleteConsoleAuthorizationConfigurationInput')
     DeleteConsoleAuthorizationConfigurationOutput = Shapes::StructureShape.new(name: 'DeleteConsoleAuthorizationConfigurationOutput')
     DeleteResourcePermissionStatementInput = Shapes::StructureShape.new(name: 'DeleteResourcePermissionStatementInput')
@@ -54,6 +55,9 @@ module Aws::Signin
     IntrospectOAuth2TokenWithIAMResponse = Shapes::StructureShape.new(name: 'IntrospectOAuth2TokenWithIAMResponse')
     IntrospectedTokenType = Shapes::StringShape.new(name: 'IntrospectedTokenType')
     IntrospectionToken = Shapes::StringShape.new(name: 'IntrospectionToken')
+    InvalidGrantException = Shapes::StructureShape.new(name: 'InvalidGrantException')
+    InvalidScopeException = Shapes::StructureShape.new(name: 'InvalidScopeException')
+    IssuedOAuthAccessTokenType = Shapes::StringShape.new(name: 'IssuedOAuthAccessTokenType')
     ListResourcePermissionStatementsInput = Shapes::StructureShape.new(name: 'ListResourcePermissionStatementsInput')
     ListResourcePermissionStatementsOutput = Shapes::StructureShape.new(name: 'ListResourcePermissionStatementsOutput')
     Long = Shapes::IntegerShape.new(name: 'Long')
@@ -73,18 +77,24 @@ module Aws::Signin
     RedirectUri = Shapes::StringShape.new(name: 'RedirectUri')
     RefreshToken = Shapes::StringShape.new(name: 'RefreshToken')
     RequestedRegion = Shapes::StringShape.new(name: 'RequestedRegion')
+    Resource = Shapes::StringShape.new(name: 'Resource')
     ResourceNotFoundException = Shapes::StructureShape.new(name: 'ResourceNotFoundException')
     RevocationToken = Shapes::StringShape.new(name: 'RevocationToken')
     RevokeOAuth2TokenWithIAMRequest = Shapes::StructureShape.new(name: 'RevokeOAuth2TokenWithIAMRequest')
     RevokeOAuth2TokenWithIAMResponse = Shapes::StructureShape.new(name: 'RevokeOAuth2TokenWithIAMResponse')
+    Scope = Shapes::StringShape.new(name: 'Scope')
     ServiceQuotaExceededException = Shapes::StructureShape.new(name: 'ServiceQuotaExceededException')
+    ServiceUnavailableException = Shapes::StructureShape.new(name: 'ServiceUnavailableException')
     SigninResourceBasedPolicy = Shapes::StructureShape.new(name: 'SigninResourceBasedPolicy')
     SourceIp = Shapes::StringShape.new(name: 'SourceIp')
     SourceVpc = Shapes::StringShape.new(name: 'SourceVpc')
     SourceVpce = Shapes::StringShape.new(name: 'SourceVpce')
     StatementId = Shapes::StringShape.new(name: 'StatementId')
     String = Shapes::StringShape.new(name: 'String')
+    SubjectToken = Shapes::StringShape.new(name: 'SubjectToken')
+    SubjectTokenType = Shapes::StringShape.new(name: 'SubjectTokenType')
     TargetId = Shapes::StringShape.new(name: 'TargetId')
+    TokenExchangeGrantType = Shapes::StringShape.new(name: 'TokenExchangeGrantType')
     TokenExpiresIn = Shapes::IntegerShape.new(name: 'TokenExpiresIn')
     TokenType = Shapes::StringShape.new(name: 'TokenType')
     TokenTypeHint = Shapes::StringShape.new(name: 'TokenTypeHint')
@@ -139,7 +149,7 @@ module Aws::Signin
     CreateOAuth2TokenResponseBody.struct_class = Types::CreateOAuth2TokenResponseBody
 
     CreateOAuth2TokenWithIAMRequest.add_member(:grant_type, Shapes::ShapeRef.new(shape: ClientCredentialsGrantType, required: true, location_name: "grant_type"))
-    CreateOAuth2TokenWithIAMRequest.add_member(:resource, Shapes::ShapeRef.new(shape: CreateOAuth2TokenWithIAMRequestResourceString, required: true, location_name: "resource"))
+    CreateOAuth2TokenWithIAMRequest.add_member(:resource, Shapes::ShapeRef.new(shape: Resource, required: true, location_name: "resource"))
     CreateOAuth2TokenWithIAMRequest.struct_class = Types::CreateOAuth2TokenWithIAMRequest
 
     CreateOAuth2TokenWithIAMResponse.add_member(:access_token, Shapes::ShapeRef.new(shape: OAuthAccessToken, required: true, location_name: "access_token"))
@@ -147,6 +157,19 @@ module Aws::Signin
     CreateOAuth2TokenWithIAMResponse.add_member(:expires_in, Shapes::ShapeRef.new(shape: TokenExpiresIn, required: true, location_name: "expires_in"))
     CreateOAuth2TokenWithIAMResponse.struct_class = Types::CreateOAuth2TokenWithIAMResponse
 
+    CreateOAuth2TokenWithTokenExchangeRequest.add_member(:grant_type, Shapes::ShapeRef.new(shape: TokenExchangeGrantType, required: true, location_name: "grant_type"))
+    CreateOAuth2TokenWithTokenExchangeRequest.add_member(:subject_token, Shapes::ShapeRef.new(shape: SubjectToken, location_name: "subject_token"))
+    CreateOAuth2TokenWithTokenExchangeRequest.add_member(:subject_token_type, Shapes::ShapeRef.new(shape: SubjectTokenType, location_name: "subject_token_type"))
+    CreateOAuth2TokenWithTokenExchangeRequest.add_member(:resource, Shapes::ShapeRef.new(shape: Resource, location_name: "resource"))
+    CreateOAuth2TokenWithTokenExchangeRequest.add_member(:scope, Shapes::ShapeRef.new(shape: Scope, location_name: "scope"))
+    CreateOAuth2TokenWithTokenExchangeRequest.struct_class = Types::CreateOAuth2TokenWithTokenExchangeRequest
+
+    CreateOAuth2TokenWithTokenExchangeResponse.add_member(:access_token, Shapes::ShapeRef.new(shape: OAuthAccessToken, required: true, location_name: "access_token"))
+    CreateOAuth2TokenWithTokenExchangeResponse.add_member(:issued_token_type, Shapes::ShapeRef.new(shape: IssuedOAuthAccessTokenType, location_name: "issued_token_type"))
+    CreateOAuth2TokenWithTokenExchangeResponse.add_member(:token_type, Shapes::ShapeRef.new(shape: BearerTokenType, required: true, location_name: "token_type"))
+    CreateOAuth2TokenWithTokenExchangeResponse.add_member(:expires_in, Shapes::ShapeRef.new(shape: TokenExpiresIn, required: true, location_name: "expires_in"))
+    CreateOAuth2TokenWithTokenExchangeResponse.struct_class = Types::CreateOAuth2TokenWithTokenExchangeResponse
+
     DeleteConsoleAuthorizationConfigurationInput.add_member(:target_id, Shapes::ShapeRef.new(shape: TargetId, location_name: "targetId"))
     DeleteConsoleAuthorizationConfigurationInput.struct_class = Types::DeleteConsoleAuthorizationConfigurationInput
 
@@ -195,9 +218,17 @@ module Aws::Signin
     IntrospectOAuth2TokenWithIAMResponse.add_member(:jti, Shapes::ShapeRef.new(shape: String, location_name: "jti"))
     IntrospectOAuth2TokenWithIAMResponse.add_member(:account_id, Shapes::ShapeRef.new(shape: AccountId, location_name: "account_id"))
     IntrospectOAuth2TokenWithIAMResponse.add_member(:signin_session, Shapes::ShapeRef.new(shape: String, location_name: "signin_session"))
-    IntrospectOAuth2TokenWithIAMResponse.add_member(:resource, Shapes::ShapeRef.new(shape: String, location_name: "resource"))
+    IntrospectOAuth2TokenWithIAMResponse.add_member(:resource, Shapes::ShapeRef.new(shape: Resource, location_name: "resource"))
     IntrospectOAuth2TokenWithIAMResponse.struct_class = Types::IntrospectOAuth2TokenWithIAMResponse
 
+    InvalidGrantException.add_member(:error, Shapes::ShapeRef.new(shape: OAuth2ErrorCode, required: true, location_name: "error"))
+    InvalidGrantException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "message"))
+    InvalidGrantException.struct_class = Types::InvalidGrantException
+
+    InvalidScopeException.add_member(:error, Shapes::ShapeRef.new(shape: OAuth2ErrorCode, required: true, location_name: "error"))
+    InvalidScopeException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "message"))
+    InvalidScopeException.struct_class = Types::InvalidScopeException
+
     ListResourcePermissionStatementsInput.add_member(:max_results, Shapes::ShapeRef.new(shape: ConsolePermissionMaxResults, location_name: "maxResults"))
     ListResourcePermissionStatementsInput.add_member(:next_token, Shapes::ShapeRef.new(shape: NextToken, location_name: "nextToken"))
     ListResourcePermissionStatementsInput.struct_class = Types::ListResourcePermissionStatementsInput
@@ -260,6 +291,10 @@ module Aws::Signin
     ServiceQuotaExceededException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "message"))
     ServiceQuotaExceededException.struct_class = Types::ServiceQuotaExceededException
 
+    ServiceUnavailableException.add_member(:error, Shapes::ShapeRef.new(shape: OAuth2ErrorCode, required: true, location_name: "error"))
+    ServiceUnavailableException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "message"))
+    ServiceUnavailableException.struct_class = Types::ServiceUnavailableException
+
     SigninResourceBasedPolicy.add_member(:version, Shapes::ShapeRef.new(shape: String, location_name: "Version"))
     SigninResourceBasedPolicy.add_member(:statement, Shapes::ShapeRef.new(shape: PolicyStatements, location_name: "Statement"))
     SigninResourceBasedPolicy.struct_class = Types::SigninResourceBasedPolicy
@@ -317,6 +352,22 @@ module Aws::Signin
         o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
       end)
 
+      api.add_operation(:create_o_auth_2_token_with_token_exchange, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "CreateOAuth2TokenWithTokenExchange"
+        o.http_method = "POST"
+        o.http_request_uri = "/v1/token?x-amz-oauth-token-method=token-exchange"
+        o['authtype'] = "none"
+        o['auth'] = ["smithy.api#noAuth"]
+        o.input = Shapes::ShapeRef.new(shape: CreateOAuth2TokenWithTokenExchangeRequest)
+        o.output = Shapes::ShapeRef.new(shape: CreateOAuth2TokenWithTokenExchangeResponse)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidGrantException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidScopeException)
+        o.errors << Shapes::ShapeRef.new(shape: TooManyRequestsError)
+        o.errors << Shapes::ShapeRef.new(shape: ServiceUnavailableException)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
+        o.errors << Shapes::ShapeRef.new(shape: ValidationException)
+      end)
+
       api.add_operation(:delete_console_authorization_configuration, Seahorse::Model::Operation.new.tap do |o|
         o.name = "DeleteConsoleAuthorizationConfiguration"
         o.http_method = "POST"

data/lib/aws-sdk-signin/endpoints.rb

@@ -21,6 +21,15 @@ module Aws::Signin
       end
     end
 
+    class CreateOAuth2TokenWithTokenExchange
+      def self.build(context)
+        Aws::Signin::EndpointParameters.create(
+          context.config,
+          is_o_auth_endpoint: true,
+        )
+      end
+    end
+
     class DeleteConsoleAuthorizationConfiguration
       def self.build(context)
         Aws::Signin::EndpointParameters.create(
@@ -107,6 +116,8 @@ module Aws::Signin
       case context.operation_name
       when :create_o_auth_2_token_with_iam
         CreateOAuth2TokenWithIAM.build(context)
+      when :create_o_auth_2_token_with_token_exchange
+        CreateOAuth2TokenWithTokenExchange.build(context)
       when :delete_console_authorization_configuration
         DeleteConsoleAuthorizationConfiguration.build(context)
       when :delete_resource_permission_statement

data/lib/aws-sdk-signin/errors.rb

@@ -30,8 +30,11 @@ module Aws::Signin
   # * {AccessDeniedException}
   # * {ConflictException}
   # * {InternalServerException}
+  # * {InvalidGrantException}
+  # * {InvalidScopeException}
   # * {ResourceNotFoundException}
   # * {ServiceQuotaExceededException}
+  # * {ServiceUnavailableException}
   # * {TooManyRequestsError}
   # * {ValidationException}
   #
@@ -101,6 +104,46 @@ module Aws::Signin
       end
     end
 
+    class InvalidGrantException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::Signin::Types::InvalidGrantException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def error
+        @data[:error]
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
+    class InvalidScopeException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::Signin::Types::InvalidScopeException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def error
+        @data[:error]
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
     class ResourceNotFoundException < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context
@@ -141,6 +184,30 @@ module Aws::Signin
       end
     end
 
+    class ServiceUnavailableException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::Signin::Types::ServiceUnavailableException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def error
+        @data[:error]
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+
+      def retryable?
+        true
+      end
+    end
+
     class TooManyRequestsError < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context

data/lib/aws-sdk-signin/types.rb

@@ -10,28 +10,15 @@
 module Aws::Signin
   module Types
 
-    # Error thrown for access denied scenarios with flexible HTTP status
-    # mapping
-    #
-    # Runtime HTTP Status Code Mapping:
-    #
-    # * HTTP 401 (Unauthorized): TOKEN\_EXPIRED, AUTHCODE\_EXPIRED
-    # * HTTP 403 (Forbidden): USER\_CREDENTIALS\_CHANGED,
-    #   INSUFFICIENT\_PERMISSIONS
-    #
-    # The specific HTTP status code is determined at runtime based on the
-    # error enum value. Consumers should use the error field to determine
-    # the specific access denial reason.
+    # You do not have sufficient access to perform this action.
     #
     # @!attribute [rw] error
-    #   OAuth 2.0 error code indicating the specific type of access denial
-    #   Can be TOKEN\_EXPIRED, AUTHCODE\_EXPIRED,
-    #   USER\_CREDENTIALS\_CHANGED, or INSUFFICIENT\_PERMISSIONS
+    #   One of TOKEN\_EXPIRED, AUTHCODE\_EXPIRED,
+    #   USER\_CREDENTIALS\_CHANGED, or INSUFFICIENT\_PERMISSIONS.
     #   @return [String]
     #
     # @!attribute [rw] message
-    #   Detailed message explaining the access denial Provides specific
-    #   information about why access was denied
+    #   The reason access was denied.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/AccessDeniedException AWS API Documentation
@@ -43,20 +30,19 @@ module Aws::Signin
       include Aws::Structure
     end
 
-    # AWS credentials structure containing temporary access credentials
-    #
-    # Scoped, temporary AWS credentials with a 15-minute duration.
+    # Contains the scoped, temporary AWS credentials used to sign requests
+    # with SigV4. Valid for 15 minutes.
     #
     # @!attribute [rw] access_key_id
-    #   AWS access key ID for temporary credentials
+    #   The AWS access key ID for the temporary credentials.
     #   @return [String]
     #
     # @!attribute [rw] secret_access_key
-    #   AWS secret access key for temporary credentials
+    #   The AWS secret access key used to sign requests.
     #   @return [String]
     #
     # @!attribute [rw] session_token
-    #   AWS session token for temporary credentials
+    #   The session token that validates the temporary security credentials.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/AccessToken AWS API Documentation
@@ -100,8 +86,8 @@ module Aws::Signin
     # grant\_type parameter in the request body.
     #
     # @!attribute [rw] token_input
-    #   Flattened token operation inputs The specific operation is
-    #   determined by grant\_type in the request body
+    #   Flattened token operation inputs. The "grant\_type" in the request
+    #   body determines the specific operation.
     #   @return [Types::CreateOAuth2TokenRequestBody]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenRequest AWS API Documentation
@@ -112,42 +98,43 @@ module Aws::Signin
       include Aws::Structure
     end
 
-    # Request body payload for CreateOAuth2Token operation
-    #
-    # The operation type is determined by the grant\_type parameter:
-    #
-    # * grant\_type=authorization\_code: Requires code, redirect\_uri,
-    #   code\_verifier
-    # * grant\_type=refresh\_token: Requires refresh\_token
+    # The request body for creating an OAuth 2.0 token. Supports both the
+    # authorization code and refresh token flows, selected by the
+    # "grant\_type" parameter.
     #
     # @!attribute [rw] client_id
-    #   The client identifier (ARN) used during Sign-In onboarding Required
-    #   for both authorization code and refresh token flows
+    #   The OAuth 2.0 client identifier. Expected values:
+    #   "arn:aws:signin:::devtools/same-device" or
+    #   "arn:aws:signin:::devtools/cross-device".
     #   @return [String]
     #
     # @!attribute [rw] grant_type
-    #   OAuth 2.0 grant type - determines which flow is used Must be
-    #   "authorization\_code" or "refresh\_token"
+    #   The OAuth 2.0 grant type. Supported values:
+    #
+    #   * "authorization\_code" - Exchange an authorization code for tokens.
+    #   * "refresh\_token" - Use a refresh token to obtain a new access
+    #     token.
     #   @return [String]
     #
     # @!attribute [rw] code
-    #   The authorization code received from /v1/authorize Required only
-    #   when grant\_type=authorization\_code
+    #   The authorization code received from the "/v1/authorize" endpoint.
+    #   Required when "grant\_type=authorization\_code".
     #   @return [String]
     #
     # @!attribute [rw] redirect_uri
-    #   The redirect URI that must match the original authorization request
-    #   Required only when grant\_type=authorization\_code
+    #   The redirect URI that was used in the original authorization
+    #   request. Must match exactly. Required when
+    #   "grant\_type=authorization\_code".
     #   @return [String]
     #
     # @!attribute [rw] code_verifier
-    #   PKCE code verifier to prove possession of the original code
-    #   challenge Required only when grant\_type=authorization\_code
+    #   The PKCE code verifier that proves possession of the original code
+    #   challenge. Required when "grant\_type=authorization\_code".
     #   @return [String]
     #
     # @!attribute [rw] refresh_token
-    #   The refresh token returned from auth\_code redemption Required only
-    #   when grant\_type=refresh\_token
+    #   The refresh token issued by a previous token response. Required when
+    #   "grant\_type=refresh\_token".
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenRequestBody AWS API Documentation
@@ -170,8 +157,8 @@ module Aws::Signin
     # grant\_type from the original request.
     #
     # @!attribute [rw] token_output
-    #   Flattened token operation outputs The specific response fields
-    #   depend on the grant\_type used in the request
+    #   Flattened token operation outputs. The specific response fields
+    #   depend on the grant\_type used in the request.
     #   @return [Types::CreateOAuth2TokenResponseBody]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenResponse AWS API Documentation
@@ -182,40 +169,35 @@ module Aws::Signin
       include Aws::Structure
     end
 
-    # Response body payload for CreateOAuth2Token operation
-    #
-    # The response content depends on the grant\_type from the request:
-    #
-    # * grant\_type=authorization\_code: Returns all fields including
-    #   refresh\_token and id\_token
-    # * grant\_type=refresh\_token: Returns access\_token, token\_type,
-    #   expires\_in, refresh\_token (no id\_token)
+    # The response body for an OAuth 2.0 token request. The fields returned
+    # depend on the "grant\_type". The authorization code flow returns
+    # "refresh\_token" and "id\_token". The refresh token flow omits
+    # "id\_token".
     #
     # @!attribute [rw] access_token
-    #   Scoped-down AWS credentials (15 minute duration) Present for both
-    #   authorization code redemption and token refresh
+    #   The access token issued by the authorization server. The token
+    #   contains temporary AWS security credentials that you use to sign
+    #   requests with SigV4.
     #   @return [Types::AccessToken]
     #
     # @!attribute [rw] token_type
-    #   Token type indicating this is AWS SigV4 credentials Value is
-    #   "aws\_sigv4" for both flows
+    #   The type of token issued. Value is "aws\_sigv4".
     #   @return [String]
     #
     # @!attribute [rw] expires_in
-    #   Time to expiry in seconds (maximum 900) Present for both
-    #   authorization code redemption and token refresh
+    #   The number of seconds until the access token expires. Maximum value
+    #   is 900 seconds (15 minutes).
     #   @return [Integer]
     #
     # @!attribute [rw] refresh_token
-    #   Encrypted refresh token with cnf.jkt (SHA-256 thumbprint of
-    #   presented jwk) Always present in responses (required for both flows)
+    #   A refresh token that can be used to obtain new access tokens without
+    #   re-authenticating.
     #   @return [String]
     #
     # @!attribute [rw] id_token
-    #   ID token containing user identity information Present only in
-    #   authorization code redemption response
-    #   (grant\_type=authorization\_code) Not included in token refresh
-    #   responses
+    #   A JSON Web Token (JWT) containing user identity claims. Present only
+    #   when "grant\_type=authorization\_code". Not included in refresh
+    #   token responses.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenResponseBody AWS API Documentation
@@ -233,7 +215,7 @@ module Aws::Signin
     # Input structure for CreateOAuth2TokenWithIAM operation
     #
     # @!attribute [rw] grant_type
-    #   OAuth 2.0 grant type. Must be "client\_credentials".
+    #   The OAuth 2.0 grant type. Must be "client\_credentials".
     #   @return [String]
     #
     # @!attribute [rw] resource
@@ -252,21 +234,21 @@ module Aws::Signin
 
     # Output structure for CreateOAuth2TokenWithIAM operation
     #
-    # Contains the JWT access token, token type, and expiration per RFC 6749
-    # §5.1.
+    # Contains the access token, token type, and expiration as defined in
+    # RFC 6749 §5.1.
     #
     # @!attribute [rw] access_token
-    #   JWT access token containing principal identity, resource scope, and
-    #   session metadata
+    #   Access token containing principal identity, resource scope, and
+    #   session metadata.
     #   @return [String]
     #
     # @!attribute [rw] token_type
-    #   Always "Bearer" per OAuth 2.1 specification
+    #   The token type. Always "Bearer" as defined in RFC 6749.
     #   @return [String]
     #
     # @!attribute [rw] expires_in
-    #   Token lifetime in seconds. Value is the minimum of session validity
-    #   and 1 hour.
+    #   Token lifetime in seconds. Value is the minimum of the caller's
+    #   session validity and 1 hour (3600 seconds).
     #   @return [Integer]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithIAMResponse AWS API Documentation
@@ -279,6 +261,87 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # Input structure for CreateOAuth2TokenWithTokenExchange operation
+    #
+    # @!attribute [rw] grant_type
+    #   The OAuth 2.0 grant type. Currently only supports
+    #   "urn:ietf:params:oauth:grant-type:token-exchange".
+    #   @return [String]
+    #
+    # @!attribute [rw] subject_token
+    #   The subject token that represents the identity of the party on whose
+    #   behalf the request is made. Required when
+    #   "grant\_type=urn:ietf:params:oauth:grant-type:token-exchange".
+    #   @return [String]
+    #
+    # @!attribute [rw] subject_token_type
+    #   The token type of the subject token. Currently only supports
+    #   "urn:ietf:params:oauth:token-type:jwt". Required when
+    #   "grant\_type=urn:ietf:params:oauth:grant-type:token-exchange".
+    #   @return [String]
+    #
+    # @!attribute [rw] resource
+    #   The OAuth resource for which the access token is requested. Required
+    #   when "grant\_type=urn:ietf:params:oauth:grant-type:token-exchange".
+    #   Example: "glue.amazonaws.com".
+    #   @return [String]
+    #
+    # @!attribute [rw] scope
+    #   IAM managed policy Amazon Resource Names (ARNs) to apply as session
+    #   policies that further scope down the permissions of the issued
+    #   access token, provided as a space-delimited list. Example:
+    #   "arn:aws:iam::444455556666:policy/MyPolicy".
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithTokenExchangeRequest AWS API Documentation
+    #
+    class CreateOAuth2TokenWithTokenExchangeRequest < Struct.new(
+      :grant_type,
+      :subject_token,
+      :subject_token_type,
+      :resource,
+      :scope)
+      SENSITIVE = [:subject_token]
+      include Aws::Structure
+    end
+
+    # Output structure for CreateOAuth2TokenWithTokenExchange operation.
+    #
+    # Contains the access token, issued token type, token type, and
+    # expiration as defined in RFC 6749 §5.1 and RFC 8693 §2.2.1.
+    #
+    # @!attribute [rw] access_token
+    #   Access token containing principal identity, resource scope, and
+    #   session metadata.
+    #   @return [String]
+    #
+    # @!attribute [rw] issued_token_type
+    #   The token type of the issued token. Always
+    #   "urn:ietf:params:oauth:token-type:access\_token" as defined in RFC
+    #   8693 §2.2.1.
+    #   @return [String]
+    #
+    # @!attribute [rw] token_type
+    #   The token type. Currently only supports "Bearer" as defined in RFC
+    #   6749.
+    #   @return [String]
+    #
+    # @!attribute [rw] expires_in
+    #   Token lifetime in seconds. Value is the minimum of the subject
+    #   token's validity and 1 hour (3600 seconds).
+    #   @return [Integer]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenWithTokenExchangeResponse AWS API Documentation
+    #
+    class CreateOAuth2TokenWithTokenExchangeResponse < Struct.new(
+      :access_token,
+      :issued_token_type,
+      :token_type,
+      :expires_in)
+      SENSITIVE = [:access_token]
+      include Aws::Structure
+    end
+
     # Input for DeleteConsoleAuthorizationConfiguration operation
     #
     # @!attribute [rw] target_id
@@ -405,21 +468,14 @@ module Aws::Signin
       include Aws::Structure
     end
 
-    # Error thrown when an internal server error occurs
-    #
-    # HTTP Status Code: 500 Internal Server Error
-    #
-    # Used for unexpected server-side errors that prevent request
-    # processing.
+    # The request failed because of an internal server error.
     #
     # @!attribute [rw] error
-    #   OAuth 2.0 error code indicating server error Will be SERVER\_ERROR
-    #   for internal server errors
+    #   Will be server\_error.
     #   @return [String]
     #
     # @!attribute [rw] message
-    #   Detailed message explaining the server error May include error
-    #   details for debugging purposes
+    #   The server error detail.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/InternalServerException AWS API Documentation
@@ -437,15 +493,14 @@ module Aws::Signin
     # an optional hint about the token's type.
     #
     # @!attribute [rw] token
-    #   The string value of the token to introspect. May be either an
-    #   access\_token or a refresh\_token issued by AWS Sign-In.
+    #   The access token or refresh token issued by AWS Sign-In.
     #   @return [String]
     #
     # @!attribute [rw] token_type_hint
-    #   Optional hint about the type of the token submitted for
-    #   introspection. The server uses this hint to optimize lookup, but
-    #   still falls back to the other token type on miss. Allowed values:
-    #   access\_token, refresh\_token.
+    #   An optional hint about the type of the token submitted for
+    #   introspection, as defined in RFC 7662 §2.1. The server checks both
+    #   token types regardless of the hint. Allowed values: "access\_token",
+    #   "refresh\_token".
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAMRequest AWS API Documentation
@@ -463,8 +518,8 @@ module Aws::Signin
     # other claims are omitted when the token is inactive.
     #
     # @!attribute [rw] active
-    #   Indicates whether the token is currently active. `true` only when
-    #   the token is valid, has not expired, has not been revoked, and
+    #   Indicates whether the token is currently active. Returns "true" only
+    #   when the token is valid, has not expired, has not been revoked, and
     #   belongs to the caller's account.
     #   @return [Boolean]
     #
@@ -473,9 +528,8 @@ module Aws::Signin
     #   @return [String]
     #
     # @!attribute [rw] user_id
-    #   User identifier matching sts:GetCallerIdentity's `UserId` field for
-    #   the token's subject principal (e.g. "AIDAEXAMPLE" for an IAM user,
-    #   or "AROAEXAMPLE:session-name" for an assumed role).
+    #   User identifier matching the "UserId" field from
+    #   "sts:GetCallerIdentity" for the token's subject principal.
     #   @return [String]
     #
     # @!attribute [rw] token_type
@@ -496,15 +550,13 @@ module Aws::Signin
     #   @return [Integer]
     #
     # @!attribute [rw] sub
-    #   Subject of the token: the IAM principal ARN. For assumed-role
-    #   sessions, this is the session ARN (matches sts:GetCallerIdentity's
-    #   `Arn` field), e.g.
-    #   arn:aws:sts::123456789012:assumed-role/MyRole/session-name.
+    #   The IAM principal Amazon Resource Name (ARN). For assumed-role
+    #   sessions, this is the session ARN.
     #   @return [String]
     #
     # @!attribute [rw] aud
-    #   Audience of the token: the OAuth resource the token is scoped to
-    #   (for example, "aws-mcp.amazonaws.com"). Omitted for refresh tokens.
+    #   The OAuth resource the token is scoped to. Omitted for refresh
+    #   tokens. Example: "aws-mcp.amazonaws.com".
     #   @return [String]
     #
     # @!attribute [rw] iss
@@ -525,8 +577,8 @@ module Aws::Signin
     #   @return [String]
     #
     # @!attribute [rw] resource
-    #   The OAuth resource the token is scoped to during Human OAuth flow.
-    #   Only present for refresh token introspection.
+    #   The OAuth resource the token is scoped to. Only present for refresh
+    #   token introspection.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAMResponse AWS API Documentation
@@ -550,6 +602,43 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # The request failed because the provided grant is invalid or expired.
+    #
+    # @!attribute [rw] error
+    #   Will be invalid\_grant.
+    #   @return [String]
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/InvalidGrantException AWS API Documentation
+    #
+    class InvalidGrantException < Struct.new(
+      :error,
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The request failed because the requested scope is invalid or exceeds
+    # the scope that can be granted.
+    #
+    # @!attribute [rw] error
+    #   Will be invalid\_scope.
+    #   @return [String]
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/InvalidScopeException AWS API Documentation
+    #
+    class InvalidScopeException < Struct.new(
+      :error,
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Input for ListResourcePermissionStatements operation
     #
     # @!attribute [rw] max_results
@@ -777,9 +866,8 @@ module Aws::Signin
     # revoke.
     #
     # @!attribute [rw] token
-    #   The refresh\_token to revoke. Must be a refresh\_token issued by AWS
-    #   Sign-In (prefix "ASOR"); access\_tokens are not accepted for
-    #   revocation.
+    #   The refresh token to revoke. Must be a refresh token issued by AWS
+    #   Sign-In. Access tokens are not accepted for revocation.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/RevokeOAuth2TokenWithIAMRequest AWS API Documentation
@@ -825,6 +913,25 @@ module Aws::Signin
       include Aws::Structure
     end
 
+    # The request failed because a dependency is temporarily unavailable.
+    # You can retry the request.
+    #
+    # @!attribute [rw] error
+    #   Will be service\_unavailable.
+    #   @return [String]
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ServiceUnavailableException AWS API Documentation
+    #
+    class ServiceUnavailableException < Struct.new(
+      :error,
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # SignIn resource-based policy document
     #
     # @!attribute [rw] version
@@ -844,29 +951,15 @@ module Aws::Signin
       include Aws::Structure
     end
 
-    # Error thrown when rate limit is exceeded
-    #
-    # HTTP Status Code: 429 Too Many Requests
-    #
-    # Possible OAuth2ErrorCode values:
-    #
-    # * INVALID\_REQUEST: Rate limiting, too many requests, abuse prevention
-    #
-    # Possible causes:
-    #
-    # * Too many token requests from the same client
-    # * Rate limiting based on client\_id or IP address
-    # * Abuse prevention mechanisms triggered
-    # * Service protection against excessive token generation
+    # The request failed because you exceeded the request rate limit for
+    # this operation.
     #
     # @!attribute [rw] error
-    #   OAuth 2.0 error code indicating the specific type of error Will be
-    #   INVALID\_REQUEST for rate limiting scenarios
+    #   Will be rate\_exceeded.
     #   @return [String]
     #
     # @!attribute [rw] message
-    #   Detailed message about the rate limiting May include retry-after
-    #   information or rate limit details
+    #   Details about the rate limit.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/TooManyRequestsError AWS API Documentation
@@ -878,21 +971,15 @@ module Aws::Signin
       include Aws::Structure
     end
 
-    # Error thrown when request validation fails
-    #
-    # HTTP Status Code: 400 Bad Request
-    #
-    # Used for request validation errors such as malformed parameters,
-    # missing required fields, or invalid parameter values.
+    # The request failed because it contains a malformed, missing, or
+    # invalid parameter.
     #
     # @!attribute [rw] error
-    #   OAuth 2.0 error code indicating validation failure Will be
-    #   INVALID\_REQUEST for validation errors
+    #   The specific code depends on which validation failed.
     #   @return [String]
     #
     # @!attribute [rw] message
-    #   Detailed message explaining the validation failure Provides specific
-    #   information about which validation failed
+    #   The validation constraint that failed.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ValidationException AWS API Documentation

data/lib/aws-sdk-signin.rb

@@ -56,7 +56,7 @@ module Aws::Signin
   autoload :EndpointProvider, 'aws-sdk-signin/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-signin/endpoints'
 
-  GEM_VERSION = '3.259.0'
+  GEM_VERSION = '3.261.0'
 
 end
 

data/lib/aws-sdk-sso/client.rb

@@ -703,7 +703,7 @@ module Aws::SSO
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.259.0'
+      context[:gem_version] = '3.261.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sso.rb

@@ -56,7 +56,7 @@ module Aws::SSO
   autoload :EndpointProvider, 'aws-sdk-sso/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-sso/endpoints'
 
-  GEM_VERSION = '3.259.0'
+  GEM_VERSION = '3.261.0'
 
 end
 

data/lib/aws-sdk-ssooidc/client.rb

@@ -1086,7 +1086,7 @@ module Aws::SSOOIDC
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.259.0'
+      context[:gem_version] = '3.261.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-ssooidc.rb

@@ -56,7 +56,7 @@ module Aws::SSOOIDC
   autoload :EndpointProvider, 'aws-sdk-ssooidc/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-ssooidc/endpoints'
 
-  GEM_VERSION = '3.259.0'
+  GEM_VERSION = '3.261.0'
 
 end
 

data/lib/aws-sdk-sts/client.rb

@@ -2807,7 +2807,7 @@ module Aws::STS
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.259.0'
+      context[:gem_version] = '3.261.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sts.rb

@@ -56,7 +56,7 @@ module Aws::STS
   autoload :EndpointProvider, 'aws-sdk-sts/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-sts/endpoints'
 
-  GEM_VERSION = '3.259.0'
+  GEM_VERSION = '3.261.0'
 
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-core
 version: !ruby/object:Gem::Version
-  version: 3.259.0
+  version: 3.261.0
 platform: ruby
 authors:
 - Amazon Web Services
@@ -18,7 +18,7 @@ dependencies:
         version: '1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: 1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: '1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: 1.4.1
 - !ruby/object:Gem::Dependency
   name: aws-partitions
   requirement: !ruby/object:Gem::Requirement