@cdklabs/cdk-ecs-codedeploy 0.0.206 → 0.0.208

package/node_modules/@aws-sdk/client-sts/dist-types/models/models_0.d.ts

@@ -1,4 +1,4 @@
-import { ExceptionOptionType as __ExceptionOptionType } from "@aws-sdk/smithy-client";
+import { ExceptionOptionType as __ExceptionOptionType } from "@smithy/smithy-client";
 import { STSServiceException as __BaseException } from "./STSServiceException";
 /**
  * @public
@@ -7,11 +7,13 @@ import { STSServiceException as __BaseException } from "./STSServiceException";
  */
 export interface AssumedRoleUser {
     /**
+     * @public
      * <p>A unique identifier that contains the role ID and the role session name of the role that
      *          is being assumed. The role ID is generated by Amazon Web Services when the role is created.</p>
      */
     AssumedRoleId: string | undefined;
     /**
+     * @public
      * <p>The ARN of the temporary security credentials that are returned from the <a>AssumeRole</a> action. For more information about ARNs and how to use them in
      *          policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM Identifiers</a> in the
      *             <i>IAM User Guide</i>.</p>
@@ -25,12 +27,29 @@ export interface AssumedRoleUser {
  */
 export interface PolicyDescriptorType {
     /**
+     * @public
      * <p>The Amazon Resource Name (ARN) of the IAM managed policy to use as a session policy
      *          for the role. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs) and Amazon Web Services
      *             Service Namespaces</a> in the <i>Amazon Web Services General Reference</i>.</p>
      */
     arn?: string;
 }
+/**
+ * @public
+ * <p>Reserved for future use.</p>
+ */
+export interface ProvidedContext {
+    /**
+     * @public
+     * <p>Reserved for future use.</p>
+     */
+    ProviderArn?: string;
+    /**
+     * @public
+     * <p>Reserved for future use.</p>
+     */
+    ContextAssertion?: string;
+}
 /**
  * @public
  * <p>You can pass custom key-value pair attributes when you assume a role or federate a user.
@@ -40,6 +59,7 @@ export interface PolicyDescriptorType {
  */
 export interface Tag {
     /**
+     * @public
      * <p>The key for a session tag.</p>
      *          <p>You can pass up to 50 session tags. The plain text session tag keys can’t exceed 128
      *          characters. For these and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
@@ -47,6 +67,7 @@ export interface Tag {
      */
     Key: string | undefined;
     /**
+     * @public
      * <p>The value for a session tag.</p>
      *          <p>You can pass up to 50 session tags. The plain text session tag values can’t exceed 256
      *          characters. For these and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
@@ -59,10 +80,12 @@ export interface Tag {
  */
 export interface AssumeRoleRequest {
     /**
+     * @public
      * <p>The Amazon Resource Name (ARN) of the role to assume.</p>
      */
     RoleArn: string | undefined;
     /**
+     * @public
      * <p>An identifier for the assumed role session.</p>
      *          <p>Use the role session name to uniquely identify a session when the same role is assumed
      *          by different principals or for different reasons. In cross-account scenarios, the role
@@ -76,6 +99,7 @@ export interface AssumeRoleRequest {
      */
     RoleSessionName: string | undefined;
     /**
+     * @public
      * <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
      *          managed session policies. The policies must exist in the same account as the role.</p>
      *          <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
@@ -100,6 +124,7 @@ export interface AssumeRoleRequest {
      */
     PolicyArns?: PolicyDescriptorType[];
     /**
+     * @public
      * <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
      *          <p>This parameter is optional. Passing policies to this operation returns new
      *          temporary credentials. The resulting session's permissions are the intersection of the
@@ -124,6 +149,7 @@ export interface AssumeRoleRequest {
      */
     Policy?: string;
     /**
+     * @public
      * <p>The duration, in seconds, of the role session. The value specified can range from 900
      *          seconds (15 minutes) up to the maximum session duration set for the role. The maximum
      *          session duration setting can have a value from 1 hour to 12 hours. If you specify a value
@@ -152,6 +178,7 @@ export interface AssumeRoleRequest {
      */
     DurationSeconds?: number;
     /**
+     * @public
      * <p>A list of session tags that you want to pass. Each session tag consists of a key name
      *          and an associated value. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Tagging Amazon Web Services STS
      *             Sessions</a> in the <i>IAM User Guide</i>.</p>
@@ -182,6 +209,7 @@ export interface AssumeRoleRequest {
      */
     Tags?: Tag[];
     /**
+     * @public
      * <p>A list of keys for session tags that you want to set as transitive. If you set a tag key
      *          as transitive, the corresponding key and value passes to subsequent sessions in a role
      *          chain. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining Roles
@@ -193,6 +221,7 @@ export interface AssumeRoleRequest {
      */
     TransitiveTagKeys?: string[];
     /**
+     * @public
      * <p>A unique identifier that might be required when you assume a role in another account. If
      *          the administrator of the account to which the role belongs provided you with an external
      *          ID, then provide that value in the <code>ExternalId</code> parameter. This value can be any
@@ -209,6 +238,7 @@ export interface AssumeRoleRequest {
      */
     ExternalId?: string;
     /**
+     * @public
      * <p>The identification number of the MFA device that is associated with the user who is
      *          making the <code>AssumeRole</code> call. Specify this value if the trust policy of the role
      *          being assumed includes a condition that requires MFA authentication. The value is either
@@ -221,6 +251,7 @@ export interface AssumeRoleRequest {
      */
     SerialNumber?: string;
     /**
+     * @public
      * <p>The value provided by the MFA device, if the trust policy of the role being assumed
      *          requires MFA. (In other words, if the policy includes a condition that tests for MFA). If
      *          the role being assumed requires MFA and if the <code>TokenCode</code> value is missing or
@@ -230,6 +261,7 @@ export interface AssumeRoleRequest {
      */
     TokenCode?: string;
     /**
+     * @public
      * <p>The source identity specified by the principal that is calling the
      *             <code>AssumeRole</code> operation.</p>
      *          <p>You can require users to specify a source identity when they assume a role. You do this
@@ -246,6 +278,11 @@ export interface AssumeRoleRequest {
      *             <code>aws:</code>. This prefix is reserved for Amazon Web Services internal use.</p>
      */
     SourceIdentity?: string;
+    /**
+     * @public
+     * <p>Reserved for future use.</p>
+     */
+    ProvidedContexts?: ProvidedContext[];
 }
 /**
  * @public
@@ -253,19 +290,23 @@ export interface AssumeRoleRequest {
  */
 export interface Credentials {
     /**
+     * @public
      * <p>The access key ID that identifies the temporary security credentials.</p>
      */
     AccessKeyId: string | undefined;
     /**
+     * @public
      * <p>The secret access key that can be used to sign requests.</p>
      */
     SecretAccessKey: string | undefined;
     /**
+     * @public
      * <p>The token that users must pass to the service API to use the temporary
      *          credentials.</p>
      */
     SessionToken: string | undefined;
     /**
+     * @public
      * <p>The date on which the current credentials expire.</p>
      */
     Expiration: Date | undefined;
@@ -277,6 +318,7 @@ export interface Credentials {
  */
 export interface AssumeRoleResponse {
     /**
+     * @public
      * <p>The temporary security credentials, which include an access key ID, a secret access key,
      *          and a security (or session) token.</p>
      *          <note>
@@ -286,6 +328,7 @@ export interface AssumeRoleResponse {
      */
     Credentials?: Credentials;
     /**
+     * @public
      * <p>The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers that you
      *          can use to refer to the resulting temporary security credentials. For example, you can
      *          reference these credentials as a principal in a resource-based policy by using the ARN or
@@ -294,12 +337,14 @@ export interface AssumeRoleResponse {
      */
     AssumedRoleUser?: AssumedRoleUser;
     /**
+     * @public
      * <p>A percentage value that indicates the packed size of the session policies and session
      *       tags combined passed in the request. The request fails if the packed size is greater than 100 percent,
      *       which means the policies and tags exceeded the allowed space.</p>
      */
     PackedPolicySize?: number;
     /**
+     * @public
      * <p>The source identity specified by the principal that is calling the
      *             <code>AssumeRole</code> operation.</p>
      *          <p>You can require users to specify a source identity when they assume a role. You do this
@@ -383,21 +428,25 @@ export declare class RegionDisabledException extends __BaseException {
  */
 export interface AssumeRoleWithSAMLRequest {
     /**
+     * @public
      * <p>The Amazon Resource Name (ARN) of the role that the caller is assuming.</p>
      */
     RoleArn: string | undefined;
     /**
+     * @public
      * <p>The Amazon Resource Name (ARN) of the SAML provider in IAM that describes the
      *          IdP.</p>
      */
     PrincipalArn: string | undefined;
     /**
+     * @public
      * <p>The base64 encoded SAML authentication response provided by the IdP.</p>
      *          <p>For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html">Configuring a Relying Party and
      *             Adding Claims</a> in the <i>IAM User Guide</i>. </p>
      */
     SAMLAssertion: string | undefined;
     /**
+     * @public
      * <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
      *          managed session policies. The policies must exist in the same account as the role.</p>
      *          <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
@@ -422,6 +471,7 @@ export interface AssumeRoleWithSAMLRequest {
      */
     PolicyArns?: PolicyDescriptorType[];
     /**
+     * @public
      * <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
      *          <p>This parameter is optional. Passing policies to this operation returns new
      *          temporary credentials. The resulting session's permissions are the intersection of the
@@ -446,6 +496,7 @@ export interface AssumeRoleWithSAMLRequest {
      */
     Policy?: string;
     /**
+     * @public
      * <p>The duration, in seconds, of the role session. Your role session lasts for the duration
      *          that you specify for the <code>DurationSeconds</code> parameter, or until the time
      *          specified in the SAML authentication response's <code>SessionNotOnOrAfter</code> value,
@@ -477,6 +528,7 @@ export interface AssumeRoleWithSAMLRequest {
  */
 export interface AssumeRoleWithSAMLResponse {
     /**
+     * @public
      * <p>The temporary security credentials, which include an access key ID, a secret access key,
      *          and a security (or session) token.</p>
      *          <note>
@@ -486,22 +538,26 @@ export interface AssumeRoleWithSAMLResponse {
      */
     Credentials?: Credentials;
     /**
+     * @public
      * <p>The identifiers for the temporary security credentials that the operation
      *          returns.</p>
      */
     AssumedRoleUser?: AssumedRoleUser;
     /**
+     * @public
      * <p>A percentage value that indicates the packed size of the session policies and session
      *       tags combined passed in the request. The request fails if the packed size is greater than 100 percent,
      *       which means the policies and tags exceeded the allowed space.</p>
      */
     PackedPolicySize?: number;
     /**
+     * @public
      * <p>The value of the <code>NameID</code> element in the <code>Subject</code> element of the
      *          SAML assertion.</p>
      */
     Subject?: string;
     /**
+     * @public
      * <p> The format of the name ID, as defined by the <code>Format</code> attribute in the
      *             <code>NameID</code> element of the SAML assertion. Typical examples of the format are
      *             <code>transient</code> or <code>persistent</code>. </p>
@@ -513,15 +569,18 @@ export interface AssumeRoleWithSAMLResponse {
      */
     SubjectType?: string;
     /**
+     * @public
      * <p>The value of the <code>Issuer</code> element of the SAML assertion.</p>
      */
     Issuer?: string;
     /**
+     * @public
      * <p> The value of the <code>Recipient</code> attribute of the
      *             <code>SubjectConfirmationData</code> element of the SAML assertion. </p>
      */
     Audience?: string;
     /**
+     * @public
      * <p>A hash value based on the concatenation of the following:</p>
      *          <ul>
      *             <li>
@@ -543,6 +602,7 @@ export interface AssumeRoleWithSAMLResponse {
      */
     NameQualifier?: string;
     /**
+     * @public
      * <p>The value in the <code>SourceIdentity</code> attribute in the SAML assertion. </p>
      *          <p>You can require users to set a source identity value when they assume a role. You do
      *          this by using the <code>sts:SourceIdentity</code> condition key in a role trust policy.
@@ -594,10 +654,12 @@ export declare class InvalidIdentityTokenException extends __BaseException {
  */
 export interface AssumeRoleWithWebIdentityRequest {
     /**
+     * @public
      * <p>The Amazon Resource Name (ARN) of the role that the caller is assuming.</p>
      */
     RoleArn: string | undefined;
     /**
+     * @public
      * <p>An identifier for the assumed role session. Typically, you pass the name or identifier
      *          that is associated with the user who is using your application. That way, the temporary
      *          security credentials that your application will use are associated with that user. This
@@ -609,13 +671,16 @@ export interface AssumeRoleWithWebIdentityRequest {
      */
     RoleSessionName: string | undefined;
     /**
+     * @public
      * <p>The OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity
      *          provider. Your application must get this token by authenticating the user who is using your
      *          application with a web identity provider before the application makes an
-     *             <code>AssumeRoleWithWebIdentity</code> call. </p>
+     *             <code>AssumeRoleWithWebIdentity</code> call. Only tokens with RSA algorithms (RS256) are
+     *          supported.</p>
      */
     WebIdentityToken: string | undefined;
     /**
+     * @public
      * <p>The fully qualified host component of the domain name of the OAuth 2.0 identity
      *          provider. Do not specify this value for an OpenID Connect identity provider.</p>
      *          <p>Currently <code>www.amazon.com</code> and <code>graph.facebook.com</code> are the only
@@ -625,6 +690,7 @@ export interface AssumeRoleWithWebIdentityRequest {
      */
     ProviderId?: string;
     /**
+     * @public
      * <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
      *          managed session policies. The policies must exist in the same account as the role.</p>
      *          <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
@@ -649,6 +715,7 @@ export interface AssumeRoleWithWebIdentityRequest {
      */
     PolicyArns?: PolicyDescriptorType[];
     /**
+     * @public
      * <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
      *          <p>This parameter is optional. Passing policies to this operation returns new
      *          temporary credentials. The resulting session's permissions are the intersection of the
@@ -673,6 +740,7 @@ export interface AssumeRoleWithWebIdentityRequest {
      */
     Policy?: string;
     /**
+     * @public
      * <p>The duration, in seconds, of the role session. The value can range from 900 seconds (15
      *          minutes) up to the maximum session duration setting for the role. This setting can have a
      *          value from 1 hour to 12 hours. If you specify a value higher than this setting, the
@@ -701,6 +769,7 @@ export interface AssumeRoleWithWebIdentityRequest {
  */
 export interface AssumeRoleWithWebIdentityResponse {
     /**
+     * @public
      * <p>The temporary security credentials, which include an access key ID, a secret access key,
      *          and a security token.</p>
      *          <note>
@@ -710,6 +779,7 @@ export interface AssumeRoleWithWebIdentityResponse {
      */
     Credentials?: Credentials;
     /**
+     * @public
      * <p>The unique user identifier that is returned by the identity provider. This identifier is
      *          associated with the <code>WebIdentityToken</code> that was submitted with the
      *             <code>AssumeRoleWithWebIdentity</code> call. The identifier is typically unique to the
@@ -719,6 +789,7 @@ export interface AssumeRoleWithWebIdentityResponse {
      */
     SubjectFromWebIdentityToken?: string;
     /**
+     * @public
      * <p>The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers that you
      *          can use to refer to the resulting temporary security credentials. For example, you can
      *          reference these credentials as a principal in a resource-based policy by using the ARN or
@@ -727,12 +798,14 @@ export interface AssumeRoleWithWebIdentityResponse {
      */
     AssumedRoleUser?: AssumedRoleUser;
     /**
+     * @public
      * <p>A percentage value that indicates the packed size of the session policies and session
      *       tags combined passed in the request. The request fails if the packed size is greater than 100 percent,
      *       which means the policies and tags exceeded the allowed space.</p>
      */
     PackedPolicySize?: number;
     /**
+     * @public
      * <p> The issuing authority of the web identity token presented. For OpenID Connect ID
      *          tokens, this contains the value of the <code>iss</code> field. For OAuth 2.0 access tokens,
      *          this contains the value of the <code>ProviderId</code> parameter that was passed in the
@@ -740,12 +813,14 @@ export interface AssumeRoleWithWebIdentityResponse {
      */
     Provider?: string;
     /**
+     * @public
      * <p>The intended audience (also known as client ID) of the web identity token. This is
      *          traditionally the client identifier issued to the application that requested the web
      *          identity token.</p>
      */
     Audience?: string;
     /**
+     * @public
      * <p>The value of the source identity that is returned in the JSON web token (JWT) from the
      *          identity provider.</p>
      *          <p>You can require users to set a source identity value when they assume a role. You do
@@ -787,6 +862,7 @@ export declare class IDPCommunicationErrorException extends __BaseException {
  */
 export interface DecodeAuthorizationMessageRequest {
     /**
+     * @public
      * <p>The encoded message that was returned with the response.</p>
      */
     EncodedMessage: string | undefined;
@@ -798,6 +874,7 @@ export interface DecodeAuthorizationMessageRequest {
  */
 export interface DecodeAuthorizationMessageResponse {
     /**
+     * @public
      * <p>The API returns a response with the decoded message.</p>
      */
     DecodedMessage?: string;
@@ -821,6 +898,7 @@ export declare class InvalidAuthorizationMessageException extends __BaseExceptio
  */
 export interface GetAccessKeyInfoRequest {
     /**
+     * @public
      * <p>The identifier of an access key.</p>
      *          <p>This parameter allows (through its regex pattern) a string of characters that can
      *          consist of any upper- or lowercase letter or digit.</p>
@@ -832,6 +910,7 @@ export interface GetAccessKeyInfoRequest {
  */
 export interface GetAccessKeyInfoResponse {
     /**
+     * @public
      * <p>The number used to identify the Amazon Web Services account.</p>
      */
     Account?: string;
@@ -848,6 +927,7 @@ export interface GetCallerIdentityRequest {
  */
 export interface GetCallerIdentityResponse {
     /**
+     * @public
      * <p>The unique identifier of the calling entity. The exact value depends on the type of
      *          entity that is making the call. The values returned are those listed in the <b>aws:userid</b> column in the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable">Principal
      *             table</a> found on the <b>Policy Variables</b> reference
@@ -855,11 +935,13 @@ export interface GetCallerIdentityResponse {
      */
     UserId?: string;
     /**
+     * @public
      * <p>The Amazon Web Services account ID number of the account that owns or contains the calling
      *          entity.</p>
      */
     Account?: string;
     /**
+     * @public
      * <p>The Amazon Web Services ARN associated with the calling entity.</p>
      */
     Arn?: string;
@@ -869,6 +951,7 @@ export interface GetCallerIdentityResponse {
  */
 export interface GetFederationTokenRequest {
     /**
+     * @public
      * <p>The name of the federated user. The name is used as an identifier for the temporary
      *          security credentials (such as <code>Bob</code>). For example, you can reference the
      *          federated user name in a resource-based policy, such as in an Amazon S3 bucket policy.</p>
@@ -878,6 +961,7 @@ export interface GetFederationTokenRequest {
      */
     Name: string | undefined;
     /**
+     * @public
      * <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
      *          <p>You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policy</a> to
      *          this operation. You can pass a single JSON policy document to use as an inline session
@@ -886,10 +970,10 @@ export interface GetFederationTokenRequest {
      *          <p>This parameter is optional. However, if you do not pass any session policies, then the
      *          resulting federated user session has no permissions.</p>
      *          <p>When you pass session policies, the session permissions are the intersection of the
-     *          IAM user policies and the session policies that you pass. This gives you a way to further
-     *          restrict the permissions for a federated user. You cannot use session policies to grant
-     *          more permissions than those that are defined in the permissions policy of the IAM user.
-     *          For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
+     *             IAM user policies and the session policies that you pass. This gives you
+     *          a way to further restrict the permissions for a federated user. You cannot use session
+     *          policies to grant more permissions than those that are defined in the permissions policy of
+     *          the IAM user. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
      *          the <i>IAM User Guide</i>.</p>
      *          <p>The resulting credentials can be used to access a resource that has a resource-based
      *          policy. If that policy specifically references the federated user session in the
@@ -911,9 +995,9 @@ export interface GetFederationTokenRequest {
      */
     Policy?: string;
     /**
+     * @public
      * <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as a
-     *          managed session policy. The policies must exist in the same account as the IAM user that
-     *          is requesting federated access.</p>
+     *          managed session policy. The policies must exist in the same account as the IAM user that is requesting federated access.</p>
      *          <p>You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policy</a> to
      *          this operation. You can pass a single JSON policy document to use as an inline session
      *          policy. You can also specify up to 10 managed policy Amazon Resource Names (ARNs) to use as
@@ -924,10 +1008,10 @@ export interface GetFederationTokenRequest {
      *          <p>This parameter is optional. However, if you do not pass any session policies, then the
      *          resulting federated user session has no permissions.</p>
      *          <p>When you pass session policies, the session permissions are the intersection of the
-     *          IAM user policies and the session policies that you pass. This gives you a way to further
-     *          restrict the permissions for a federated user. You cannot use session policies to grant
-     *          more permissions than those that are defined in the permissions policy of the IAM user.
-     *          For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
+     *             IAM user policies and the session policies that you pass. This gives you
+     *          a way to further restrict the permissions for a federated user. You cannot use session
+     *          policies to grant more permissions than those that are defined in the permissions policy of
+     *          the IAM user. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
      *          the <i>IAM User Guide</i>.</p>
      *          <p>The resulting credentials can be used to access a resource that has a resource-based
      *          policy. If that policy specifically references the federated user session in the
@@ -944,15 +1028,17 @@ export interface GetFederationTokenRequest {
      */
     PolicyArns?: PolicyDescriptorType[];
     /**
+     * @public
      * <p>The duration, in seconds, that the session should last. Acceptable durations for
      *          federation sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with
      *          43,200 seconds (12 hours) as the default. Sessions obtained using root user
      *          credentials are restricted to a maximum of 3,600 seconds (one hour). If the specified
-     *          duration is longer than one hour, the session obtained by using root user credentials
-     *          defaults to one hour.</p>
+     *          duration is longer than one hour, the session obtained by using root user
+     *          credentials defaults to one hour.</p>
      */
     DurationSeconds?: number;
     /**
+     * @public
      * <p>A list of session tags. Each session tag consists of a key name and an associated value.
      *          For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
      *             <i>IAM User Guide</i>.</p>
@@ -984,11 +1070,13 @@ export interface GetFederationTokenRequest {
  */
 export interface FederatedUser {
     /**
+     * @public
      * <p>The string that identifies the federated user associated with the credentials, similar
      *          to the unique ID of an IAM user.</p>
      */
     FederatedUserId: string | undefined;
     /**
+     * @public
      * <p>The ARN that specifies the federated user that is associated with the credentials. For
      *          more information about ARNs and how to use them in policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM
      *             Identifiers</a> in the <i>IAM User Guide</i>. </p>
@@ -1002,6 +1090,7 @@ export interface FederatedUser {
  */
 export interface GetFederationTokenResponse {
     /**
+     * @public
      * <p>The temporary security credentials, which include an access key ID, a secret access key,
      *          and a security (or session) token.</p>
      *          <note>
@@ -1011,6 +1100,7 @@ export interface GetFederationTokenResponse {
      */
     Credentials?: Credentials;
     /**
+     * @public
      * <p>Identifiers for the federated user associated with the credentials (such as
      *             <code>arn:aws:sts::123456789012:federated-user/Bob</code> or
      *             <code>123456789012:Bob</code>). You can use the federated user's ARN in your
@@ -1018,6 +1108,7 @@ export interface GetFederationTokenResponse {
      */
     FederatedUser?: FederatedUser;
     /**
+     * @public
      * <p>A percentage value that indicates the packed size of the session policies and session
      *       tags combined passed in the request. The request fails if the packed size is greater than 100 percent,
      *       which means the policies and tags exceeded the allowed space.</p>
@@ -1029,32 +1120,33 @@ export interface GetFederationTokenResponse {
  */
 export interface GetSessionTokenRequest {
     /**
+     * @public
      * <p>The duration, in seconds, that the credentials should remain valid. Acceptable durations
-     *          for IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours),
-     *          with 43,200 seconds (12 hours) as the default. Sessions for Amazon Web Services account owners are
-     *          restricted to a maximum of 3,600 seconds (one hour). If the duration is longer than one
-     *          hour, the session for Amazon Web Services account owners defaults to one hour.</p>
+     *          for IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds
+     *          (36 hours), with 43,200 seconds (12 hours) as the default. Sessions for Amazon Web Services account
+     *          owners are restricted to a maximum of 3,600 seconds (one hour). If the duration is longer
+     *          than one hour, the session for Amazon Web Services account owners defaults to one hour.</p>
      */
     DurationSeconds?: number;
     /**
-     * <p>The identification number of the MFA device that is associated with the IAM user who
-     *          is making the <code>GetSessionToken</code> call. Specify this value if the IAM user has a
-     *          policy that requires MFA authentication. The value is either the serial number for a
-     *          hardware device (such as <code>GAHT12345678</code>) or an Amazon Resource Name (ARN) for a
-     *          virtual device (such as <code>arn:aws:iam::123456789012:mfa/user</code>). You can find the
-     *          device for an IAM user by going to the Amazon Web Services Management Console and viewing the user's security
-     *          credentials. </p>
+     * @public
+     * <p>The identification number of the MFA device that is associated with the IAM user who is making the <code>GetSessionToken</code> call. Specify this value
+     *          if the IAM user has a policy that requires MFA authentication. The value is
+     *          either the serial number for a hardware device (such as <code>GAHT12345678</code>) or an
+     *          Amazon Resource Name (ARN) for a virtual device (such as
+     *             <code>arn:aws:iam::123456789012:mfa/user</code>). You can find the device for an IAM user by going to the Amazon Web Services Management Console and viewing the user's security credentials. </p>
      *          <p>The regex used to validate this parameter is a string of
      *     characters consisting of upper- and lower-case alphanumeric characters with no spaces.
      *     You can also include underscores or any of the following characters: =,.@:/-</p>
      */
     SerialNumber?: string;
     /**
+     * @public
      * <p>The value provided by the MFA device, if MFA is required. If any policy requires the
-     *          IAM user to submit an MFA code, specify this value. If MFA authentication is required,
-     *          the user must provide a code when requesting a set of temporary security credentials. A
-     *          user who fails to provide the code receives an "access denied" response when requesting
-     *          resources that require MFA authentication.</p>
+     *             IAM user to submit an MFA code, specify this value. If MFA authentication
+     *          is required, the user must provide a code when requesting a set of temporary security
+     *          credentials. A user who fails to provide the code receives an "access denied" response when
+     *          requesting resources that require MFA authentication.</p>
      *          <p>The format for this parameter, as described by its regex pattern, is a sequence of six
      *          numeric digits.</p>
      */
@@ -1067,6 +1159,7 @@ export interface GetSessionTokenRequest {
  */
 export interface GetSessionTokenResponse {
     /**
+     * @public
      * <p>The temporary security credentials, which include an access key ID, a secret access key,
      *          and a security (or session) token.</p>
      *          <note>