api_op_AssumeRoleWithWebIdentity.go (22436B)
1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package sts 4 5 import ( 6 "context" 7 awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware" 8 "github.com/aws/aws-sdk-go-v2/service/sts/types" 9 "github.com/aws/smithy-go/middleware" 10 smithyhttp "github.com/aws/smithy-go/transport/http" 11 ) 12 13 // Returns a set of temporary security credentials for users who have been 14 // authenticated in a mobile or web application with a web identity provider. 15 // Example providers include the OAuth 2.0 providers Login with Amazon and 16 // Facebook, or any OpenID Connect-compatible identity provider such as Google or 17 // Amazon Cognito federated identities 18 // (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html). 19 // For mobile applications, we recommend that you use Amazon Cognito. You can use 20 // Amazon Cognito with the Amazon Web Services SDK for iOS Developer Guide 21 // (http://aws.amazon.com/sdkforios/) and the Amazon Web Services SDK for Android 22 // Developer Guide (http://aws.amazon.com/sdkforandroid/) to uniquely identify a 23 // user. You can also supply the user with a consistent identity throughout the 24 // lifetime of an application. To learn more about Amazon Cognito, see Amazon 25 // Cognito Overview 26 // (https://docs.aws.amazon.com/mobile/sdkforandroid/developerguide/cognito-auth.html#d0e840) 27 // in Amazon Web Services SDK for Android Developer Guide and Amazon Cognito 28 // Overview 29 // (https://docs.aws.amazon.com/mobile/sdkforios/developerguide/cognito-auth.html#d0e664) 30 // in the Amazon Web Services SDK for iOS Developer Guide. Calling 31 // AssumeRoleWithWebIdentity does not require the use of Amazon Web Services 32 // security credentials. Therefore, you can distribute an application (for example, 33 // on mobile devices) that requests temporary security credentials without 34 // including long-term Amazon Web Services credentials in the application. You also 35 // don't need to deploy server-based proxy services that use long-term Amazon Web 36 // Services credentials. Instead, the identity of the caller is validated by using 37 // a token from the web identity provider. For a comparison of 38 // AssumeRoleWithWebIdentity with the other API operations that produce temporary 39 // credentials, see Requesting Temporary Security Credentials 40 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) 41 // and Comparing the Amazon Web Services STS API operations 42 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison) 43 // in the IAM User Guide. The temporary security credentials returned by this API 44 // consist of an access key ID, a secret access key, and a security token. 45 // Applications can use these temporary security credentials to sign calls to 46 // Amazon Web Services service API operations. Session Duration By default, the 47 // temporary security credentials created by AssumeRoleWithWebIdentity last for one 48 // hour. However, you can use the optional DurationSeconds parameter to specify the 49 // duration of your session. You can provide a value from 900 seconds (15 minutes) 50 // up to the maximum session duration setting for the role. This setting can have a 51 // value from 1 hour to 12 hours. To learn how to view the maximum value for your 52 // role, see View the Maximum Session Duration Setting for a Role 53 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) 54 // in the IAM User Guide. The maximum session duration limit applies when you use 55 // the AssumeRole* API operations or the assume-role* CLI commands. However the 56 // limit does not apply when you use those operations to create a console URL. For 57 // more information, see Using IAM Roles 58 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html) in the IAM 59 // User Guide. Permissions The temporary security credentials created by 60 // AssumeRoleWithWebIdentity can be used to make API calls to any Amazon Web 61 // Services service with the following exception: you cannot call the STS 62 // GetFederationToken or GetSessionToken API operations. (Optional) You can pass 63 // inline or managed session policies 64 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) 65 // to this operation. You can pass a single JSON policy document to use as an 66 // inline session policy. You can also specify up to 10 managed policies to use as 67 // managed session policies. The plaintext that you use for both inline and managed 68 // session policies can't exceed 2,048 characters. Passing policies to this 69 // operation returns new temporary credentials. The resulting session's permissions 70 // are the intersection of the role's identity-based policy and the session 71 // policies. You can use the role's temporary credentials in subsequent Amazon Web 72 // Services API calls to access resources in the account that owns the role. You 73 // cannot use session policies to grant more permissions than those allowed by the 74 // identity-based policy of the role that is being assumed. For more information, 75 // see Session Policies 76 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) 77 // in the IAM User Guide. Tags (Optional) You can configure your IdP to pass 78 // attributes into your web identity token as session tags. Each session tag 79 // consists of a key name and an associated value. For more information about 80 // session tags, see Passing Session Tags in STS 81 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) in the 82 // IAM User Guide. You can pass up to 50 session tags. The plaintext session tag 83 // keys can’t exceed 128 characters and the values can’t exceed 256 characters. For 84 // these and additional limits, see IAM and STS Character Limits 85 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length) 86 // in the IAM User Guide. An Amazon Web Services conversion compresses the passed 87 // session policies and session tags into a packed binary format that has a 88 // separate limit. Your request can fail for this limit even if your plaintext 89 // meets the other requirements. The PackedPolicySize response element indicates by 90 // percentage how close the policies and tags for your request are to the upper 91 // size limit. You can pass a session tag with the same key as a tag that is 92 // attached to the role. When you do, the session tag overrides the role tag with 93 // the same key. An administrator must grant you the permissions necessary to pass 94 // session tags. The administrator can also create granular permissions to allow 95 // you to pass only specific session tags. For more information, see Tutorial: 96 // Using Tags for Attribute-Based Access Control 97 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html) 98 // in the IAM User Guide. You can set the session tags as transitive. Transitive 99 // tags persist during role chaining. For more information, see Chaining Roles with 100 // Session Tags 101 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining) 102 // in the IAM User Guide. Identities Before your application can call 103 // AssumeRoleWithWebIdentity, you must have an identity token from a supported 104 // identity provider and create a role that the application can assume. The role 105 // that your application assumes must trust the identity provider that is 106 // associated with the identity token. In other words, the identity provider must 107 // be specified in the role's trust policy. Calling AssumeRoleWithWebIdentity can 108 // result in an entry in your CloudTrail logs. The entry includes the Subject 109 // (http://openid.net/specs/openid-connect-core-1_0.html#Claims) of the provided 110 // web identity token. We recommend that you avoid using any personally 111 // identifiable information (PII) in this field. For example, you could instead use 112 // a GUID or a pairwise identifier, as suggested in the OIDC specification 113 // (http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes). For more 114 // information about how to use web identity federation and the 115 // AssumeRoleWithWebIdentity API, see the following resources: 116 // 117 // * Using Web 118 // Identity Federation API Operations for Mobile Apps 119 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html) 120 // and Federation Through a Web-based Identity Provider 121 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity). 122 // 123 // * 124 // Web Identity Federation Playground 125 // (https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/). 126 // Walk through the process of authenticating through Login with Amazon, Facebook, 127 // or Google, getting temporary security credentials, and then using those 128 // credentials to make a request to Amazon Web Services. 129 // 130 // * Amazon Web Services SDK 131 // for iOS Developer Guide (http://aws.amazon.com/sdkforios/) and Amazon Web 132 // Services SDK for Android Developer Guide (http://aws.amazon.com/sdkforandroid/). 133 // These toolkits contain sample apps that show how to invoke the identity 134 // providers. The toolkits then show how to use the information from these 135 // providers to get and use temporary security credentials. 136 // 137 // * Web Identity 138 // Federation with Mobile Applications 139 // (http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications). 140 // This article discusses web identity federation and shows an example of how to 141 // use web identity federation to get access to content in Amazon S3. 142 func (c *Client) AssumeRoleWithWebIdentity(ctx context.Context, params *AssumeRoleWithWebIdentityInput, optFns ...func(*Options)) (*AssumeRoleWithWebIdentityOutput, error) { 143 if params == nil { 144 params = &AssumeRoleWithWebIdentityInput{} 145 } 146 147 result, metadata, err := c.invokeOperation(ctx, "AssumeRoleWithWebIdentity", params, optFns, c.addOperationAssumeRoleWithWebIdentityMiddlewares) 148 if err != nil { 149 return nil, err 150 } 151 152 out := result.(*AssumeRoleWithWebIdentityOutput) 153 out.ResultMetadata = metadata 154 return out, nil 155 } 156 157 type AssumeRoleWithWebIdentityInput struct { 158 159 // The Amazon Resource Name (ARN) of the role that the caller is assuming. 160 // 161 // This member is required. 162 RoleArn *string 163 164 // An identifier for the assumed role session. Typically, you pass the name or 165 // identifier that is associated with the user who is using your application. That 166 // way, the temporary security credentials that your application will use are 167 // associated with that user. This session name is included as part of the ARN and 168 // assumed role ID in the AssumedRoleUser response element. The regex used to 169 // validate this parameter is a string of characters consisting of upper- and 170 // lower-case alphanumeric characters with no spaces. You can also include 171 // underscores or any of the following characters: =,.@- 172 // 173 // This member is required. 174 RoleSessionName *string 175 176 // The OAuth 2.0 access token or OpenID Connect ID token that is provided by the 177 // identity provider. Your application must get this token by authenticating the 178 // user who is using your application with a web identity provider before the 179 // application makes an AssumeRoleWithWebIdentity call. 180 // 181 // This member is required. 182 WebIdentityToken *string 183 184 // The duration, in seconds, of the role session. The value can range from 900 185 // seconds (15 minutes) up to the maximum session duration setting for the role. 186 // This setting can have a value from 1 hour to 12 hours. If you specify a value 187 // higher than this setting, the operation fails. For example, if you specify a 188 // session duration of 12 hours, but your administrator set the maximum session 189 // duration to 6 hours, your operation fails. To learn how to view the maximum 190 // value for your role, see View the Maximum Session Duration Setting for a Role 191 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) 192 // in the IAM User Guide. By default, the value is set to 3600 seconds. The 193 // DurationSeconds parameter is separate from the duration of a console session 194 // that you might request using the returned credentials. The request to the 195 // federation endpoint for a console sign-in token takes a SessionDuration 196 // parameter that specifies the maximum length of the console session. For more 197 // information, see Creating a URL that Enables Federated Users to Access the 198 // Amazon Web Services Management Console 199 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html) 200 // in the IAM User Guide. 201 DurationSeconds *int32 202 203 // An IAM policy in JSON format that you want to use as an inline session policy. 204 // This parameter is optional. Passing policies to this operation returns new 205 // temporary credentials. The resulting session's permissions are the intersection 206 // of the role's identity-based policy and the session policies. You can use the 207 // role's temporary credentials in subsequent Amazon Web Services API calls to 208 // access resources in the account that owns the role. You cannot use session 209 // policies to grant more permissions than those allowed by the identity-based 210 // policy of the role that is being assumed. For more information, see Session 211 // Policies 212 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) 213 // in the IAM User Guide. The plaintext that you use for both inline and managed 214 // session policies can't exceed 2,048 characters. The JSON policy characters can 215 // be any ASCII character from the space character to the end of the valid 216 // character list (\u0020 through \u00FF). It can also include the tab (\u0009), 217 // linefeed (\u000A), and carriage return (\u000D) characters. An Amazon Web 218 // Services conversion compresses the passed session policies and session tags into 219 // a packed binary format that has a separate limit. Your request can fail for this 220 // limit even if your plaintext meets the other requirements. The PackedPolicySize 221 // response element indicates by percentage how close the policies and tags for 222 // your request are to the upper size limit. 223 Policy *string 224 225 // The Amazon Resource Names (ARNs) of the IAM managed policies that you want to 226 // use as managed session policies. The policies must exist in the same account as 227 // the role. This parameter is optional. You can provide up to 10 managed policy 228 // ARNs. However, the plaintext that you use for both inline and managed session 229 // policies can't exceed 2,048 characters. For more information about ARNs, see 230 // Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces 231 // (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) in 232 // the Amazon Web Services General Reference. An Amazon Web Services conversion 233 // compresses the passed session policies and session tags into a packed binary 234 // format that has a separate limit. Your request can fail for this limit even if 235 // your plaintext meets the other requirements. The PackedPolicySize response 236 // element indicates by percentage how close the policies and tags for your request 237 // are to the upper size limit. Passing policies to this operation returns new 238 // temporary credentials. The resulting session's permissions are the intersection 239 // of the role's identity-based policy and the session policies. You can use the 240 // role's temporary credentials in subsequent Amazon Web Services API calls to 241 // access resources in the account that owns the role. You cannot use session 242 // policies to grant more permissions than those allowed by the identity-based 243 // policy of the role that is being assumed. For more information, see Session 244 // Policies 245 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) 246 // in the IAM User Guide. 247 PolicyArns []types.PolicyDescriptorType 248 249 // The fully qualified host component of the domain name of the OAuth 2.0 identity 250 // provider. Do not specify this value for an OpenID Connect identity provider. 251 // Currently www.amazon.com and graph.facebook.com are the only supported identity 252 // providers for OAuth 2.0 access tokens. Do not include URL schemes and port 253 // numbers. Do not specify this value for OpenID Connect ID tokens. 254 ProviderId *string 255 256 noSmithyDocumentSerde 257 } 258 259 // Contains the response to a successful AssumeRoleWithWebIdentity request, 260 // including temporary Amazon Web Services credentials that can be used to make 261 // Amazon Web Services requests. 262 type AssumeRoleWithWebIdentityOutput struct { 263 264 // The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers 265 // that you can use to refer to the resulting temporary security credentials. For 266 // example, you can reference these credentials as a principal in a resource-based 267 // policy by using the ARN or assumed role ID. The ARN and ID include the 268 // RoleSessionName that you specified when you called AssumeRole. 269 AssumedRoleUser *types.AssumedRoleUser 270 271 // The intended audience (also known as client ID) of the web identity token. This 272 // is traditionally the client identifier issued to the application that requested 273 // the web identity token. 274 Audience *string 275 276 // The temporary security credentials, which include an access key ID, a secret 277 // access key, and a security token. The size of the security token that STS API 278 // operations return is not fixed. We strongly recommend that you make no 279 // assumptions about the maximum size. 280 Credentials *types.Credentials 281 282 // A percentage value that indicates the packed size of the session policies and 283 // session tags combined passed in the request. The request fails if the packed 284 // size is greater than 100 percent, which means the policies and tags exceeded the 285 // allowed space. 286 PackedPolicySize *int32 287 288 // The issuing authority of the web identity token presented. For OpenID Connect ID 289 // tokens, this contains the value of the iss field. For OAuth 2.0 access tokens, 290 // this contains the value of the ProviderId parameter that was passed in the 291 // AssumeRoleWithWebIdentity request. 292 Provider *string 293 294 // The value of the source identity that is returned in the JSON web token (JWT) 295 // from the identity provider. You can require users to set a source identity value 296 // when they assume a role. You do this by using the sts:SourceIdentity condition 297 // key in a role trust policy. That way, actions that are taken with the role are 298 // associated with that user. After the source identity is set, the value cannot be 299 // changed. It is present in the request for all actions that are taken by the role 300 // and persists across chained role 301 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining) 302 // sessions. You can configure your identity provider to use an attribute 303 // associated with your users, like user name or email, as the source identity when 304 // calling AssumeRoleWithWebIdentity. You do this by adding a claim to the JSON web 305 // token. To learn more about OIDC tokens and claims, see Using Tokens with User 306 // Pools 307 // (https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html) 308 // in the Amazon Cognito Developer Guide. For more information about using source 309 // identity, see Monitor and control actions taken with assumed roles 310 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) 311 // in the IAM User Guide. The regex used to validate this parameter is a string of 312 // characters consisting of upper- and lower-case alphanumeric characters with no 313 // spaces. You can also include underscores or any of the following characters: 314 // =,.@- 315 SourceIdentity *string 316 317 // The unique user identifier that is returned by the identity provider. This 318 // identifier is associated with the WebIdentityToken that was submitted with the 319 // AssumeRoleWithWebIdentity call. The identifier is typically unique to the user 320 // and the application that acquired the WebIdentityToken (pairwise identifier). 321 // For OpenID Connect ID tokens, this field contains the value returned by the 322 // identity provider as the token's sub (Subject) claim. 323 SubjectFromWebIdentityToken *string 324 325 // Metadata pertaining to the operation's result. 326 ResultMetadata middleware.Metadata 327 328 noSmithyDocumentSerde 329 } 330 331 func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middleware.Stack, options Options) (err error) { 332 err = stack.Serialize.Add(&awsAwsquery_serializeOpAssumeRoleWithWebIdentity{}, middleware.After) 333 if err != nil { 334 return err 335 } 336 err = stack.Deserialize.Add(&awsAwsquery_deserializeOpAssumeRoleWithWebIdentity{}, middleware.After) 337 if err != nil { 338 return err 339 } 340 if err = addSetLoggerMiddleware(stack, options); err != nil { 341 return err 342 } 343 if err = awsmiddleware.AddClientRequestIDMiddleware(stack); err != nil { 344 return err 345 } 346 if err = smithyhttp.AddComputeContentLengthMiddleware(stack); err != nil { 347 return err 348 } 349 if err = addResolveEndpointMiddleware(stack, options); err != nil { 350 return err 351 } 352 if err = addRetryMiddlewares(stack, options); err != nil { 353 return err 354 } 355 if err = awsmiddleware.AddRawResponseToMetadata(stack); err != nil { 356 return err 357 } 358 if err = awsmiddleware.AddRecordResponseTiming(stack); err != nil { 359 return err 360 } 361 if err = addClientUserAgent(stack); err != nil { 362 return err 363 } 364 if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { 365 return err 366 } 367 if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { 368 return err 369 } 370 if err = addOpAssumeRoleWithWebIdentityValidationMiddleware(stack); err != nil { 371 return err 372 } 373 if err = stack.Initialize.Add(newServiceMetadataMiddleware_opAssumeRoleWithWebIdentity(options.Region), middleware.Before); err != nil { 374 return err 375 } 376 if err = addRequestIDRetrieverMiddleware(stack); err != nil { 377 return err 378 } 379 if err = addResponseErrorMiddleware(stack); err != nil { 380 return err 381 } 382 if err = addRequestResponseLogging(stack, options); err != nil { 383 return err 384 } 385 return nil 386 } 387 388 func newServiceMetadataMiddleware_opAssumeRoleWithWebIdentity(region string) *awsmiddleware.RegisterServiceMetadata { 389 return &awsmiddleware.RegisterServiceMetadata{ 390 Region: region, 391 ServiceID: ServiceID, 392 SigningName: "sts", 393 OperationName: "AssumeRoleWithWebIdentity", 394 } 395 }