api_op_AssumeRoot.go (6790B)
1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package sts 4 5 import ( 6 "context" 7 8 "github.com/aws/aws-sdk-go-v2/service/sts/types" 9 "github.com/aws/smithy-go/middleware" 10 ) 11 12 // Returns a set of short term credentials you can use to perform privileged tasks 13 // on a member account in your organization. You must use credentials from an 14 // Organizations management account or a delegated administrator account for IAM to 15 // call AssumeRoot . You cannot use root user credentials to make this call. 16 // 17 // Before you can launch a privileged session, you must have centralized root 18 // access in your organization. For steps to enable this feature, see [Centralize root access for member accounts]in the IAM 19 // User Guide. 20 // 21 // The STS global endpoint is not supported for AssumeRoot. You must send this 22 // request to a Regional STS endpoint. For more information, see [Endpoints]. 23 // 24 // You can track AssumeRoot in CloudTrail logs to determine what actions were 25 // performed in a session. For more information, see [Track privileged tasks in CloudTrail]in the IAM User Guide. 26 // 27 // When granting access to privileged tasks you should only grant the necessary 28 // permissions required to perform that task. For more information, see [Security best practices in IAM]. In 29 // addition, you can use [service control policies](SCPs) to manage and limit permissions in your 30 // organization. See [General examples]in the Organizations User Guide for more information on SCPs. 31 // 32 // [Endpoints]: https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html#sts-endpoints 33 // [Security best practices in IAM]: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html 34 // [Track privileged tasks in CloudTrail]: https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-track-privileged-tasks.html 35 // [General examples]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html 36 // [service control policies]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html 37 // [Centralize root access for member accounts]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html 38 func (c *Client) AssumeRoot(ctx context.Context, params *AssumeRootInput, optFns ...func(*Options)) (*AssumeRootOutput, error) { 39 if params == nil { 40 params = &AssumeRootInput{} 41 } 42 43 result, metadata, err := c.invokeOperation(ctx, "AssumeRoot", params, optFns, c.addOperationAssumeRootMiddlewares) 44 if err != nil { 45 return nil, err 46 } 47 48 out := result.(*AssumeRootOutput) 49 out.ResultMetadata = metadata 50 return out, nil 51 } 52 53 type AssumeRootInput struct { 54 55 // The member account principal ARN or account ID. 56 // 57 // This member is required. 58 TargetPrincipal *string 59 60 // The identity based policy that scopes the session to the privileged tasks that 61 // can be performed. You must 62 // 63 // use one of following Amazon Web Services managed policies to scope root session 64 // actions: 65 // 66 // [IAMAuditRootUserCredentials] 67 // 68 // [IAMCreateRootUserPassword] 69 // 70 // [IAMDeleteRootUserCredentials] 71 // 72 // [S3UnlockBucketPolicy] 73 // 74 // [SQSUnlockQueuePolicy] 75 // 76 // [IAMDeleteRootUserCredentials]: https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-IAMDeleteRootUserCredentials 77 // [IAMCreateRootUserPassword]: https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-IAMCreateRootUserPassword 78 // [IAMAuditRootUserCredentials]: https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-IAMAuditRootUserCredentials 79 // [S3UnlockBucketPolicy]: https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-S3UnlockBucketPolicy 80 // [SQSUnlockQueuePolicy]: https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-SQSUnlockQueuePolicy 81 // 82 // This member is required. 83 TaskPolicyArn *types.PolicyDescriptorType 84 85 // The duration, in seconds, of the privileged session. The value can range from 0 86 // seconds up to the maximum session duration of 900 seconds (15 minutes). If you 87 // specify a value higher than this setting, the operation fails. 88 // 89 // By default, the value is set to 900 seconds. 90 DurationSeconds *int32 91 92 noSmithyDocumentSerde 93 } 94 95 type AssumeRootOutput struct { 96 97 // The temporary security credentials, which include an access key ID, a secret 98 // access key, and a security token. 99 // 100 // The size of the security token that STS API operations return is not fixed. We 101 // strongly recommend that you make no assumptions about the maximum size. 102 Credentials *types.Credentials 103 104 // The source identity specified by the principal that is calling the AssumeRoot 105 // operation. 106 // 107 // You can use the aws:SourceIdentity condition key to control access based on the 108 // value of source identity. For more information about using source identity, see [Monitor and control actions taken with assumed roles] 109 // in the IAM User Guide. 110 // 111 // The regex used to validate this parameter is a string of characters consisting 112 // of upper- and lower-case alphanumeric characters with no spaces. You can also 113 // include underscores or any of the following characters: =,.@- 114 // 115 // [Monitor and control actions taken with assumed roles]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html 116 SourceIdentity *string 117 118 // Metadata pertaining to the operation's result. 119 ResultMetadata middleware.Metadata 120 121 noSmithyDocumentSerde 122 } 123 124 func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, options Options) (err error) { 125 err = stack.Serialize.Add(&awsAwsquery_serializeOpAssumeRoot{}, middleware.After) 126 if err != nil { 127 return err 128 } 129 err = stack.Deserialize.Add(&awsAwsquery_deserializeOpAssumeRoot{}, middleware.After) 130 if err != nil { 131 return err 132 } 133 134 if err = addComputeContentLength(stack); err != nil { 135 return err 136 } 137 if err = addResolveEndpointMiddleware(stack, options); err != nil { 138 return err 139 } 140 if err = addComputePayloadSHA256(stack); err != nil { 141 return err 142 } 143 if err = addRecordResponseTiming(stack, options); err != nil { 144 return err 145 } 146 if err = addCredentialSource(stack, options); err != nil { 147 return err 148 } 149 if err = addOpAssumeRootValidationMiddleware(stack); err != nil { 150 return err 151 } 152 if err = addRequestIDRetrieverMiddleware(stack); err != nil { 153 return err 154 } 155 if err = addResponseErrorMiddleware(stack); err != nil { 156 return err 157 } 158 if err = addRequestResponseLogging(stack, options); err != nil { 159 return err 160 } 161 if err = addDisableHTTPSMiddleware(stack, options); err != nil { 162 return err 163 } 164 if err = addInterceptors(stack, options); err != nil { 165 return err 166 } 167 return nil 168 }