api_op_GetSessionToken.go (8087B)
1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package sts 4 5 import ( 6 "context" 7 8 "github.com/aws/aws-sdk-go-v2/service/sts/types" 9 "github.com/aws/smithy-go/middleware" 10 ) 11 12 // Returns a set of temporary credentials for an Amazon Web Services account or 13 // IAM user. The credentials consist of an access key ID, a secret access key, and 14 // a security token. Typically, you use GetSessionToken if you want to use MFA to 15 // protect programmatic calls to specific Amazon Web Services API operations like 16 // Amazon EC2 StopInstances . 17 // 18 // MFA-enabled IAM users must call GetSessionToken and submit an MFA code that is 19 // associated with their MFA device. Using the temporary security credentials that 20 // the call returns, IAM users can then make programmatic calls to API operations 21 // that require MFA authentication. An incorrect MFA code causes the API to return 22 // an access denied error. For a comparison of GetSessionToken with the other API 23 // operations that produce temporary credentials, see [Requesting Temporary Security Credentials]and [Compare STS credentials] in the IAM User Guide. 24 // 25 // No permissions are required for users to perform this operation. The purpose of 26 // the sts:GetSessionToken operation is to authenticate the user using MFA. You 27 // cannot use policies to control authentication operations. For more information, 28 // see [Permissions for GetSessionToken]in the IAM User Guide. 29 // 30 // # Session Duration 31 // 32 // The GetSessionToken operation must be called by using the long-term Amazon Web 33 // Services security credentials of an IAM user. Credentials that are created by 34 // IAM users are valid for the duration that you specify. This duration can range 35 // from 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours), 36 // with a default of 43,200 seconds (12 hours). Credentials based on account 37 // credentials can range from 900 seconds (15 minutes) up to 3,600 seconds (1 38 // hour), with a default of 1 hour. 39 // 40 // # Permissions 41 // 42 // The temporary security credentials created by GetSessionToken can be used to 43 // make API calls to any Amazon Web Services service with the following exceptions: 44 // 45 // - You cannot call any IAM API operations unless MFA authentication 46 // information is included in the request. 47 // 48 // - You cannot call any STS API except AssumeRole or GetCallerIdentity . 49 // 50 // The credentials that GetSessionToken returns are based on permissions 51 // associated with the IAM user whose credentials were used to call the operation. 52 // The temporary credentials have the same permissions as the IAM user. 53 // 54 // Although it is possible to call GetSessionToken using the security credentials 55 // of an Amazon Web Services account root user rather than an IAM user, we do not 56 // recommend it. If GetSessionToken is called using root user credentials, the 57 // temporary credentials have root user permissions. For more information, see [Safeguard your root user credentials and don't use them for everyday tasks]in 58 // the IAM User Guide 59 // 60 // For more information about using GetSessionToken to create temporary 61 // credentials, see [Temporary Credentials for Users in Untrusted Environments]in the IAM User Guide. 62 // 63 // [Permissions for GetSessionToken]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html 64 // [Temporary Credentials for Users in Untrusted Environments]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken 65 // [Safeguard your root user credentials and don't use them for everyday tasks]: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials 66 // [Requesting Temporary Security Credentials]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html 67 // [Compare STS credentials]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_sts-comparison.html 68 func (c *Client) GetSessionToken(ctx context.Context, params *GetSessionTokenInput, optFns ...func(*Options)) (*GetSessionTokenOutput, error) { 69 if params == nil { 70 params = &GetSessionTokenInput{} 71 } 72 73 result, metadata, err := c.invokeOperation(ctx, "GetSessionToken", params, optFns, c.addOperationGetSessionTokenMiddlewares) 74 if err != nil { 75 return nil, err 76 } 77 78 out := result.(*GetSessionTokenOutput) 79 out.ResultMetadata = metadata 80 return out, nil 81 } 82 83 type GetSessionTokenInput struct { 84 85 // The duration, in seconds, that the credentials should remain valid. Acceptable 86 // durations for IAM user sessions range from 900 seconds (15 minutes) to 129,600 87 // seconds (36 hours), with 43,200 seconds (12 hours) as the default. Sessions for 88 // Amazon Web Services account owners are restricted to a maximum of 3,600 seconds 89 // (one hour). If the duration is longer than one hour, the session for Amazon Web 90 // Services account owners defaults to one hour. 91 DurationSeconds *int32 92 93 // The identification number of the MFA device that is associated with the IAM 94 // user who is making the GetSessionToken call. Specify this value if the IAM user 95 // has a policy that requires MFA authentication. The value is either the serial 96 // number for a hardware device (such as GAHT12345678 ) or an Amazon Resource Name 97 // (ARN) for a virtual device (such as arn:aws:iam::123456789012:mfa/user ). You 98 // can find the device for an IAM user by going to the Amazon Web Services 99 // Management Console and viewing the user's security credentials. 100 // 101 // The regex used to validate this parameter is a string of characters consisting 102 // of upper- and lower-case alphanumeric characters with no spaces. You can also 103 // include underscores or any of the following characters: =,.@:/- 104 SerialNumber *string 105 106 // The value provided by the MFA device, if MFA is required. If any policy 107 // requires the IAM user to submit an MFA code, specify this value. If MFA 108 // authentication is required, the user must provide a code when requesting a set 109 // of temporary security credentials. A user who fails to provide the code receives 110 // an "access denied" response when requesting resources that require MFA 111 // authentication. 112 // 113 // The format for this parameter, as described by its regex pattern, is a sequence 114 // of six numeric digits. 115 TokenCode *string 116 117 noSmithyDocumentSerde 118 } 119 120 // Contains the response to a successful GetSessionToken request, including temporary Amazon Web 121 // Services credentials that can be used to make Amazon Web Services requests. 122 type GetSessionTokenOutput struct { 123 124 // The temporary security credentials, which include an access key ID, a secret 125 // access key, and a security (or session) token. 126 // 127 // The size of the security token that STS API operations return is not fixed. We 128 // strongly recommend that you make no assumptions about the maximum size. 129 Credentials *types.Credentials 130 131 // Metadata pertaining to the operation's result. 132 ResultMetadata middleware.Metadata 133 134 noSmithyDocumentSerde 135 } 136 137 func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack, options Options) (err error) { 138 err = stack.Serialize.Add(&awsAwsquery_serializeOpGetSessionToken{}, middleware.After) 139 if err != nil { 140 return err 141 } 142 err = stack.Deserialize.Add(&awsAwsquery_deserializeOpGetSessionToken{}, middleware.After) 143 if err != nil { 144 return err 145 } 146 147 if err = addComputeContentLength(stack); err != nil { 148 return err 149 } 150 if err = addResolveEndpointMiddleware(stack, options); err != nil { 151 return err 152 } 153 if err = addComputePayloadSHA256(stack); err != nil { 154 return err 155 } 156 if err = addRecordResponseTiming(stack, options); err != nil { 157 return err 158 } 159 if err = addCredentialSource(stack, options); err != nil { 160 return err 161 } 162 if err = addRequestIDRetrieverMiddleware(stack); err != nil { 163 return err 164 } 165 if err = addResponseErrorMiddleware(stack); err != nil { 166 return err 167 } 168 if err = addRequestResponseLogging(stack, options); err != nil { 169 return err 170 } 171 if err = addDisableHTTPSMiddleware(stack, options); err != nil { 172 return err 173 } 174 if err = addInterceptors(stack, options); err != nil { 175 return err 176 } 177 return nil 178 }