Skip to content

Commit 13e6e50

Browse files
aws-sdk-dotnet-automationaws-sdk-dotnet-automation
committed
Granular access control support for NEO-SAML with IAMFederation for AOS data source
1 parent fa14430 commit 13e6e50

File tree

12 files changed

+573
-0
lines changed

12 files changed

+573
-0
lines changed

‎generator/ServiceModels/opensearch/opensearch-2021-01-01.api.json

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1417,6 +1417,7 @@
14171417
"InternalUserDatabaseEnabled":{"shape":"Boolean"},
14181418
"SAMLOptions":{"shape":"SAMLOptionsOutput"},
14191419
"JWTOptions":{"shape":"JWTOptionsOutput"},
1420+
"IAMFederationOptions":{"shape":"IAMFederationOptionsOutput"},
14201421
"AnonymousAuthDisableDate":{"shape":"DisableTimestamp"},
14211422
"AnonymousAuthEnabled":{"shape":"Boolean"}
14221423
}
@@ -1429,6 +1430,7 @@
14291430
"MasterUserOptions":{"shape":"MasterUserOptions"},
14301431
"SAMLOptions":{"shape":"SAMLOptionsInput"},
14311432
"JWTOptions":{"shape":"JWTOptionsInput"},
1433+
"IAMFederationOptions":{"shape":"IAMFederationOptionsInput"},
14321434
"AnonymousAuthEnabled":{"shape":"Boolean"}
14331435
}
14341436
},
@@ -3307,6 +3309,34 @@
33073309
}
33083310
},
33093311
"HostedZoneId":{"type":"string"},
3312+
"IAMFederationOptionsInput":{
3313+
"type":"structure",
3314+
"members":{
3315+
"Enabled":{"shape":"Boolean"},
3316+
"SubjectKey":{"shape":"IAMFederationSubjectKey"},
3317+
"RolesKey":{"shape":"IAMFederationRolesKey"}
3318+
}
3319+
},
3320+
"IAMFederationOptionsOutput":{
3321+
"type":"structure",
3322+
"members":{
3323+
"Enabled":{"shape":"Boolean"},
3324+
"SubjectKey":{"shape":"IAMFederationSubjectKey"},
3325+
"RolesKey":{"shape":"IAMFederationRolesKey"}
3326+
}
3327+
},
3328+
"IAMFederationRolesKey":{
3329+
"type":"string",
3330+
"max":64,
3331+
"min":1,
3332+
"pattern":"^(null|[A-Za-z][A-Za-z0-9_.:/=+\\-@]*)$"
3333+
},
3334+
"IAMFederationSubjectKey":{
3335+
"type":"string",
3336+
"max":64,
3337+
"min":1,
3338+
"pattern":"^(null|[A-Za-z][A-Za-z0-9_.:/=+\\-@]*)$"
3339+
},
33103340
"IPAddressType":{
33113341
"type":"string",
33123342
"enum":[

‎generator/ServiceModels/opensearch/opensearch-2021-01-01.docs.json

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,8 @@
501501
"DomainStatus$UpgradeProcessing": "<p>The status of a domain version upgrade to a new version of OpenSearch or Elasticsearch. True if OpenSearch Service is in the process of a version upgrade. False if the configuration is active.</p>",
502502
"EBSOptions$EBSEnabled": "<p>Indicates whether EBS volumes are attached to data nodes in an OpenSearch Service domain.</p>",
503503
"EncryptionAtRestOptions$Enabled": "<p>True to enable encryption at rest.</p>",
504+
"IAMFederationOptionsInput$Enabled": "<p>True to enable IAM federation authentication for a domain.</p>",
505+
"IAMFederationOptionsOutput$Enabled": "<p>True if IAM federation is enabled.</p>",
504506
"IamIdentityCenterOptions$enabled": "<p>Indicates whether IAM Identity Center is enabled for the OpenSearch application.</p>",
505507
"IamIdentityCenterOptionsInput$enabled": "<p>Specifies whether IAM Identity Center is enabled or disabled.</p>",
506508
"IdentityCenterOptions$EnabledAPIAccess": "<p>Indicates whether IAM Identity Center is enabled for the application.</p>",
@@ -1620,6 +1622,32 @@
16201622
"DomainStatus$DomainEndpointV2HostedZoneId": "<p>The dual stack hosted zone ID for the domain. </p>"
16211623
}
16221624
},
1625+
"IAMFederationOptionsInput": {
1626+
"base": "<p>The IAM federation authentication configuration for an Amazon OpenSearch Service domain.</p>",
1627+
"refs": {
1628+
"AdvancedSecurityOptionsInput$IAMFederationOptions": "<p>Container for information about the IAM federation configuration for an OpenSearch UI application.</p>"
1629+
}
1630+
},
1631+
"IAMFederationOptionsOutput": {
1632+
"base": "<p>Describes the IAM federation options configured for the domain.</p>",
1633+
"refs": {
1634+
"AdvancedSecurityOptions$IAMFederationOptions": "<p>Container for information about the IAM federation configuration for an OpenSearch UI application.</p>"
1635+
}
1636+
},
1637+
"IAMFederationRolesKey": {
1638+
"base": null,
1639+
"refs": {
1640+
"IAMFederationOptionsInput$RolesKey": "<p>Element of the IAM federation assertion to use for backend roles. Default is <code>roles</code>.</p>",
1641+
"IAMFederationOptionsOutput$RolesKey": "<p>The key used for matching the IAM federation roles attribute.</p>"
1642+
}
1643+
},
1644+
"IAMFederationSubjectKey": {
1645+
"base": null,
1646+
"refs": {
1647+
"IAMFederationOptionsInput$SubjectKey": "<p>Element of the IAM federation assertion to use for the user name. Default is <code>sub</code>.</p>",
1648+
"IAMFederationOptionsOutput$SubjectKey": "<p>The key used for matching the IAM federation subject attribute.</p>"
1649+
}
1650+
},
16231651
"IPAddressType": {
16241652
"base": null,
16251653
"refs": {

‎generator/ServiceModels/opensearch/opensearch-2021-01-01.normal.json

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1600,6 +1600,10 @@
16001600
"shape":"JWTOptionsOutput",
16011601
"documentation":"<p>Container for information about the JWT configuration of the Amazon OpenSearch Service.</p>"
16021602
},
1603+
"IAMFederationOptions":{
1604+
"shape":"IAMFederationOptionsOutput",
1605+
"documentation":"<p>Container for information about the IAM federation configuration for an OpenSearch UI application.</p>"
1606+
},
16031607
"AnonymousAuthDisableDate":{
16041608
"shape":"DisableTimestamp",
16051609
"documentation":"<p>Date and time when the migration period will be disabled. Only necessary when <a href=\"https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-enabling-existing\">enabling fine-grained access control on an existing domain</a>.</p>"
@@ -1634,6 +1638,10 @@
16341638
"shape":"JWTOptionsInput",
16351639
"documentation":"<p>Container for information about the JWT configuration of the Amazon OpenSearch Service. </p>"
16361640
},
1641+
"IAMFederationOptions":{
1642+
"shape":"IAMFederationOptionsInput",
1643+
"documentation":"<p>Container for information about the IAM federation configuration for an OpenSearch UI application.</p>"
1644+
},
16371645
"AnonymousAuthEnabled":{
16381646
"shape":"Boolean",
16391647
"documentation":"<p>True to enable a 30-day migration period during which administrators can create role mappings. Only necessary when <a href=\"https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-enabling-existing\">enabling fine-grained access control on an existing domain</a>.</p>"
@@ -4862,6 +4870,54 @@
48624870
"documentation":"<p>Container for the response returned by the <code>GetUpgradeStatus</code> operation.</p>"
48634871
},
48644872
"HostedZoneId":{"type":"string"},
4873+
"IAMFederationOptionsInput":{
4874+
"type":"structure",
4875+
"members":{
4876+
"Enabled":{
4877+
"shape":"Boolean",
4878+
"documentation":"<p>True to enable IAM federation authentication for a domain.</p>"
4879+
},
4880+
"SubjectKey":{
4881+
"shape":"IAMFederationSubjectKey",
4882+
"documentation":"<p>Element of the IAM federation assertion to use for the user name. Default is <code>sub</code>.</p>"
4883+
},
4884+
"RolesKey":{
4885+
"shape":"IAMFederationRolesKey",
4886+
"documentation":"<p>Element of the IAM federation assertion to use for backend roles. Default is <code>roles</code>.</p>"
4887+
}
4888+
},
4889+
"documentation":"<p>The IAM federation authentication configuration for an Amazon OpenSearch Service domain.</p>"
4890+
},
4891+
"IAMFederationOptionsOutput":{
4892+
"type":"structure",
4893+
"members":{
4894+
"Enabled":{
4895+
"shape":"Boolean",
4896+
"documentation":"<p>True if IAM federation is enabled.</p>"
4897+
},
4898+
"SubjectKey":{
4899+
"shape":"IAMFederationSubjectKey",
4900+
"documentation":"<p>The key used for matching the IAM federation subject attribute.</p>"
4901+
},
4902+
"RolesKey":{
4903+
"shape":"IAMFederationRolesKey",
4904+
"documentation":"<p>The key used for matching the IAM federation roles attribute.</p>"
4905+
}
4906+
},
4907+
"documentation":"<p>Describes the IAM federation options configured for the domain.</p>"
4908+
},
4909+
"IAMFederationRolesKey":{
4910+
"type":"string",
4911+
"max":64,
4912+
"min":1,
4913+
"pattern":"^(null|[A-Za-z][A-Za-z0-9_.:/=+\\-@]*)$"
4914+
},
4915+
"IAMFederationSubjectKey":{
4916+
"type":"string",
4917+
"max":64,
4918+
"min":1,
4919+
"pattern":"^(null|[A-Za-z][A-Za-z0-9_.:/=+\\-@]*)$"
4920+
},
48654921
"IPAddressType":{
48664922
"type":"string",
48674923
"enum":[

‎sdk/code-analysis/ServiceAnalysis/OpenSearchService/Generated/PropertyValueRules.xml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1045,6 +1045,30 @@
10451045
<min>1</min>
10461046
<max>100</max>
10471047
</property-value-rule>
1048+
<property-value-rule>
1049+
<property>Amazon.OpenSearchService.Model.IAMFederationOptionsInput.RolesKey</property>
1050+
<min>1</min>
1051+
<max>64</max>
1052+
<pattern>^(null|[A-Za-z][A-Za-z0-9_.:/=+\-@]*)$</pattern>
1053+
</property-value-rule>
1054+
<property-value-rule>
1055+
<property>Amazon.OpenSearchService.Model.IAMFederationOptionsInput.SubjectKey</property>
1056+
<min>1</min>
1057+
<max>64</max>
1058+
<pattern>^(null|[A-Za-z][A-Za-z0-9_.:/=+\-@]*)$</pattern>
1059+
</property-value-rule>
1060+
<property-value-rule>
1061+
<property>Amazon.OpenSearchService.Model.IAMFederationOptionsOutput.RolesKey</property>
1062+
<min>1</min>
1063+
<max>64</max>
1064+
<pattern>^(null|[A-Za-z][A-Za-z0-9_.:/=+\-@]*)$</pattern>
1065+
</property-value-rule>
1066+
<property-value-rule>
1067+
<property>Amazon.OpenSearchService.Model.IAMFederationOptionsOutput.SubjectKey</property>
1068+
<min>1</min>
1069+
<max>64</max>
1070+
<pattern>^(null|[A-Za-z][A-Za-z0-9_.:/=+\-@]*)$</pattern>
1071+
</property-value-rule>
10481072
<property-value-rule>
10491073
<property>Amazon.OpenSearchService.Model.IamIdentityCenterOptions.IamIdentityCenterApplicationArn</property>
10501074
<min>20</min>

‎sdk/src/Services/OpenSearchService/Generated/Model/AdvancedSecurityOptions.cs

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ public partial class AdvancedSecurityOptions
3737
private DateTime? _anonymousAuthDisableDate;
3838
private bool? _anonymousAuthEnabled;
3939
private bool? _enabled;
40+
private IAMFederationOptionsOutput _iamFederationOptions;
4041
private bool? _internalUserDatabaseEnabled;
4142
private JWTOptionsOutput _jwtOptions;
4243
private SAMLOptionsOutput _samlOptions;
@@ -98,6 +99,25 @@ internal bool IsSetEnabled()
9899
return this._enabled.HasValue;
99100
}
100101

102+
/// <summary>
103+
/// Gets and sets the property IAMFederationOptions.
104+
/// <para>
105+
/// Container for information about the IAM federation configuration for an OpenSearch
106+
/// UI application.
107+
/// </para>
108+
/// </summary>
109+
public IAMFederationOptionsOutput IAMFederationOptions
110+
{
111+
get { return this._iamFederationOptions; }
112+
set { this._iamFederationOptions = value; }
113+
}
114+
115+
// Check to see if IAMFederationOptions property is set
116+
internal bool IsSetIAMFederationOptions()
117+
{
118+
return this._iamFederationOptions != null;
119+
}
120+
101121
/// <summary>
102122
/// Gets and sets the property InternalUserDatabaseEnabled.
103123
/// <para>

‎sdk/src/Services/OpenSearchService/Generated/Model/AdvancedSecurityOptionsInput.cs

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ public partial class AdvancedSecurityOptionsInput
3838
{
3939
private bool? _anonymousAuthEnabled;
4040
private bool? _enabled;
41+
private IAMFederationOptionsInput _iamFederationOptions;
4142
private bool? _internalUserDatabaseEnabled;
4243
private JWTOptionsInput _jwtOptions;
4344
private MasterUserOptions _masterUserOptions;
@@ -81,6 +82,25 @@ internal bool IsSetEnabled()
8182
return this._enabled.HasValue;
8283
}
8384

85+
/// <summary>
86+
/// Gets and sets the property IAMFederationOptions.
87+
/// <para>
88+
/// Container for information about the IAM federation configuration for an OpenSearch
89+
/// UI application.
90+
/// </para>
91+
/// </summary>
92+
public IAMFederationOptionsInput IAMFederationOptions
93+
{
94+
get { return this._iamFederationOptions; }
95+
set { this._iamFederationOptions = value; }
96+
}
97+
98+
// Check to see if IAMFederationOptions property is set
99+
internal bool IsSetIAMFederationOptions()
100+
{
101+
return this._iamFederationOptions != null;
102+
}
103+
84104
/// <summary>
85105
/// Gets and sets the property InternalUserDatabaseEnabled.
86106
/// <para>

‎sdk/src/Services/OpenSearchService/Generated/Model/IAMFederationOptionsInput.cs

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/*
2+
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
/*
17+
* Do not modify this file. This file is generated from the opensearch-2021-01-01.normal.json service model.
18+
*/
19+
using System;
20+
using System.Collections.Generic;
21+
using System.Xml.Serialization;
22+
using System.Text;
23+
using System.IO;
24+
using System.Net;
25+
26+
using Amazon.Runtime;
27+
using Amazon.Runtime.Internal;
28+
29+
#pragma warning disable CS0612,CS0618,CS1570
30+
namespace Amazon.OpenSearchService.Model
31+
{
32+
/// <summary>
33+
/// The IAM federation authentication configuration for an Amazon OpenSearch Service domain.
34+
/// </summary>
35+
public partial class IAMFederationOptionsInput
36+
{
37+
private bool? _enabled;
38+
private string _rolesKey;
39+
private string _subjectKey;
40+
41+
/// <summary>
42+
/// Gets and sets the property Enabled.
43+
/// <para>
44+
/// True to enable IAM federation authentication for a domain.
45+
/// </para>
46+
/// </summary>
47+
public bool Enabled
48+
{
49+
get { return this._enabled.GetValueOrDefault(); }
50+
set { this._enabled = value; }
51+
}
52+
53+
// Check to see if Enabled property is set
54+
internal bool IsSetEnabled()
55+
{
56+
return this._enabled.HasValue;
57+
}
58+
59+
/// <summary>
60+
/// Gets and sets the property RolesKey.
61+
/// <para>
62+
/// Element of the IAM federation assertion to use for backend roles. Default is <c>roles</c>.
63+
/// </para>
64+
/// </summary>
65+
[AWSProperty(Min=1, Max=64)]
66+
public string RolesKey
67+
{
68+
get { return this._rolesKey; }
69+
set { this._rolesKey = value; }
70+
}
71+
72+
// Check to see if RolesKey property is set
73+
internal bool IsSetRolesKey()
74+
{
75+
return this._rolesKey != null;
76+
}
77+
78+
/// <summary>
79+
/// Gets and sets the property SubjectKey.
80+
/// <para>
81+
/// Element of the IAM federation assertion to use for the user name. Default is <c>sub</c>.
82+
/// </para>
83+
/// </summary>
84+
[AWSProperty(Min=1, Max=64)]
85+
public string SubjectKey
86+
{
87+
get { return this._subjectKey; }
88+
set { this._subjectKey = value; }
89+
}
90+
91+
// Check to see if SubjectKey property is set
92+
internal bool IsSetSubjectKey()
93+
{
94+
return this._subjectKey != null;
95+
}
96+
97+
}
98+
}

0 commit comments

Comments
 (0)