Skip to content

Commit 217b110

Browse files
aws-sdk-dotnet-automationaws-sdk-dotnet-automation
committed
This release introduces the new API 'AssumeRoot', which returns short-term credentials that you can use to perform privileged tasks.
1 parent 28efb3d commit 217b110

26 files changed

+1607
-565
lines changed

‎docgenerator/AWSSDKDocSamples/SecurityToken.GeneratedSamples.extra.xml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,25 @@
5757
</example>
5858
</value>
5959
</doc>
60+
<doc>
61+
<members>
62+
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.AssumeRoot(Amazon.SecurityToken.Model.AssumeRootRequest)" />
63+
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.AssumeRoot(Amazon.SecurityToken.Model.AssumeRootRequest)" />
64+
<member name="T:Amazon.SecurityToken.Model.AssumeRootRequest" />
65+
<member name="T:Amazon.SecurityToken.Model.AssumeRootResponse" />
66+
</members>
67+
<value>
68+
<example>
69+
<para>
70+
The following command retrieves a set of short-term credentials you can use to unlock an S3 bucket for a member account by removing the bucket policy.
71+
</para>
72+
<code
73+
title="To launch a privileged session"
74+
source=".\AWSSDKDocSamples\SecurityToken\SecurityToken.GeneratedSamples.cs"
75+
region="to-launch-a-privileged-session-1731335424565" />
76+
</example>
77+
</value>
78+
</doc>
6079
<doc>
6180
<members>
6281
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.DecodeAuthorizationMessage(Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest)" />

‎docgenerator/AWSSDKDocSamples/SecurityToken/SecurityToken.GeneratedSamples.cs

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,24 @@ public void SecurityTokenServiceAssumeRoleWithWebIdentity()
9999
#endregion
100100
}
101101

102+
public void SecurityTokenServiceAssumeRoot()
103+
{
104+
#region to-launch-a-privileged-session-1731335424565
105+
106+
var client = new AmazonSecurityTokenServiceClient();
107+
var response = client.AssumeRoot(new AssumeRootRequest
108+
{
109+
DurationSeconds = 900,
110+
TargetPrincipal = "111122223333",
111+
TaskPolicyArn = new PolicyDescriptorType { Arn = "arn:aws:iam::aws:policy/root-task/S3UnlockBucketPolicy" }
112+
});
113+
114+
Credentials credentials = response.Credentials;
115+
string sourceIdentity = response.SourceIdentity;
116+
117+
#endregion
118+
}
119+
102120
public void SecurityTokenServiceDecodeAuthorizationMessage()
103121
{
104122
#region to-decode-information-about-an-authorization-status-of-a-request-1480533854499

‎generator/ServiceModels/sts/sts-2011-06-15.api.json

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@
55
"endpointPrefix":"sts",
66
"globalEndpoint":"sts.amazonaws.com",
77
"protocol":"query",
8+
"protocols":["query"],
89
"serviceAbbreviation":"AWS STS",
910
"serviceFullName":"AWS Security Token Service",
1011
"serviceId":"STS",
1112
"signatureVersion":"v4",
1213
"uid":"sts-2011-06-15",
13-
"xmlNamespace":"https://sts.amazonaws.com/doc/2011-06-15/"
14+
"xmlNamespace":"https://sts.amazonaws.com/doc/2011-06-15/",
15+
"auth":["aws.auth#sigv4"]
1416
},
1517
"operations":{
1618
"AssumeRole":{
@@ -72,6 +74,22 @@
7274
{"shape":"RegionDisabledException"}
7375
]
7476
},
77+
"AssumeRoot":{
78+
"name":"AssumeRoot",
79+
"http":{
80+
"method":"POST",
81+
"requestUri":"/"
82+
},
83+
"input":{"shape":"AssumeRootRequest"},
84+
"output":{
85+
"shape":"AssumeRootResponse",
86+
"resultWrapper":"AssumeRootResult"
87+
},
88+
"errors":[
89+
{"shape":"RegionDisabledException"},
90+
{"shape":"ExpiredTokenException"}
91+
]
92+
},
7593
"DecodeAuthorizationMessage":{
7694
"name":"DecodeAuthorizationMessage",
7795
"http":{
@@ -234,6 +252,25 @@
234252
"SourceIdentity":{"shape":"sourceIdentityType"}
235253
}
236254
},
255+
"AssumeRootRequest":{
256+
"type":"structure",
257+
"required":[
258+
"TargetPrincipal",
259+
"TaskPolicyArn"
260+
],
261+
"members":{
262+
"TargetPrincipal":{"shape":"TargetPrincipalType"},
263+
"TaskPolicyArn":{"shape":"PolicyDescriptorType"},
264+
"DurationSeconds":{"shape":"RootDurationSecondsType"}
265+
}
266+
},
267+
"AssumeRootResponse":{
268+
"type":"structure",
269+
"members":{
270+
"Credentials":{"shape":"Credentials"},
271+
"SourceIdentity":{"shape":"sourceIdentityType"}
272+
}
273+
},
237274
"AssumedRoleUser":{
238275
"type":"structure",
239276
"required":[
@@ -460,6 +497,11 @@
460497
},
461498
"exception":true
462499
},
500+
"RootDurationSecondsType":{
501+
"type":"integer",
502+
"max":900,
503+
"min":0
504+
},
463505
"SAMLAssertionType":{
464506
"type":"string",
465507
"max":100000,
@@ -479,6 +521,11 @@
479521
"Value":{"shape":"tagValueType"}
480522
}
481523
},
524+
"TargetPrincipalType":{
525+
"type":"string",
526+
"max":2048,
527+
"min":12
528+
},
482529
"accessKeyIdType":{
483530
"type":"string",
484531
"max":128,

‎generator/ServiceModels/sts/sts-2011-06-15.docs.json

Lines changed: 45 additions & 19 deletions
Large diffs are not rendered by default.

‎generator/ServiceModels/sts/sts-2011-06-15.examples.json

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,35 @@
125125
"title": "To assume a role as an OpenID Connect-federated user"
126126
}
127127
],
128+
"AssumeRoot": [
129+
{
130+
"input": {
131+
"DurationSeconds": 900,
132+
"TargetPrincipal": "111122223333",
133+
"TaskPolicyArn": {
134+
"arn": "arn:aws:iam::aws:policy/root-task/S3UnlockBucketPolicy"
135+
}
136+
},
137+
"output": {
138+
"Credentials": {
139+
"AccessKeyId": "ASIAJEXAMPLEXEG2JICEA",
140+
"Expiration": "2024-11-15T00:05:07Z",
141+
"SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
142+
"SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU="
143+
},
144+
"SourceIdentity": "Alice"
145+
},
146+
"comments": {
147+
"input": {
148+
},
149+
"output": {
150+
}
151+
},
152+
"description": "The following command retrieves a set of short-term credentials you can use to unlock an S3 bucket for a member account by removing the bucket policy.",
153+
"id": "to-launch-a-privileged-session-1731335424565",
154+
"title": "To launch a privileged session"
155+
}
156+
],
128157
"DecodeAuthorizationMessage": [
129158
{
130159
"input": {

‎generator/ServiceModels/sts/sts-2011-06-15.normal.json

Lines changed: 83 additions & 20 deletions
Large diffs are not rendered by default.

‎sdk/code-analysis/ServiceAnalysis/SecurityToken/Generated/PropertyValueRules.xml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,22 @@
142142
<min>6</min>
143143
<max>255</max>
144144
</property-value-rule>
145+
<property-value-rule>
146+
<property>Amazon.SecurityToken.Model.AssumeRootRequest.DurationSeconds</property>
147+
<min>0</min>
148+
<max>900</max>
149+
</property-value-rule>
150+
<property-value-rule>
151+
<property>Amazon.SecurityToken.Model.AssumeRootRequest.TargetPrincipal</property>
152+
<min>12</min>
153+
<max>2048</max>
154+
</property-value-rule>
155+
<property-value-rule>
156+
<property>Amazon.SecurityToken.Model.AssumeRootResponse.SourceIdentity</property>
157+
<min>2</min>
158+
<max>64</max>
159+
<pattern>[\w+=,.@-]*</pattern>
160+
</property-value-rule>
145161
<property-value-rule>
146162
<property>Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest.EncodedMessage</property>
147163
<min>1</min>

‎sdk/src/Services/SecurityToken/Generated/Model/AssumeRoleRequest.cs

Lines changed: 38 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ namespace Amazon.SecurityToken.Model
3636
/// secret access key, and a security token. Typically, you use <c>AssumeRole</c> within
3737
/// your account or for cross-account access. For a comparison of <c>AssumeRole</c> with
3838
/// other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
39-
/// Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
40-
/// the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
39+
/// Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_sts-comparison.html">Compare
40+
/// STS credentials</a> in the <i>IAM User Guide</i>.
4141
///
4242
///
4343
/// <para>
@@ -52,17 +52,17 @@ namespace Amazon.SecurityToken.Model
5252
/// </para>
5353
///
5454
/// <para>
55-
/// (Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
56-
/// policies</a> to this operation. You can pass a single JSON policy document to use
57-
/// as an inline session policy. You can also specify up to 10 managed policy Amazon Resource
58-
/// Names (ARNs) to use as managed session policies. The plaintext that you use for both
59-
/// inline and managed session policies can't exceed 2,048 characters. Passing policies
60-
/// to this operation returns new temporary credentials. The resulting session's permissions
61-
/// are the intersection of the role's identity-based policy and the session policies.
62-
/// You can use the role's temporary credentials in subsequent Amazon Web Services API
63-
/// calls to access resources in the account that owns the role. You cannot use session
64-
/// policies to grant more permissions than those allowed by the identity-based policy
65-
/// of the role that is being assumed. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
55+
/// (Optional) You can pass inline or managed session policies to this operation. You
56+
/// can pass a single JSON policy document to use as an inline session policy. You can
57+
/// also specify up to 10 managed policy Amazon Resource Names (ARNs) to use as managed
58+
/// session policies. The plaintext that you use for both inline and managed session policies
59+
/// can't exceed 2,048 characters. Passing policies to this operation returns new temporary
60+
/// credentials. The resulting session's permissions are the intersection of the role's
61+
/// identity-based policy and the session policies. You can use the role's temporary credentials
62+
/// in subsequent Amazon Web Services API calls to access resources in the account that
63+
/// owns the role. You cannot use session policies to grant more permissions than those
64+
/// allowed by the identity-based policy of the role that is being assumed. For more information,
65+
/// see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
6666
/// Policies</a> in the <i>IAM User Guide</i>.
6767
/// </para>
6868
///
@@ -196,8 +196,8 @@ public partial class AssumeRoleRequest : AmazonSecurityTokenServiceRequest
196196
/// on the maximum session duration setting for your role. However, if you assume a role
197197
/// using role chaining and provide a <c>DurationSeconds</c> parameter value greater than
198198
/// one hour, the operation fails. To learn how to view the maximum value for your role,
199-
/// see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
200-
/// the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
199+
/// see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_update-role-settings.html#id_roles_update-session-duration">Update
200+
/// the maximum session duration for a role</a>.
201201
/// </para>
202202
///
203203
/// <para>
@@ -293,7 +293,11 @@ internal bool IsSetExternalId()
293293
/// The <c>PackedPolicySize</c> response element indicates by percentage how close the
294294
/// policies and tags for your request are to the upper size limit.
295295
/// </para>
296-
/// </note>
296+
/// </note>
297+
/// <para>
298+
/// For more information about role session permissions, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
299+
/// policies</a>.
300+
/// </para>
297301
/// </summary>
298302
[AWSProperty(Min=1)]
299303
public string Policy
@@ -419,6 +423,14 @@ internal bool IsSetRoleArn()
419423
/// </para>
420424
///
421425
/// <para>
426+
/// For security purposes, administrators can view this field in <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html#cloudtrail-integration_signin-tempcreds">CloudTrail
427+
/// logs</a> to help identify who performed an action in Amazon Web Services. Your administrator
428+
/// might require that you specify your user name as the session name when you assume
429+
/// the role. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_rolesessionname">
430+
/// <c>sts:RoleSessionName</c> </a>.
431+
/// </para>
432+
///
433+
/// <para>
422434
/// The regex used to validate this parameter is a string of characters consisting of
423435
/// upper- and lower-case alphanumeric characters with no spaces. You can also include
424436
/// underscores or any of the following characters: =,.@-
@@ -470,16 +482,18 @@ internal bool IsSetSerialNumber()
470482
/// Gets and sets the property SourceIdentity.
471483
/// <para>
472484
/// The source identity specified by the principal that is calling the <c>AssumeRole</c>
473-
/// operation.
485+
/// operation. The source identity value persists across <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html#iam-term-role-chaining">chained
486+
/// role</a> sessions.
474487
/// </para>
475488
///
476489
/// <para>
477490
/// You can require users to specify a source identity when they assume a role. You do
478-
/// this by using the <c>sts:SourceIdentity</c> condition key in a role trust policy.
479-
/// You can use source identity information in CloudTrail logs to determine who took actions
480-
/// with a role. You can use the <c>aws:SourceIdentity</c> condition key to further control
481-
/// access to Amazon Web Services resources based on the value of source identity. For
482-
/// more information about using source identity, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html">Monitor
491+
/// this by using the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceidentity">
492+
/// <c>sts:SourceIdentity</c> </a> condition key in a role trust policy. You can use source
493+
/// identity information in CloudTrail logs to determine who took actions with a role.
494+
/// You can use the <c>aws:SourceIdentity</c> condition key to further control access
495+
/// to Amazon Web Services resources based on the value of source identity. For more information
496+
/// about using source identity, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html">Monitor
483497
/// and control actions taken with assumed roles</a> in the <i>IAM User Guide</i>.
484498
/// </para>
485499
///
@@ -599,8 +613,8 @@ internal bool IsSetTokenCode()
599613
/// </para>
600614
///
601615
/// <para>
602-
/// This parameter is optional. When you set session tags as transitive, the session policy
603-
/// and session tags packed binary limit is not affected.
616+
/// This parameter is optional. The transitive status of a session tag does not impact
617+
/// its packed binary size.
604618
/// </para>
605619
///
606620
/// <para>

‎sdk/src/Services/SecurityToken/Generated/Model/AssumeRoleWithSAMLRequest.cs

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ namespace Amazon.SecurityToken.Model
3636
/// an enterprise identity store or directory to role-based Amazon Web Services access
3737
/// without user-specific credentials or configuration. For a comparison of <c>AssumeRoleWithSAML</c>
3838
/// with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
39-
/// Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
40-
/// the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
39+
/// Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_sts-comparison.html">Compare
40+
/// STS credentials</a> in the <i>IAM User Guide</i>.
4141
///
4242
///
4343
/// <para>
@@ -275,6 +275,11 @@ internal bool IsSetDurationSeconds()
275275
/// character to the end of the valid character list (\u0020 through \u00FF). It can also
276276
/// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D) characters.
277277
/// </para>
278+
///
279+
/// <para>
280+
/// For more information about role session permissions, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
281+
/// policies</a>.
282+
/// </para>
278283
/// <note>
279284
/// <para>
280285
/// An Amazon Web Services conversion compresses the passed inline session policy, managed

‎sdk/src/Services/SecurityToken/Generated/Model/AssumeRoleWithSAMLResponse.cs

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,15 +194,17 @@ internal bool IsSetPackedPolicySize()
194194
/// <summary>
195195
/// Gets and sets the property SourceIdentity.
196196
/// <para>
197-
/// The value in the <c>SourceIdentity</c> attribute in the SAML assertion.
197+
/// The value in the <c>SourceIdentity</c> attribute in the SAML assertion. The source
198+
/// identity value persists across <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html#iam-term-role-chaining">chained
199+
/// role</a> sessions.
198200
/// </para>
199201
///
200202
/// <para>
201203
/// You can require users to set a source identity value when they assume a role. You
202204
/// do this by using the <c>sts:SourceIdentity</c> condition key in a role trust policy.
203205
/// That way, actions that are taken with the role are associated with that user. After
204206
/// the source identity is set, the value cannot be changed. It is present in the request
205-
/// for all actions that are taken by the role and persists across <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining">chained
207+
/// for all actions that are taken by the role and persists across <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html#id_roles_terms-and-concepts">chained
206208
/// role</a> sessions. You can configure your SAML identity provider to use an attribute
207209
/// associated with your users, like user name or email, as the source identity when calling
208210
/// <c>AssumeRoleWithSAML</c>. You do this by adding an attribute to the SAML assertion.

0 commit comments

Comments
 (0)