Skip to content

Commit 58b9244

Browse files
aws-sdk-dotnet-automationaws-sdk-dotnet-automation
committed
The AWS Security Token Service APIs AssumeRoleWithSAML and AssumeRoleWithWebIdentity can now be invoked without pre-configured AWS credentials in the SDK configuration.
1 parent a60eb0f commit 58b9244

File tree

7 files changed

+82
-108
lines changed

7 files changed

+82
-108
lines changed

‎generator/ServiceModels/sts/sts-2011-06-15.api.json

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,9 @@
5151
{"shape":"InvalidIdentityTokenException"},
5252
{"shape":"ExpiredTokenException"},
5353
{"shape":"RegionDisabledException"}
54-
]
54+
],
55+
"authtype":"none",
56+
"auth":["smithy.api#noAuth"]
5557
},
5658
"AssumeRoleWithWebIdentity":{
5759
"name":"AssumeRoleWithWebIdentity",
@@ -72,7 +74,9 @@
7274
{"shape":"InvalidIdentityTokenException"},
7375
{"shape":"ExpiredTokenException"},
7476
{"shape":"RegionDisabledException"}
75-
]
77+
],
78+
"authtype":"none",
79+
"auth":["smithy.api#noAuth"]
7680
},
7781
"AssumeRoot":{
7882
"name":"AssumeRoot",
@@ -349,8 +353,7 @@
349353
},
350354
"GetCallerIdentityRequest":{
351355
"type":"structure",
352-
"members":{
353-
}
356+
"members":{}
354357
},
355358
"GetCallerIdentityResponse":{
356359
"type":"structure",

‎generator/ServiceModels/sts/sts-2011-06-15.docs.json

Lines changed: 26 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -15,43 +15,35 @@
1515
"shapes": {
1616
"AssumeRoleRequest": {
1717
"base": null,
18-
"refs": {
19-
}
18+
"refs": {}
2019
},
2120
"AssumeRoleResponse": {
2221
"base": "<p>Contains the response to a successful <a>AssumeRole</a> request, including temporary Amazon Web Services credentials that can be used to make Amazon Web Services requests. </p>",
23-
"refs": {
24-
}
22+
"refs": {}
2523
},
2624
"AssumeRoleWithSAMLRequest": {
2725
"base": null,
28-
"refs": {
29-
}
26+
"refs": {}
3027
},
3128
"AssumeRoleWithSAMLResponse": {
3229
"base": "<p>Contains the response to a successful <a>AssumeRoleWithSAML</a> request, including temporary Amazon Web Services credentials that can be used to make Amazon Web Services requests. </p>",
33-
"refs": {
34-
}
30+
"refs": {}
3531
},
3632
"AssumeRoleWithWebIdentityRequest": {
3733
"base": null,
38-
"refs": {
39-
}
34+
"refs": {}
4035
},
4136
"AssumeRoleWithWebIdentityResponse": {
4237
"base": "<p>Contains the response to a successful <a>AssumeRoleWithWebIdentity</a> request, including temporary Amazon Web Services credentials that can be used to make Amazon Web Services requests. </p>",
43-
"refs": {
44-
}
38+
"refs": {}
4539
},
4640
"AssumeRootRequest": {
4741
"base": null,
48-
"refs": {
49-
}
42+
"refs": {}
5043
},
5144
"AssumeRootResponse": {
5245
"base": null,
53-
"refs": {
54-
}
46+
"refs": {}
5547
},
5648
"AssumedRoleUser": {
5749
"base": "<p>The identifiers for the temporary security credentials that the operation returns.</p>",
@@ -81,18 +73,15 @@
8173
},
8274
"DecodeAuthorizationMessageRequest": {
8375
"base": null,
84-
"refs": {
85-
}
76+
"refs": {}
8677
},
8778
"DecodeAuthorizationMessageResponse": {
8879
"base": "<p>A document that contains additional information about the authorization status of a request from an encoded message that is returned in response to an Amazon Web Services request.</p>",
89-
"refs": {
90-
}
80+
"refs": {}
9181
},
9282
"ExpiredTokenException": {
9383
"base": "<p>The web identity token that was passed is expired or is not valid. Get a new identity token from the identity provider and then retry the request.</p>",
94-
"refs": {
95-
}
84+
"refs": {}
9685
},
9786
"FederatedUser": {
9887
"base": "<p>Identifiers for the federated user that is associated with the credentials.</p>",
@@ -102,63 +91,51 @@
10291
},
10392
"GetAccessKeyInfoRequest": {
10493
"base": null,
105-
"refs": {
106-
}
94+
"refs": {}
10795
},
10896
"GetAccessKeyInfoResponse": {
10997
"base": null,
110-
"refs": {
111-
}
98+
"refs": {}
11299
},
113100
"GetCallerIdentityRequest": {
114101
"base": null,
115-
"refs": {
116-
}
102+
"refs": {}
117103
},
118104
"GetCallerIdentityResponse": {
119105
"base": "<p>Contains the response to a successful <a>GetCallerIdentity</a> request, including information about the entity making the request.</p>",
120-
"refs": {
121-
}
106+
"refs": {}
122107
},
123108
"GetFederationTokenRequest": {
124109
"base": null,
125-
"refs": {
126-
}
110+
"refs": {}
127111
},
128112
"GetFederationTokenResponse": {
129113
"base": "<p>Contains the response to a successful <a>GetFederationToken</a> request, including temporary Amazon Web Services credentials that can be used to make Amazon Web Services requests. </p>",
130-
"refs": {
131-
}
114+
"refs": {}
132115
},
133116
"GetSessionTokenRequest": {
134117
"base": null,
135-
"refs": {
136-
}
118+
"refs": {}
137119
},
138120
"GetSessionTokenResponse": {
139121
"base": "<p>Contains the response to a successful <a>GetSessionToken</a> request, including temporary Amazon Web Services credentials that can be used to make Amazon Web Services requests. </p>",
140-
"refs": {
141-
}
122+
"refs": {}
142123
},
143124
"IDPCommunicationErrorException": {
144125
"base": "<p>The request could not be fulfilled because the identity provider (IDP) that was asked to verify the incoming identity token could not be reached. This is often a transient error caused by network conditions. Retry the request a limited number of times so that you don't exceed the request rate. If the error persists, the identity provider might be down or not responding.</p>",
145-
"refs": {
146-
}
126+
"refs": {}
147127
},
148128
"IDPRejectedClaimException": {
149129
"base": "<p>The identity provider (IdP) reported that authentication failed. This might be because the claim is invalid.</p> <p>If this error is returned for the <code>AssumeRoleWithWebIdentity</code> operation, it can also mean that the claim has expired or has been explicitly revoked. </p>",
150-
"refs": {
151-
}
130+
"refs": {}
152131
},
153132
"InvalidAuthorizationMessageException": {
154133
"base": "<p>The error returned if the message passed to <code>DecodeAuthorizationMessage</code> was invalid. This can happen if the token contains invalid characters, such as line breaks, or if the message has expired.</p>",
155-
"refs": {
156-
}
134+
"refs": {}
157135
},
158136
"InvalidIdentityTokenException": {
159137
"base": "<p>The web identity token that was passed could not be validated by Amazon Web Services. Get a new identity token from the identity provider and then retry the request.</p>",
160-
"refs": {
161-
}
138+
"refs": {}
162139
},
163140
"Issuer": {
164141
"base": null,
@@ -169,8 +146,7 @@
169146
},
170147
"MalformedPolicyDocumentException": {
171148
"base": "<p>The request was rejected because the policy document was malformed. The error message describes the specific error.</p>",
172-
"refs": {
173-
}
149+
"refs": {}
174150
},
175151
"NameQualifier": {
176152
"base": null,
@@ -180,8 +156,7 @@
180156
},
181157
"PackedPolicyTooLargeException": {
182158
"base": "<p>The request was rejected because the total packed size of the session policies and session tags combined was too large. An Amazon Web Services conversion compresses the session policy document, session policy ARNs, and session tags into a packed binary format that has a separate limit. The error message indicates by percentage how close the policies and tags are to the upper size limit. For more information, see <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html\">Passing Session Tags in STS</a> in the <i>IAM User Guide</i>.</p> <p>You could receive this error even though you meet other defined session policy and session tag limits. For more information, see <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length\">IAM and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.</p>",
183-
"refs": {
184-
}
159+
"refs": {}
185160
},
186161
"PolicyDescriptorType": {
187162
"base": "<p>A reference to the IAM managed policy that is passed as a session policy for a role session or a federated user session.</p>",
@@ -204,8 +179,7 @@
204179
},
205180
"RegionDisabledException": {
206181
"base": "<p>STS is not activated in the requested region for the account that is being asked to generate credentials. The account administrator must use the IAM console to activate STS in that region. For more information, see <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html\">Activating and Deactivating STS in an Amazon Web Services Region</a> in the <i>IAM User Guide</i>.</p>",
207-
"refs": {
208-
}
182+
"refs": {}
209183
},
210184
"RootDurationSecondsType": {
211185
"base": null,

‎generator/ServiceModels/sts/sts-2011-06-15.examples.json

Lines changed: 23 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,8 @@
4141
"PackedPolicySize": 8
4242
},
4343
"comments": {
44-
"input": {
45-
},
46-
"output": {
47-
}
44+
"input": {},
45+
"output": {}
4846
},
4947
"description": "",
5048
"id": "to-assume-a-role-1480532402212",
@@ -78,10 +76,8 @@
7876
"SubjectType": "transient"
7977
},
8078
"comments": {
81-
"input": {
82-
},
83-
"output": {
84-
}
79+
"input": {},
80+
"output": {}
8581
},
8682
"description": "",
8783
"id": "to-assume-role-with-saml-14882749597814",
@@ -115,10 +111,8 @@
115111
"SubjectFromWebIdentityToken": "amzn1.account.AF6RHO7KZU5XRVQJGXK6HEXAMPLE"
116112
},
117113
"comments": {
118-
"input": {
119-
},
120-
"output": {
121-
}
114+
"input": {},
115+
"output": {}
122116
},
123117
"description": "",
124118
"id": "to-assume-a-role-as-an-openid-connect-federated-user-1480533445696",
@@ -144,10 +138,8 @@
144138
"SourceIdentity": "Alice"
145139
},
146140
"comments": {
147-
"input": {
148-
},
149-
"output": {
150-
}
141+
"input": {},
142+
"output": {}
151143
},
152144
"description": "The following command retrieves a set of short-term credentials you can use to unlock an S3 bucket for a member account by removing the bucket policy.",
153145
"id": "to-launch-a-privileged-session-1731335424565",
@@ -163,10 +155,8 @@
163155
"DecodedMessage": "{\"allowed\": \"false\",\"explicitDeny\": \"false\",\"matchedStatements\": \"\",\"failures\": \"\",\"context\": {\"principal\": {\"id\": \"AIDACKCEVSQ6C2EXAMPLE\",\"name\": \"Bob\",\"arn\": \"arn:aws:iam::123456789012:user/Bob\"},\"action\": \"ec2:StopInstances\",\"resource\": \"arn:aws:ec2:us-east-1:123456789012:instance/i-dd01c9bd\",\"conditions\": [{\"item\": {\"key\": \"ec2:Tenancy\",\"values\": [\"default\"]},{\"item\": {\"key\": \"ec2:ResourceTag/elasticbeanstalk:environment-name\",\"values\": [\"Default-Environment\"]}},(Additional items ...)]}}"
164156
},
165157
"comments": {
166-
"input": {
167-
},
168-
"output": {
169-
}
158+
"input": {},
159+
"output": {}
170160
},
171161
"description": "",
172162
"id": "to-decode-information-about-an-authorization-status-of-a-request-1480533854499",
@@ -175,54 +165,45 @@
175165
],
176166
"GetCallerIdentity": [
177167
{
178-
"input": {
179-
},
168+
"input": {},
180169
"output": {
181170
"Account": "123456789012",
182171
"Arn": "arn:aws:iam::123456789012:user/Alice",
183172
"UserId": "AKIAI44QH8DHBEXAMPLE"
184173
},
185174
"comments": {
186-
"input": {
187-
},
188-
"output": {
189-
}
175+
"input": {},
176+
"output": {}
190177
},
191178
"description": "This example shows a request and response made with the credentials for a user named Alice in the AWS account 123456789012.",
192179
"id": "to-get-details-about-a-calling-iam-user-1480540050376",
193180
"title": "To get details about a calling IAM user"
194181
},
195182
{
196-
"input": {
197-
},
183+
"input": {},
198184
"output": {
199185
"Account": "123456789012",
200186
"Arn": "arn:aws:sts::123456789012:assumed-role/my-role-name/my-role-session-name",
201187
"UserId": "AKIAI44QH8DHBEXAMPLE:my-role-session-name"
202188
},
203189
"comments": {
204-
"input": {
205-
},
206-
"output": {
207-
}
190+
"input": {},
191+
"output": {}
208192
},
209193
"description": "This example shows a request and response made with temporary credentials created by AssumeRole. The name of the assumed role is my-role-name, and the RoleSessionName is set to my-role-session-name.",
210194
"id": "to-get-details-about-a-calling-user-federated-with-assumerole-1480540158545",
211195
"title": "To get details about a calling user federated with AssumeRole"
212196
},
213197
{
214-
"input": {
215-
},
198+
"input": {},
216199
"output": {
217200
"Account": "123456789012",
218201
"Arn": "arn:aws:sts::123456789012:federated-user/my-federated-user-name",
219202
"UserId": "123456789012:my-federated-user-name"
220203
},
221204
"comments": {
222-
"input": {
223-
},
224-
"output": {
225-
}
205+
"input": {},
206+
"output": {}
226207
},
227208
"description": "This example shows a request and response made with temporary credentials created by using GetFederationToken. The Name parameter is set to my-federated-user-name.",
228209
"id": "to-get-details-about-a-calling-user-federated-with-getfederationtoken-1480540231316",
@@ -260,10 +241,8 @@
260241
"PackedPolicySize": 8
261242
},
262243
"comments": {
263-
"input": {
264-
},
265-
"output": {
266-
}
244+
"input": {},
245+
"output": {}
267246
},
268247
"description": "",
269248
"id": "to-get-temporary-credentials-for-a-role-by-using-getfederationtoken-1480540749900",
@@ -286,10 +265,8 @@
286265
}
287266
},
288267
"comments": {
289-
"input": {
290-
},
291-
"output": {
292-
}
268+
"input": {},
269+
"output": {}
293270
},
294271
"description": "",
295272
"id": "to-get-temporary-credentials-for-an-iam-user-or-an-aws-account-1480540814038",

0 commit comments

Comments
 (0)