@@ -82,41 +82,43 @@ class GoogleIdentityStsV1betaExchangeTokenRequest
8282 # ` ``` Example payload: ``` ` "iss": "https://accounts.google.com", "iat":
8383 # 1517963104, "exp": 1517966704, "aud": "113475438248934895348", "sub": "
8484 # 113475438248934895348", "my_claims": ` "additional_claim": "value" ` ` ``` If `
85- # subject_token` is an AWS token, it must be a serialized, [signed](https://docs.
86- # aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) request to the
87- # AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/
88- # APIReference/API_GetCallerIdentity) method. Format the request as URL-encoded
89- # JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-
90- # type:aws4_request`. The following parameters are required: - `url`: The URL of
91- # the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.
92- # com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also
85+ # subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token.
86+ # This token contains the same information as a request to the AWS [`
87+ # GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/
88+ # API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.
89+ # amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request
90+ # information. Use Signature Version 4. Format the request as URL-encoded JSON,
91+ # and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:
92+ # aws4_request`. The following parameters are required: - `url`: The URL of the
93+ # AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?
94+ # Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also
9395 # supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP
9496 # request headers, which must include: - `Authorization`: The request signature.
9597 # - `x-amz-date`: The time you will send the request, formatted as an [ISO8601
9698 # Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#
97- # sigv4_elements_date) string. This is typically set to the current time and
98- # used to prevent replay attacks. - `host`: The hostname of the `url` field; for
99- # example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full,
100- # canonical resource name of the workload identity pool provider, with or
101- # without an `https:` prefix. To help ensure data integrity, we recommend
99+ # sigv4_elements_date) string. This value is typically set to the current time
100+ # and is used to help prevent replay attacks. - `host`: The hostname of the `url`
101+ # field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`:
102+ # The full, canonical resource name of the workload identity pool provider, with
103+ # or without an `https:` prefix. To help ensure data integrity, we recommend
102104 # including this header in the `SignedHeaders` field of the signed request. For
103105 # example: //iam.googleapis.com/projects//locations//workloadIdentityPools//
104106 # providers/ https://iam.googleapis.com/projects//locations//
105107 # workloadIdentityPools//providers/ If you are using temporary security
106108 # credentials provided by AWS, you must also include the header `x-amz-security-
107- # token`, with the value `` . The following example shows a signed, serialized
108- # request : ``` ` "headers":[ `"key": "x-amz-date", "value": "20200815T015049Z"`,
109- # ` "key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential, +
110- # SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$
111- # signature"`, `"key": "x-goog-cloud-target-resource", "value": "//iam.
112- # googleapis.com/projects//locations//workloadIdentityPools//providers/"`, `"key"
113- # : "host", "value": "sts.amazonaws.com"` . ], "method":"POST", "url":"https://
114- # sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" ` ``` You can
115- # also use a Google-issued OAuth 2.0 access token with this field to obtain an
116- # access token with new security attributes applied, such as a Credential Access
117- # Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth :
118- # token-type:access_token`. If an access token already contains security
119- # attributes, you cannot apply additional security attributes.
109+ # token`, with the value set to the session token . The following example shows a
110+ # `GetCallerIdentity` token : ``` ` "headers": [ `"key": "x-amz-date", "value": "
111+ # 20200815T015049Z"`, ` "key": "Authorization", "value": "AWS4-HMAC-SHA256+
112+ # Credential=$credential,+ SignedHeaders=host;x-amz-date;x-goog-cloud-target-
113+ # resource,+Signature=$ signature"`, `"key": "x-goog-cloud-target-resource", "
114+ # value": "//iam. googleapis.com/projects//locations//workloadIdentityPools//
115+ # providers/"`, `"key" : "host", "value": "sts.amazonaws.com"` . ], "method": "
116+ # POST", "url": "https:// sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-
117+ # 06-15" ` ``` You can also use a Google-issued OAuth 2.0 access token with this
118+ # field to obtain an access token with new security attributes applied, such as
119+ # a Credential Access Boundary. In this case, set `subject_token_type` to `urn:
120+ # ietf:params:oauth: token-type:access_token`. If an access token already
121+ # contains security attributes, you cannot apply additional security attributes.
120122 # Corresponds to the JSON property `subjectToken`
121123 # @return [String]
122124 attr_accessor :subject_token
0 commit comments