1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package sts 4 5 import ( 6 "context" 7 "fmt" 8 awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware" 9 "github.com/aws/aws-sdk-go-v2/service/sts/types" 10 "github.com/aws/smithy-go/middleware" 11 smithyhttp "github.com/aws/smithy-go/transport/http" 12 ) 13 14 // Returns a set of temporary security credentials for users who have been 15 // authenticated in a mobile or web application with a web identity provider. 16 // Example providers include the OAuth 2.0 providers Login with Amazon and 17 // Facebook, or any OpenID Connect-compatible identity provider such as Google or 18 // Amazon Cognito federated identities (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html) 19 // . For mobile applications, we recommend that you use Amazon Cognito. You can use 20 // Amazon Cognito with the Amazon Web Services SDK for iOS Developer Guide (http://aws.amazon.com/sdkforios/) 21 // and the Amazon Web Services SDK for Android Developer Guide (http://aws.amazon.com/sdkforandroid/) 22 // to uniquely identify a user. You can also supply the user with a consistent 23 // identity throughout the lifetime of an application. To learn more about Amazon 24 // Cognito, see Amazon Cognito identity pools (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html) 25 // in Amazon Cognito Developer Guide. Calling AssumeRoleWithWebIdentity does not 26 // require the use of Amazon Web Services security credentials. Therefore, you can 27 // distribute an application (for example, on mobile devices) that requests 28 // temporary security credentials without including long-term Amazon Web Services 29 // credentials in the application. You also don't need to deploy server-based proxy 30 // services that use long-term Amazon Web Services credentials. Instead, the 31 // identity of the caller is validated by using a token from the web identity 32 // provider. For a comparison of AssumeRoleWithWebIdentity with the other API 33 // operations that produce temporary credentials, see Requesting Temporary 34 // Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) 35 // and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison) 36 // in the IAM User Guide. The temporary security credentials returned by this API 37 // consist of an access key ID, a secret access key, and a security token. 38 // Applications can use these temporary security credentials to sign calls to 39 // Amazon Web Services service API operations. Session Duration By default, the 40 // temporary security credentials created by AssumeRoleWithWebIdentity last for 41 // one hour. However, you can use the optional DurationSeconds parameter to 42 // specify the duration of your session. You can provide a value from 900 seconds 43 // (15 minutes) up to the maximum session duration setting for the role. This 44 // setting can have a value from 1 hour to 12 hours. To learn how to view the 45 // maximum value for your role, see View the Maximum Session Duration Setting for 46 // a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) 47 // in the IAM User Guide. The maximum session duration limit applies when you use 48 // the AssumeRole* API operations or the assume-role* CLI commands. However the 49 // limit does not apply when you use those operations to create a console URL. For 50 // more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html) 51 // in the IAM User Guide. Permissions The temporary security credentials created by 52 // AssumeRoleWithWebIdentity can be used to make API calls to any Amazon Web 53 // Services service with the following exception: you cannot call the STS 54 // GetFederationToken or GetSessionToken API operations. (Optional) You can pass 55 // inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) 56 // to this operation. You can pass a single JSON policy document to use as an 57 // inline session policy. You can also specify up to 10 managed policy Amazon 58 // Resource Names (ARNs) to use as managed session policies. The plaintext that you 59 // use for both inline and managed session policies can't exceed 2,048 characters. 60 // Passing policies to this operation returns new temporary credentials. The 61 // resulting session's permissions are the intersection of the role's 62 // identity-based policy and the session policies. You can use the role's temporary 63 // credentials in subsequent Amazon Web Services API calls to access resources in 64 // the account that owns the role. You cannot use session policies to grant more 65 // permissions than those allowed by the identity-based policy of the role that is 66 // being assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) 67 // in the IAM User Guide. Tags (Optional) You can configure your IdP to pass 68 // attributes into your web identity token as session tags. Each session tag 69 // consists of a key name and an associated value. For more information about 70 // session tags, see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html) 71 // in the IAM User Guide. You can pass up to 50 session tags. The plaintext session 72 // tag keys can’t exceed 128 characters and the values can’t exceed 256 characters. 73 // For these and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length) 74 // in the IAM User Guide. An Amazon Web Services conversion compresses the passed 75 // inline session policy, managed policy ARNs, and session tags into a packed 76 // binary format that has a separate limit. Your request can fail for this limit 77 // even if your plaintext meets the other requirements. The PackedPolicySize 78 // response element indicates by percentage how close the policies and tags for 79 // your request are to the upper size limit. You can pass a session tag with the 80 // same key as a tag that is attached to the role. When you do, the session tag 81 // overrides the role tag with the same key. An administrator must grant you the 82 // permissions necessary to pass session tags. The administrator can also create 83 // granular permissions to allow you to pass only specific session tags. For more 84 // information, see Tutorial: Using Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html) 85 // in the IAM User Guide. You can set the session tags as transitive. Transitive 86 // tags persist during role chaining. For more information, see Chaining Roles 87 // with Session Tags (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining) 88 // in the IAM User Guide. Identities Before your application can call 89 // AssumeRoleWithWebIdentity , you must have an identity token from a supported 90 // identity provider and create a role that the application can assume. The role 91 // that your application assumes must trust the identity provider that is 92 // associated with the identity token. In other words, the identity provider must 93 // be specified in the role's trust policy. Calling AssumeRoleWithWebIdentity can 94 // result in an entry in your CloudTrail logs. The entry includes the Subject (http://openid.net/specs/openid-connect-core-1_0.html#Claims) 95 // of the provided web identity token. We recommend that you avoid using any 96 // personally identifiable information (PII) in this field. For example, you could 97 // instead use a GUID or a pairwise identifier, as suggested in the OIDC 98 // specification (http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes) 99 // . For more information about how to use web identity federation and the 100 // AssumeRoleWithWebIdentity API, see the following resources: 101 // - Using Web Identity Federation API Operations for Mobile Apps (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html) 102 // and Federation Through a Web-based Identity Provider (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity) 103 // . 104 // - Web Identity Federation Playground (https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/) 105 // . Walk through the process of authenticating through Login with Amazon, 106 // Facebook, or Google, getting temporary security credentials, and then using 107 // those credentials to make a request to Amazon Web Services. 108 // - Amazon Web Services SDK for iOS Developer Guide (http://aws.amazon.com/sdkforios/) 109 // and Amazon Web Services SDK for Android Developer Guide (http://aws.amazon.com/sdkforandroid/) 110 // . These toolkits contain sample apps that show how to invoke the identity 111 // providers. The toolkits then show how to use the information from these 112 // providers to get and use temporary security credentials. 113 // - Web Identity Federation with Mobile Applications (http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications) 114 // . This article discusses web identity federation and shows an example of how to 115 // use web identity federation to get access to content in Amazon S3. 116 func (c *Client) AssumeRoleWithWebIdentity(ctx context.Context, params *AssumeRoleWithWebIdentityInput, optFns ...func(*Options)) (*AssumeRoleWithWebIdentityOutput, error) { 117 if params == nil { 118 params = &AssumeRoleWithWebIdentityInput{} 119 } 120 121 result, metadata, err := c.invokeOperation(ctx, "AssumeRoleWithWebIdentity", params, optFns, c.addOperationAssumeRoleWithWebIdentityMiddlewares) 122 if err != nil { 123 return nil, err 124 } 125 126 out := result.(*AssumeRoleWithWebIdentityOutput) 127 out.ResultMetadata = metadata 128 return out, nil 129 } 130 131 type AssumeRoleWithWebIdentityInput struct { 132 133 // The Amazon Resource Name (ARN) of the role that the caller is assuming. 134 // 135 // This member is required. 136 RoleArn *string 137 138 // An identifier for the assumed role session. Typically, you pass the name or 139 // identifier that is associated with the user who is using your application. That 140 // way, the temporary security credentials that your application will use are 141 // associated with that user. This session name is included as part of the ARN and 142 // assumed role ID in the AssumedRoleUser response element. The regex used to 143 // validate this parameter is a string of characters consisting of upper- and 144 // lower-case alphanumeric characters with no spaces. You can also include 145 // underscores or any of the following characters: =,.@- 146 // 147 // This member is required. 148 RoleSessionName *string 149 150 // The OAuth 2.0 access token or OpenID Connect ID token that is provided by the 151 // identity provider. Your application must get this token by authenticating the 152 // user who is using your application with a web identity provider before the 153 // application makes an AssumeRoleWithWebIdentity call. Only tokens with RSA 154 // algorithms (RS256) are supported. 155 // 156 // This member is required. 157 WebIdentityToken *string 158 159 // The duration, in seconds, of the role session. The value can range from 900 160 // seconds (15 minutes) up to the maximum session duration setting for the role. 161 // This setting can have a value from 1 hour to 12 hours. If you specify a value 162 // higher than this setting, the operation fails. For example, if you specify a 163 // session duration of 12 hours, but your administrator set the maximum session 164 // duration to 6 hours, your operation fails. To learn how to view the maximum 165 // value for your role, see View the Maximum Session Duration Setting for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session) 166 // in the IAM User Guide. By default, the value is set to 3600 seconds. The 167 // DurationSeconds parameter is separate from the duration of a console session 168 // that you might request using the returned credentials. The request to the 169 // federation endpoint for a console sign-in token takes a SessionDuration 170 // parameter that specifies the maximum length of the console session. For more 171 // information, see Creating a URL that Enables Federated Users to Access the 172 // Amazon Web Services Management Console (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html) 173 // in the IAM User Guide. 174 DurationSeconds *int32 175 176 // An IAM policy in JSON format that you want to use as an inline session policy. 177 // This parameter is optional. Passing policies to this operation returns new 178 // temporary credentials. The resulting session's permissions are the intersection 179 // of the role's identity-based policy and the session policies. You can use the 180 // role's temporary credentials in subsequent Amazon Web Services API calls to 181 // access resources in the account that owns the role. You cannot use session 182 // policies to grant more permissions than those allowed by the identity-based 183 // policy of the role that is being assumed. For more information, see Session 184 // Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) 185 // in the IAM User Guide. The plaintext that you use for both inline and managed 186 // session policies can't exceed 2,048 characters. The JSON policy characters can 187 // be any ASCII character from the space character to the end of the valid 188 // character list (\u0020 through \u00FF). It can also include the tab (\u0009), 189 // linefeed (\u000A), and carriage return (\u000D) characters. An Amazon Web 190 // Services conversion compresses the passed inline session policy, managed policy 191 // ARNs, and session tags into a packed binary format that has a separate limit. 192 // Your request can fail for this limit even if your plaintext meets the other 193 // requirements. The PackedPolicySize response element indicates by percentage how 194 // close the policies and tags for your request are to the upper size limit. 195 Policy *string 196 197 // The Amazon Resource Names (ARNs) of the IAM managed policies that you want to 198 // use as managed session policies. The policies must exist in the same account as 199 // the role. This parameter is optional. You can provide up to 10 managed policy 200 // ARNs. However, the plaintext that you use for both inline and managed session 201 // policies can't exceed 2,048 characters. For more information about ARNs, see 202 // Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) 203 // in the Amazon Web Services General Reference. An Amazon Web Services conversion 204 // compresses the passed inline session policy, managed policy ARNs, and session 205 // tags into a packed binary format that has a separate limit. Your request can 206 // fail for this limit even if your plaintext meets the other requirements. The 207 // PackedPolicySize response element indicates by percentage how close the policies 208 // and tags for your request are to the upper size limit. Passing policies to this 209 // operation returns new temporary credentials. The resulting session's permissions 210 // are the intersection of the role's identity-based policy and the session 211 // policies. You can use the role's temporary credentials in subsequent Amazon Web 212 // Services API calls to access resources in the account that owns the role. You 213 // cannot use session policies to grant more permissions than those allowed by the 214 // identity-based policy of the role that is being assumed. For more information, 215 // see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) 216 // in the IAM User Guide. 217 PolicyArns []types.PolicyDescriptorType 218 219 // The fully qualified host component of the domain name of the OAuth 2.0 identity 220 // provider. Do not specify this value for an OpenID Connect identity provider. 221 // Currently www.amazon.com and graph.facebook.com are the only supported identity 222 // providers for OAuth 2.0 access tokens. Do not include URL schemes and port 223 // numbers. Do not specify this value for OpenID Connect ID tokens. 224 ProviderId *string 225 226 noSmithyDocumentSerde 227 } 228 229 // Contains the response to a successful AssumeRoleWithWebIdentity request, 230 // including temporary Amazon Web Services credentials that can be used to make 231 // Amazon Web Services requests. 232 type AssumeRoleWithWebIdentityOutput struct { 233 234 // The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers 235 // that you can use to refer to the resulting temporary security credentials. For 236 // example, you can reference these credentials as a principal in a resource-based 237 // policy by using the ARN or assumed role ID. The ARN and ID include the 238 // RoleSessionName that you specified when you called AssumeRole . 239 AssumedRoleUser *types.AssumedRoleUser 240 241 // The intended audience (also known as client ID) of the web identity token. This 242 // is traditionally the client identifier issued to the application that requested 243 // the web identity token. 244 Audience *string 245 246 // The temporary security credentials, which include an access key ID, a secret 247 // access key, and a security token. The size of the security token that STS API 248 // operations return is not fixed. We strongly recommend that you make no 249 // assumptions about the maximum size. 250 Credentials *types.Credentials 251 252 // A percentage value that indicates the packed size of the session policies and 253 // session tags combined passed in the request. The request fails if the packed 254 // size is greater than 100 percent, which means the policies and tags exceeded the 255 // allowed space. 256 PackedPolicySize *int32 257 258 // The issuing authority of the web identity token presented. For OpenID Connect 259 // ID tokens, this contains the value of the iss field. For OAuth 2.0 access 260 // tokens, this contains the value of the ProviderId parameter that was passed in 261 // the AssumeRoleWithWebIdentity request. 262 Provider *string 263 264 // The value of the source identity that is returned in the JSON web token (JWT) 265 // from the identity provider. You can require users to set a source identity value 266 // when they assume a role. You do this by using the sts:SourceIdentity condition 267 // key in a role trust policy. That way, actions that are taken with the role are 268 // associated with that user. After the source identity is set, the value cannot be 269 // changed. It is present in the request for all actions that are taken by the role 270 // and persists across chained role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining) 271 // sessions. You can configure your identity provider to use an attribute 272 // associated with your users, like user name or email, as the source identity when 273 // calling AssumeRoleWithWebIdentity . You do this by adding a claim to the JSON 274 // web token. To learn more about OIDC tokens and claims, see Using Tokens with 275 // User Pools (https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html) 276 // in the Amazon Cognito Developer Guide. For more information about using source 277 // identity, see Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) 278 // in the IAM User Guide. The regex used to validate this parameter is a string of 279 // characters consisting of upper- and lower-case alphanumeric characters with no 280 // spaces. You can also include underscores or any of the following characters: 281 // =,.@- 282 SourceIdentity *string 283 284 // The unique user identifier that is returned by the identity provider. This 285 // identifier is associated with the WebIdentityToken that was submitted with the 286 // AssumeRoleWithWebIdentity call. The identifier is typically unique to the user 287 // and the application that acquired the WebIdentityToken (pairwise identifier). 288 // For OpenID Connect ID tokens, this field contains the value returned by the 289 // identity provider as the token's sub (Subject) claim. 290 SubjectFromWebIdentityToken *string 291 292 // Metadata pertaining to the operation's result. 293 ResultMetadata middleware.Metadata 294 295 noSmithyDocumentSerde 296 } 297 298 func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middleware.Stack, options Options) (err error) { 299 if err := stack.Serialize.Add(&setOperationInputMiddleware{}, middleware.After); err != nil { 300 return err 301 } 302 err = stack.Serialize.Add(&awsAwsquery_serializeOpAssumeRoleWithWebIdentity{}, middleware.After) 303 if err != nil { 304 return err 305 } 306 err = stack.Deserialize.Add(&awsAwsquery_deserializeOpAssumeRoleWithWebIdentity{}, middleware.After) 307 if err != nil { 308 return err 309 } 310 if err := addProtocolFinalizerMiddlewares(stack, options, "AssumeRoleWithWebIdentity"); err != nil { 311 return fmt.Errorf("add protocol finalizers: %v", err) 312 } 313 314 if err = addlegacyEndpointContextSetter(stack, options); err != nil { 315 return err 316 } 317 if err = addSetLoggerMiddleware(stack, options); err != nil { 318 return err 319 } 320 if err = addClientRequestID(stack); err != nil { 321 return err 322 } 323 if err = addComputeContentLength(stack); err != nil { 324 return err 325 } 326 if err = addResolveEndpointMiddleware(stack, options); err != nil { 327 return err 328 } 329 if err = addRetry(stack, options); err != nil { 330 return err 331 } 332 if err = addRawResponseToMetadata(stack); err != nil { 333 return err 334 } 335 if err = addRecordResponseTiming(stack); err != nil { 336 return err 337 } 338 if err = addClientUserAgent(stack, options); err != nil { 339 return err 340 } 341 if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { 342 return err 343 } 344 if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { 345 return err 346 } 347 if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil { 348 return err 349 } 350 if err = addOpAssumeRoleWithWebIdentityValidationMiddleware(stack); err != nil { 351 return err 352 } 353 if err = stack.Initialize.Add(newServiceMetadataMiddleware_opAssumeRoleWithWebIdentity(options.Region), middleware.Before); err != nil { 354 return err 355 } 356 if err = addRecursionDetection(stack); err != nil { 357 return err 358 } 359 if err = addRequestIDRetrieverMiddleware(stack); err != nil { 360 return err 361 } 362 if err = addResponseErrorMiddleware(stack); err != nil { 363 return err 364 } 365 if err = addRequestResponseLogging(stack, options); err != nil { 366 return err 367 } 368 if err = addDisableHTTPSMiddleware(stack, options); err != nil { 369 return err 370 } 371 return nil 372 } 373 374 func newServiceMetadataMiddleware_opAssumeRoleWithWebIdentity(region string) *awsmiddleware.RegisterServiceMetadata { 375 return &awsmiddleware.RegisterServiceMetadata{ 376 Region: region, 377 ServiceID: ServiceID, 378 OperationName: "AssumeRoleWithWebIdentity", 379 } 380 } 381