/** * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. * SPDX-License-Identifier: Apache-2.0. */ #pragma once #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include namespace Aws { namespace Http { class HttpClient; class HttpClientFactory; } // namespace Http namespace Utils { template< typename R, typename E> class Outcome; namespace Threading { class Executor; } // namespace Threading namespace Xml { class XmlDocument; } // namespace Xml } // namespace Utils namespace Auth { class AWSCredentials; class AWSCredentialsProvider; } // namespace Auth namespace Client { class RetryStrategy; } // namespace Client namespace STS { namespace Model { class AssumeRoleRequest; class AssumeRoleWithSAMLRequest; class AssumeRoleWithWebIdentityRequest; class DecodeAuthorizationMessageRequest; class GetAccessKeyInfoRequest; class GetCallerIdentityRequest; class GetFederationTokenRequest; class GetSessionTokenRequest; typedef Aws::Utils::Outcome AssumeRoleOutcome; typedef Aws::Utils::Outcome AssumeRoleWithSAMLOutcome; typedef Aws::Utils::Outcome AssumeRoleWithWebIdentityOutcome; typedef Aws::Utils::Outcome DecodeAuthorizationMessageOutcome; typedef Aws::Utils::Outcome GetAccessKeyInfoOutcome; typedef Aws::Utils::Outcome GetCallerIdentityOutcome; typedef Aws::Utils::Outcome GetFederationTokenOutcome; typedef Aws::Utils::Outcome GetSessionTokenOutcome; typedef std::future AssumeRoleOutcomeCallable; typedef std::future AssumeRoleWithSAMLOutcomeCallable; typedef std::future AssumeRoleWithWebIdentityOutcomeCallable; typedef std::future DecodeAuthorizationMessageOutcomeCallable; typedef std::future GetAccessKeyInfoOutcomeCallable; typedef std::future GetCallerIdentityOutcomeCallable; typedef std::future GetFederationTokenOutcomeCallable; typedef std::future GetSessionTokenOutcomeCallable; } // namespace Model class STSClient; typedef std::function&) > AssumeRoleResponseReceivedHandler; typedef std::function&) > AssumeRoleWithSAMLResponseReceivedHandler; typedef std::function&) > AssumeRoleWithWebIdentityResponseReceivedHandler; typedef std::function&) > DecodeAuthorizationMessageResponseReceivedHandler; typedef std::function&) > GetAccessKeyInfoResponseReceivedHandler; typedef std::function&) > GetCallerIdentityResponseReceivedHandler; typedef std::function&) > GetFederationTokenResponseReceivedHandler; typedef std::function&) > GetSessionTokenResponseReceivedHandler; /** * Security Token Service

Security Token Service (STS) * enables you to request temporary, limited-privilege credentials for Identity and * Access Management (IAM) users or for users that you authenticate (federated * users). This guide provides descriptions of the STS API. For more information * about using this service, see Temporary * Security Credentials.

*/ class AWS_STS_API STSClient : public Aws::Client::AWSXMLClient { public: typedef Aws::Client::AWSXMLClient BASECLASS; /** * Initializes client to use DefaultCredentialProviderChain, with default http client factory, and optional client config. If client config * is not specified, it will be initialized to default values. */ STSClient(const Aws::Client::ClientConfiguration& clientConfiguration = Aws::Client::ClientConfiguration()); /** * Initializes client to use SimpleAWSCredentialsProvider, with default http client factory, and optional client config. If client config * is not specified, it will be initialized to default values. */ STSClient(const Aws::Auth::AWSCredentials& credentials, const Aws::Client::ClientConfiguration& clientConfiguration = Aws::Client::ClientConfiguration()); /** * Initializes client to use specified credentials provider with specified client config. If http client factory is not supplied, * the default http client factory will be used */ STSClient(const std::shared_ptr& credentialsProvider, const Aws::Client::ClientConfiguration& clientConfiguration = Aws::Client::ClientConfiguration()); virtual ~STSClient(); /** * Converts any request object to a presigned URL with the GET method, using region for the signer and a timeout of 15 minutes. */ Aws::String ConvertRequestToPresignedUrl(const Aws::AmazonSerializableWebServiceRequest& requestToConvert, const char* region) const; /** *

Returns a set of temporary security credentials that you can use to access * Amazon Web Services resources that you might not normally have access to. These * temporary credentials consist of an access key ID, a secret access key, and a * security token. Typically, you use AssumeRole within your account * or for cross-account access. For a comparison of AssumeRole with * other API operations that produce temporary credentials, see Requesting * Temporary Security Credentials and Comparing * the Amazon Web Services STS API operations in the IAM User Guide.

Permissions

The temporary security credentials created by * AssumeRole can be used to make API calls to any Amazon Web Services * service with the following exception: You cannot call the Amazon Web Services * STS GetFederationToken or GetSessionToken API * operations.

(Optional) You can pass inline or managed session * policies to this operation. You can pass a single JSON policy document to * use as an inline session policy. You can also specify up to 10 managed policies * to use as managed session policies. The plaintext that you use for both inline * and managed session policies can't exceed 2,048 characters. Passing policies to * this operation returns new temporary credentials. The resulting session's * permissions are the intersection of the role's identity-based policy and the * session policies. You can use the role's temporary credentials in subsequent * Amazon Web Services API calls to access resources in the account that owns the * role. You cannot use session policies to grant more permissions than those * allowed by the identity-based policy of the role that is being assumed. For more * information, see Session * Policies in the IAM User Guide.

When you create a role, you * create two policies: A role trust policy that specifies who can assume * the role and a permissions policy that specifies what can be done with * the role. You specify the trusted principal who is allowed to assume the role in * the role trust policy.

To assume a role from a different account, your * Amazon Web Services account must be trusted by the role. The trust relationship * is defined in the role's trust policy when the role is created. That trust * policy states which accounts are allowed to delegate that access to users in the * account.

A user who wants to access a role in a different account must * also have permissions that are delegated from the user account administrator. * The administrator must attach a policy that allows the user to call * AssumeRole for the ARN of the role in the other account.

To * allow a user to assume a role in the same account, you can do either of the * following:

Attach a policy to the user that allows the user to * call AssumeRole (as long as the role's trust policy trusts the * account).
Add the user as a principal directly in the role's * trust policy.

You can do either because the role’s trust * policy acts as an IAM resource-based policy. When a resource-based policy grants * access to a principal in the same account, no additional identity-based policy * is required. For more information about trust policies and resource-based * policies, see IAM * Policies in the IAM User Guide.

Tags

(Optional) You can pass tag key-value pairs to your session. These tags are * called session tags. For more information about session tags, see Passing * Session Tags in STS in the IAM User Guide.

An administrator * must grant you the permissions necessary to pass session tags. The administrator * can also create granular permissions to allow you to pass only specific session * tags. For more information, see Tutorial: * Using Tags for Attribute-Based Access Control in the IAM User * Guide.

You can set the session tags as transitive. Transitive tags * persist during role chaining. For more information, see Chaining * Roles with Session Tags in the IAM User Guide.

Using MFA * with AssumeRole

(Optional) You can include multi-factor * authentication (MFA) information when you call AssumeRole. This is * useful for cross-account scenarios to ensure that the user that assumes the role * has been authenticated with an Amazon Web Services MFA device. In that scenario, * the trust policy of the role being assumed includes a condition that tests for * MFA authentication. If the caller does not include valid MFA information, the * request to assume the role is denied. The condition in a trust policy that tests * for MFA authentication might look like the following example.

* "Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}

For more information, see Configuring * MFA-Protected API Access in the IAM User Guide guide.

To use * MFA with AssumeRole, you pass values for the * SerialNumber and TokenCode parameters. The * SerialNumber value identifies the user's hardware or virtual MFA * device. The TokenCode is the time-based one-time password (TOTP) * that the MFA device produces.

See Also:

See Also:

See Also:

See Also:

See Also:

See Also:

See Also:

See Also: