diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ ## Version -`1.4.3` +`1.4.4` ## Description diff --git a/amazonka-sts.cabal b/amazonka-sts.cabal --- a/amazonka-sts.cabal +++ b/amazonka-sts.cabal @@ -1,5 +1,5 @@ name: amazonka-sts -version: 1.4.3 +version: 1.4.4 synopsis: Amazon Security Token Service SDK. homepage: https://github.com/brendanhay/amazonka bug-reports: https://github.com/brendanhay/amazonka/issues @@ -11,7 +11,7 @@ category: Network, AWS, Cloud, Distributed Computing build-type: Simple cabal-version: >= 1.10 -extra-source-files: README.md fixture/*.yaml fixture/*.proto +extra-source-files: README.md fixture/*.yaml fixture/*.proto src/.gitkeep description: AWS Security Token Service @@ -74,7 +74,7 @@ , Network.AWS.STS.Types.Sum build-depends: - amazonka-core == 1.4.3.* + amazonka-core == 1.4.4.* , base >= 4.7 && < 5 test-suite amazonka-sts-test @@ -94,9 +94,9 @@ , Test.AWS.STS.Internal build-depends: - amazonka-core == 1.4.3.* - , amazonka-test == 1.4.3.* - , amazonka-sts == 1.4.3.* + amazonka-core == 1.4.4.* + , amazonka-test == 1.4.4.* + , amazonka-sts == 1.4.4.* , base , bytestring , tasty diff --git a/gen/Network/AWS/STS/AssumeRole.hs b/gen/Network/AWS/STS/AssumeRole.hs --- a/gen/Network/AWS/STS/AssumeRole.hs +++ b/gen/Network/AWS/STS/AssumeRole.hs @@ -20,7 +20,7 @@ -- -- Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) that you can use to access AWS resources that you might not normally have access to. Typically, you use 'AssumeRole' for cross-account access or federation. For a comparison of 'AssumeRole' with the other APIs that produce temporary credentials, see and in the /IAM User Guide/. -- --- __Important:__ You cannot call 'AssumeRole' by using AWS root account credentials; access is denied. You must use IAM user credentials or temporary security credentials to call 'AssumeRole'. +-- __Important:__ You cannot call 'AssumeRole' by using AWS root account credentials; access is denied. You must use credentials for an IAM user or an IAM role to call 'AssumeRole'. -- -- For cross-account access, imagine that you own multiple accounts and need to access resources in each account. You could create long-term credentials in each account to access those resources. However, managing all those credentials and remembering which one can access which account can be time consuming. Instead, you can create one set of long-term credentials in one account and then use temporary security credentials to access all the other accounts by assuming roles in those accounts. For more information about roles, see in the /IAM User Guide/. -- @@ -126,6 +126,8 @@ arTokenCode = lens _arTokenCode (\ s a -> s{_arTokenCode = a}); -- | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) to 3600 seconds (1 hour). By default, the value is set to 3600 seconds. +-- +-- This is separate from the duration of a console session that you might request using the returned credentials. The request to the federation endpoint for a console sign-in token takes a 'SessionDuration' parameter that specifies the maximum length of the console session, separately from the 'DurationSeconds' parameter on this API. For more information, see in the /IAM User Guide/. arDurationSeconds :: Lens' AssumeRole (Maybe Natural) arDurationSeconds = lens _arDurationSeconds (\ s a -> s{_arDurationSeconds = a}) . mapping _Nat; @@ -141,13 +143,13 @@ -- | A unique identifier that is used by third parties when assuming roles in their customers\' accounts. For each role that the third party can assume, they should instruct their customers to ensure the role\'s trust policy checks for the external ID that the third party generated. Each time the third party assumes the role, they should pass the customer\'s external ID. The external ID is useful in order to help third parties bind a role to the customer who created it. For more information about the external ID, see in the /IAM User Guide/. -- --- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include any of the following characters: =,.\':\\\/- +-- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.\':\\\/- arExternalId :: Lens' AssumeRole (Maybe Text) arExternalId = lens _arExternalId (\ s a -> s{_arExternalId = a}); -- | The identification number of the MFA device that is associated with the user who is making the 'AssumeRole' call. Specify this value if the trust policy of the role being assumed includes a condition that requires MFA authentication. The value is either the serial number for a hardware device (such as 'GAHT12345678') or an Amazon Resource Name (ARN) for a virtual device (such as 'arn:aws:iam::123456789012:mfa\/user'). -- --- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include any of the following characters: =,.\'- +-- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.\'- arSerialNumber :: Lens' AssumeRole (Maybe Text) arSerialNumber = lens _arSerialNumber (\ s a -> s{_arSerialNumber = a}); @@ -159,7 +161,7 @@ -- -- Use the role session name to uniquely identify a session when the same role is assumed by different principals or for different reasons. In cross-account scenarios, the role session name is visible to, and can be logged by the account that owns the role. The role session name is also used in the ARN of the assumed role principal. This means that subsequent cross-account API requests using the temporary security credentials will expose the role session name to the external account in their CloudTrail logs. -- --- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include any of the following characters: =,.\'- +-- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.\'- arRoleSessionName :: Lens' AssumeRole Text arRoleSessionName = lens _arRoleSessionName (\ s a -> s{_arRoleSessionName = a}); diff --git a/gen/Network/AWS/STS/AssumeRoleWithSAML.hs b/gen/Network/AWS/STS/AssumeRoleWithSAML.hs --- a/gen/Network/AWS/STS/AssumeRoleWithSAML.hs +++ b/gen/Network/AWS/STS/AssumeRoleWithSAML.hs @@ -26,7 +26,7 @@ -- -- The temporary security credentials created by 'AssumeRoleWithSAML' can be used to make API calls to any AWS service with the following exception: you cannot call the STS service\'s 'GetFederationToken' or 'GetSessionToken' APIs. -- --- Optionally, you can pass an IAM access policy to this operation. If you choose not to pass a policy, the temporary security credentials that are returned by the operation have the permissions that are defined in the access policy of the role that is being assumed. If you pass a policy to this operation, the temporary security credentials that are returned by the operation have the permissions that are allowed by both the access policy of the role that is being assumed, /__and__/ the policy that you pass. This gives you a way to further restrict the permissions for the resulting temporary security credentials. You cannot use the passed policy to grant permissions that are in excess of those allowed by the access policy of the role that is being assumed. For more information, see in the /IAM User Guide/. +-- Optionally, you can pass an IAM access policy to this operation. If you choose not to pass a policy, the temporary security credentials that are returned by the operation have the permissions that are defined in the access policy of the role that is being assumed. If you pass a policy to this operation, the temporary security credentials that are returned by the operation have the permissions that are allowed by the intersection of both the access policy of the role that is being assumed, /__and__/ the policy that you pass. This means that both policies must grant the permission for the action to be allowed. This gives you a way to further restrict the permissions for the resulting temporary security credentials. You cannot use the passed policy to grant permissions that are in excess of those allowed by the access policy of the role that is being assumed. For more information, see in the /IAM User Guide/. -- -- Before your application can call 'AssumeRoleWithSAML', you must configure your SAML identity provider (IdP) to issue the claims required by AWS. Additionally, you must use AWS Identity and Access Management (IAM) to create a SAML provider entity in your AWS account that represents your identity provider, and create an IAM role that specifies this SAML provider in its trust policy. -- @@ -116,7 +116,7 @@ -- | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) to 3600 seconds (1 hour). By default, the value is set to 3600 seconds. An expiration can also be specified in the SAML authentication response\'s 'SessionNotOnOrAfter' value. The actual expiration time is whichever value is shorter. -- --- The maximum duration for a session is 1 hour, and the minimum duration is 15 minutes, even if values outside this range are specified. +-- This is separate from the duration of a console session that you might request using the returned credentials. The request to the federation endpoint for a console sign-in token takes a 'SessionDuration' parameter that specifies the maximum length of the console session, separately from the 'DurationSeconds' parameter on this API. For more information, see in the /IAM User Guide/. arwsamlDurationSeconds :: Lens' AssumeRoleWithSAML (Maybe Natural) arwsamlDurationSeconds = lens _arwsamlDurationSeconds (\ s a -> s{_arwsamlDurationSeconds = a}) . mapping _Nat; diff --git a/gen/Network/AWS/STS/AssumeRoleWithWebIdentity.hs b/gen/Network/AWS/STS/AssumeRoleWithWebIdentity.hs --- a/gen/Network/AWS/STS/AssumeRoleWithWebIdentity.hs +++ b/gen/Network/AWS/STS/AssumeRoleWithWebIdentity.hs @@ -130,6 +130,8 @@ arwwiProviderId = lens _arwwiProviderId (\ s a -> s{_arwwiProviderId = a}); -- | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) to 3600 seconds (1 hour). By default, the value is set to 3600 seconds. +-- +-- This is separate from the duration of a console session that you might request using the returned credentials. The request to the federation endpoint for a console sign-in token takes a 'SessionDuration' parameter that specifies the maximum length of the console session, separately from the 'DurationSeconds' parameter on this API. For more information, see in the /IAM User Guide/. arwwiDurationSeconds :: Lens' AssumeRoleWithWebIdentity (Maybe Natural) arwwiDurationSeconds = lens _arwwiDurationSeconds (\ s a -> s{_arwwiDurationSeconds = a}) . mapping _Nat; @@ -149,7 +151,7 @@ -- | An identifier for the assumed role session. Typically, you pass the name or identifier that is associated with the user who is using your application. That way, the temporary security credentials that your application will use are associated with that user. This session name is included as part of the ARN and assumed role ID in the 'AssumedRoleUser' response element. -- --- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include any of the following characters: =,.\'- +-- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.\'- arwwiRoleSessionName :: Lens' AssumeRoleWithWebIdentity Text arwwiRoleSessionName = lens _arwwiRoleSessionName (\ s a -> s{_arwwiRoleSessionName = a}); diff --git a/gen/Network/AWS/STS/GetFederationToken.hs b/gen/Network/AWS/STS/GetFederationToken.hs --- a/gen/Network/AWS/STS/GetFederationToken.hs +++ b/gen/Network/AWS/STS/GetFederationToken.hs @@ -118,7 +118,7 @@ -- | The name of the federated user. The name is used as an identifier for the temporary security credentials (such as 'Bob'). For example, you can reference the federated user name in a resource-based policy, such as in an Amazon S3 bucket policy. -- --- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include any of the following characters: =,.\'- +-- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.\'- gftName :: Lens' GetFederationToken Text gftName = lens _gftName (\ s a -> s{_gftName = a}); diff --git a/gen/Network/AWS/STS/GetSessionToken.hs b/gen/Network/AWS/STS/GetSessionToken.hs --- a/gen/Network/AWS/STS/GetSessionToken.hs +++ b/gen/Network/AWS/STS/GetSessionToken.hs @@ -95,7 +95,7 @@ -- | The identification number of the MFA device that is associated with the IAM user who is making the 'GetSessionToken' call. Specify this value if the IAM user has a policy that requires MFA authentication. The value is either the serial number for a hardware device (such as 'GAHT12345678') or an Amazon Resource Name (ARN) for a virtual device (such as 'arn:aws:iam::123456789012:mfa\/user'). You can find the device for an IAM user by going to the AWS Management Console and viewing the user\'s security credentials. -- --- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include any of the following characters: =,.\'- +-- The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.\'- gstSerialNumber :: Lens' GetSessionToken (Maybe Text) gstSerialNumber = lens _gstSerialNumber (\ s a -> s{_gstSerialNumber = a}); diff --git a/src/.gitkeep b/src/.gitkeep new file mode 100644 --- /dev/null +++ b/src/.gitkeep