amazonka-sts-0.2.2: gen/Network/AWS/STS/AssumeRoleWithSAML.hs
{-# LANGUAGE DataKinds #-}
{-# LANGUAGE DeriveGeneric #-}
{-# LANGUAGE FlexibleInstances #-}
{-# LANGUAGE GeneralizedNewtypeDeriving #-}
{-# LANGUAGE LambdaCase #-}
{-# LANGUAGE NoImplicitPrelude #-}
{-# LANGUAGE OverloadedStrings #-}
{-# LANGUAGE RecordWildCards #-}
{-# LANGUAGE TypeFamilies #-}
{-# OPTIONS_GHC -fno-warn-unused-imports #-}
-- Module : Network.AWS.STS.AssumeRoleWithSAML
-- Copyright : (c) 2013-2014 Brendan Hay <brendan.g.hay@gmail.com>
-- License : This Source Code Form is subject to the terms of
-- the Mozilla Public License, v. 2.0.
-- A copy of the MPL can be found in the LICENSE file or
-- you can obtain it at http://mozilla.org/MPL/2.0/.
-- Maintainer : Brendan Hay <brendan.g.hay@gmail.com>
-- Stability : experimental
-- Portability : non-portable (GHC extensions)
--
-- Derived from AWS service descriptions, licensed under Apache 2.0.
-- | Returns a set of temporary security credentials for users who have been
-- authenticated via a SAML authentication response. This operation provides a
-- mechanism for tying an enterprise identity store or directory to role-based
-- AWS access without user-specific credentials or configuration.
--
-- The temporary security credentials returned by this operation consist of an
-- access key ID, a secret access key, and a security token. Applications can
-- use these temporary security credentials to sign calls to AWS services. The
-- credentials are valid for the duration that you specified when calling 'AssumeRoleWithSAML', which can be up to 3600 seconds (1 hour) or until the time specified in the
-- SAML authentication response's 'NotOnOrAfter' value, whichever is shorter.
--
-- Optionally, you can pass an IAM access policy to this operation. If you
-- choose not to pass a policy, the temporary security credentials that are
-- returned by the operation have the permissions that are defined in the access
-- policy of the role that is being assumed. If you pass a policy to this
-- operation, the temporary security credentials that are returned by the
-- operation have the permissions that are allowed by both the access policy of
-- the role that is being assumed, /and/ the policy that you pass. This gives you
-- a way to further restrict the permissions for the resulting temporary
-- security credentials. You cannot use the passed policy to grant permissions
-- that are in excess of those allowed by the access policy of the role that is
-- being assumed. For more information, see <http://docs.aws.amazon.com/STS/latest/UsingSTS/permissions-assume-role.html Permissions for AssumeRoleWithSAML>
-- in /Using Temporary Security Credentials/.
--
-- Before your application can call 'AssumeRoleWithSAML', you must configure your
-- SAML identity provider (IdP) to issue the claims required by AWS.
-- Additionally, you must use AWS Identity and Access Management (IAM) to create
-- a SAML provider entity in your AWS account that represents your identity
-- provider, and create an IAM role that specifies this SAML provider in its
-- trust policy.
--
-- Calling 'AssumeRoleWithSAML' does not require the use of AWS security
-- credentials. The identity of the caller is validated by using keys in the
-- metadata document that is uploaded for the SAML provider entity for your
-- identity provider.
--
-- For more information, see the following resources:
--
-- <http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingSAML.html Creating Temporary Security Credentials for SAML Federation> in /UsingTemporary Security Credentials/. <http://docs.aws.amazon.com/IAM/latest/UserGuide/idp-managing-identityproviders.html SAML Providers> in /Using IAM/. <http://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html Configuringa Relying Party and Claims> in /Using IAM/. <http://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml.html Creating a Role for SAML-BasedFederation> in /Using IAM/.
--
-- <http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html>
module Network.AWS.STS.AssumeRoleWithSAML
(
-- * Request
AssumeRoleWithSAML
-- ** Request constructor
, assumeRoleWithSAML
-- ** Request lenses
, arwsamlDurationSeconds
, arwsamlPolicy
, arwsamlPrincipalArn
, arwsamlRoleArn
, arwsamlSAMLAssertion
-- * Response
, AssumeRoleWithSAMLResponse
-- ** Response constructor
, assumeRoleWithSAMLResponse
-- ** Response lenses
, arwsamlrAssumedRoleUser
, arwsamlrAudience
, arwsamlrCredentials
, arwsamlrIssuer
, arwsamlrNameQualifier
, arwsamlrPackedPolicySize
, arwsamlrSubject
, arwsamlrSubjectType
) where
import Network.AWS.Prelude
import Network.AWS.Request.Query
import Network.AWS.STS.Types
import qualified GHC.Exts
data AssumeRoleWithSAML = AssumeRoleWithSAML
{ _arwsamlDurationSeconds :: Maybe Nat
, _arwsamlPolicy :: Maybe Text
, _arwsamlPrincipalArn :: Text
, _arwsamlRoleArn :: Text
, _arwsamlSAMLAssertion :: Text
} deriving (Eq, Ord, Read, Show)
-- | 'AssumeRoleWithSAML' constructor.
--
-- The fields accessible through corresponding lenses are:
--
-- * 'arwsamlDurationSeconds' @::@ 'Maybe' 'Natural'
--
-- * 'arwsamlPolicy' @::@ 'Maybe' 'Text'
--
-- * 'arwsamlPrincipalArn' @::@ 'Text'
--
-- * 'arwsamlRoleArn' @::@ 'Text'
--
-- * 'arwsamlSAMLAssertion' @::@ 'Text'
--
assumeRoleWithSAML :: Text -- ^ 'arwsamlRoleArn'
-> Text -- ^ 'arwsamlPrincipalArn'
-> Text -- ^ 'arwsamlSAMLAssertion'
-> AssumeRoleWithSAML
assumeRoleWithSAML p1 p2 p3 = AssumeRoleWithSAML
{ _arwsamlRoleArn = p1
, _arwsamlPrincipalArn = p2
, _arwsamlSAMLAssertion = p3
, _arwsamlPolicy = Nothing
, _arwsamlDurationSeconds = Nothing
}
-- | The duration, in seconds, of the role session. The value can range from 900
-- seconds (15 minutes) to 3600 seconds (1 hour). By default, the value is set
-- to 3600 seconds. An expiration can also be specified in the SAML
-- authentication response's 'NotOnOrAfter' value. The actual expiration time is
-- whichever value is shorter.
arwsamlDurationSeconds :: Lens' AssumeRoleWithSAML (Maybe Natural)
arwsamlDurationSeconds =
lens _arwsamlDurationSeconds (\s a -> s { _arwsamlDurationSeconds = a })
. mapping _Nat
-- | An IAM policy in JSON format.
--
-- The policy parameter is optional. If you pass a policy, the temporary
-- security credentials that are returned by the operation have the permissions
-- that are allowed by both the access policy of the role that is being assumed, /and/ the policy that you pass. This gives you a way to further restrict the
-- permissions for the resulting temporary security credentials. You cannot use
-- the passed policy to grant permissions that are in excess of those allowed by
-- the access policy of the role that is being assumed. For more information,
-- see <http://docs.aws.amazon.com/STS/latest/UsingSTS/permissions-assume-role.html Permissions for AssumeRoleWithSAML> in /Using Temporary Security Credentials/
-- .
arwsamlPolicy :: Lens' AssumeRoleWithSAML (Maybe Text)
arwsamlPolicy = lens _arwsamlPolicy (\s a -> s { _arwsamlPolicy = a })
-- | The Amazon Resource Name (ARN) of the SAML provider in IAM that describes the
-- IdP.
arwsamlPrincipalArn :: Lens' AssumeRoleWithSAML Text
arwsamlPrincipalArn =
lens _arwsamlPrincipalArn (\s a -> s { _arwsamlPrincipalArn = a })
-- | The Amazon Resource Name (ARN) of the role that the caller is assuming.
arwsamlRoleArn :: Lens' AssumeRoleWithSAML Text
arwsamlRoleArn = lens _arwsamlRoleArn (\s a -> s { _arwsamlRoleArn = a })
-- | The base-64 encoded SAML authentication response provided by the IdP.
--
-- For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html Configuring a Relying Party and Adding Claims> in
-- the /Using IAM/ guide.
arwsamlSAMLAssertion :: Lens' AssumeRoleWithSAML Text
arwsamlSAMLAssertion =
lens _arwsamlSAMLAssertion (\s a -> s { _arwsamlSAMLAssertion = a })
data AssumeRoleWithSAMLResponse = AssumeRoleWithSAMLResponse
{ _arwsamlrAssumedRoleUser :: Maybe AssumedRoleUser
, _arwsamlrAudience :: Maybe Text
, _arwsamlrCredentials :: Maybe Credentials
, _arwsamlrIssuer :: Maybe Text
, _arwsamlrNameQualifier :: Maybe Text
, _arwsamlrPackedPolicySize :: Maybe Nat
, _arwsamlrSubject :: Maybe Text
, _arwsamlrSubjectType :: Maybe Text
} deriving (Eq, Read, Show)
-- | 'AssumeRoleWithSAMLResponse' constructor.
--
-- The fields accessible through corresponding lenses are:
--
-- * 'arwsamlrAssumedRoleUser' @::@ 'Maybe' 'AssumedRoleUser'
--
-- * 'arwsamlrAudience' @::@ 'Maybe' 'Text'
--
-- * 'arwsamlrCredentials' @::@ 'Maybe' 'Credentials'
--
-- * 'arwsamlrIssuer' @::@ 'Maybe' 'Text'
--
-- * 'arwsamlrNameQualifier' @::@ 'Maybe' 'Text'
--
-- * 'arwsamlrPackedPolicySize' @::@ 'Maybe' 'Natural'
--
-- * 'arwsamlrSubject' @::@ 'Maybe' 'Text'
--
-- * 'arwsamlrSubjectType' @::@ 'Maybe' 'Text'
--
assumeRoleWithSAMLResponse :: AssumeRoleWithSAMLResponse
assumeRoleWithSAMLResponse = AssumeRoleWithSAMLResponse
{ _arwsamlrCredentials = Nothing
, _arwsamlrAssumedRoleUser = Nothing
, _arwsamlrPackedPolicySize = Nothing
, _arwsamlrSubject = Nothing
, _arwsamlrSubjectType = Nothing
, _arwsamlrIssuer = Nothing
, _arwsamlrAudience = Nothing
, _arwsamlrNameQualifier = Nothing
}
arwsamlrAssumedRoleUser :: Lens' AssumeRoleWithSAMLResponse (Maybe AssumedRoleUser)
arwsamlrAssumedRoleUser =
lens _arwsamlrAssumedRoleUser (\s a -> s { _arwsamlrAssumedRoleUser = a })
-- | The value of the 'Recipient' attribute of the 'SubjectConfirmationData' element
-- of the SAML assertion.
arwsamlrAudience :: Lens' AssumeRoleWithSAMLResponse (Maybe Text)
arwsamlrAudience = lens _arwsamlrAudience (\s a -> s { _arwsamlrAudience = a })
arwsamlrCredentials :: Lens' AssumeRoleWithSAMLResponse (Maybe Credentials)
arwsamlrCredentials =
lens _arwsamlrCredentials (\s a -> s { _arwsamlrCredentials = a })
-- | The value of the 'Issuer' element of the SAML assertion.
arwsamlrIssuer :: Lens' AssumeRoleWithSAMLResponse (Maybe Text)
arwsamlrIssuer = lens _arwsamlrIssuer (\s a -> s { _arwsamlrIssuer = a })
-- | A hash value based on the concatenation of the 'Issuer' response value, the AWS
-- account ID, and the friendly name (the last part of the ARN) of the SAML
-- provider in IAM. The combination of 'NameQualifier' and 'Subject' can be used to
-- uniquely identify a federated user.
--
-- The following pseudocode shows how the hash value is calculated:
--
-- 'BASE64 ( SHA1 ( "https://example.com/saml" + "123456789012" + "/MySAMLIdP") )'
arwsamlrNameQualifier :: Lens' AssumeRoleWithSAMLResponse (Maybe Text)
arwsamlrNameQualifier =
lens _arwsamlrNameQualifier (\s a -> s { _arwsamlrNameQualifier = a })
-- | A percentage value that indicates the size of the policy in packed form. The
-- service rejects any policy with a packed size greater than 100 percent, which
-- means the policy exceeded the allowed space.
arwsamlrPackedPolicySize :: Lens' AssumeRoleWithSAMLResponse (Maybe Natural)
arwsamlrPackedPolicySize =
lens _arwsamlrPackedPolicySize
(\s a -> s { _arwsamlrPackedPolicySize = a })
. mapping _Nat
-- | The value of the 'NameID' element in the 'Subject' element of the SAML assertion.
arwsamlrSubject :: Lens' AssumeRoleWithSAMLResponse (Maybe Text)
arwsamlrSubject = lens _arwsamlrSubject (\s a -> s { _arwsamlrSubject = a })
-- | The format of the name ID, as defined by the 'Format' attribute in the 'NameID'
-- element of the SAML assertion. Typical examples of the format are 'transient'
-- or 'persistent'.
--
-- If the format includes the prefix 'urn:oasis:names:tc:SAML:2.0:nameid-format', that prefix is removed. For example,
-- 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' is returned as 'transient'.
-- If the format includes any other prefix, the format is returned with no
-- modifications.
arwsamlrSubjectType :: Lens' AssumeRoleWithSAMLResponse (Maybe Text)
arwsamlrSubjectType =
lens _arwsamlrSubjectType (\s a -> s { _arwsamlrSubjectType = a })
instance ToPath AssumeRoleWithSAML where
toPath = const "/"
instance ToQuery AssumeRoleWithSAML where
toQuery AssumeRoleWithSAML{..} = mconcat
[ "DurationSeconds" =? _arwsamlDurationSeconds
, "Policy" =? _arwsamlPolicy
, "PrincipalArn" =? _arwsamlPrincipalArn
, "RoleArn" =? _arwsamlRoleArn
, "SAMLAssertion" =? _arwsamlSAMLAssertion
]
instance ToHeaders AssumeRoleWithSAML
instance AWSRequest AssumeRoleWithSAML where
type Sv AssumeRoleWithSAML = STS
type Rs AssumeRoleWithSAML = AssumeRoleWithSAMLResponse
request = post "AssumeRoleWithSAML"
response = xmlResponse
instance FromXML AssumeRoleWithSAMLResponse where
parseXML = withElement "AssumeRoleWithSAMLResult" $ \x -> AssumeRoleWithSAMLResponse
<$> x .@? "AssumedRoleUser"
<*> x .@? "Audience"
<*> x .@? "Credentials"
<*> x .@? "Issuer"
<*> x .@? "NameQualifier"
<*> x .@? "PackedPolicySize"
<*> x .@? "Subject"
<*> x .@? "SubjectType"