|
| 1 | +import { ProviderError } from "@aws-sdk/property-provider"; |
| 2 | +import { CredentialProvider, Credentials } from "@aws-sdk/types"; |
| 3 | + |
| 4 | +export interface AssumeRoleWithWebIdentityParams { |
| 5 | + /** |
| 6 | + * <p>The Amazon Resource Name (ARN) of the role that the caller is assuming.</p> |
| 7 | + */ |
| 8 | + RoleArn: string; |
| 9 | + /** |
| 10 | + * <p>An identifier for the assumed role session. Typically, you pass the name or identifier |
| 11 | + * that is associated with the user who is using your application. That way, the temporary |
| 12 | + * security credentials that your application will use are associated with that user. This |
| 13 | + * session name is included as part of the ARN and assumed role ID in the |
| 14 | + * <code>AssumedRoleUser</code> response element.</p> |
| 15 | + * <p>The regex used to validate this parameter is a string of characters |
| 16 | + * consisting of upper- and lower-case alphanumeric characters with no spaces. You can |
| 17 | + * also include underscores or any of the following characters: =,.@-</p> |
| 18 | + */ |
| 19 | + RoleSessionName: string; |
| 20 | + /** |
| 21 | + * <p>The OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity |
| 22 | + * provider. Your application must get this token by authenticating the user who is using your |
| 23 | + * application with a web identity provider before the application makes an |
| 24 | + * <code>AssumeRoleWithWebIdentity</code> call. </p> |
| 25 | + */ |
| 26 | + WebIdentityToken: string; |
| 27 | + |
| 28 | + /** |
| 29 | + * <p>The fully qualified host component of the domain name of the identity provider.</p> |
| 30 | + * <p>Specify this value only for OAuth 2.0 access tokens. Currently |
| 31 | + * <code>www.amazon.com</code> and <code>graph.facebook.com</code> are the only supported |
| 32 | + * identity providers for OAuth 2.0 access tokens. Do not include URL schemes and port |
| 33 | + * numbers.</p> |
| 34 | + * <p>Do not specify this value for OpenID Connect ID tokens.</p> |
| 35 | + */ |
| 36 | + ProviderId?: string; |
| 37 | + |
| 38 | + /** |
| 39 | + * <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as |
| 40 | + * managed session policies. The policies must exist in the same account as the role.</p> |
| 41 | + * <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the |
| 42 | + * plain text that you use for both inline and managed session policies can't exceed 2,048 |
| 43 | + * characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs) and AWS |
| 44 | + * Service Namespaces</a> in the AWS General Reference.</p> |
| 45 | + * <note> |
| 46 | + * <p>An AWS conversion compresses the passed session policies and session tags into a |
| 47 | + * packed binary format that has a separate limit. Your request can fail for this limit |
| 48 | + * even if your plain text meets the other requirements. The <code>PackedPolicySize</code> |
| 49 | + * response element indicates by percentage how close the policies and tags for your |
| 50 | + * request are to the upper size limit. |
| 51 | + * </p> |
| 52 | + * </note> |
| 53 | + * |
| 54 | + * <p>Passing policies to this operation returns new |
| 55 | + * temporary credentials. The resulting session's permissions are the intersection of the |
| 56 | + * role's identity-based policy and the session policies. You can use the role's temporary |
| 57 | + * credentials in subsequent AWS API calls to access resources in the account that owns |
| 58 | + * the role. You cannot use session policies to grant more permissions than those allowed |
| 59 | + * by the identity-based policy of the role that is being assumed. For more information, see |
| 60 | + * <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session |
| 61 | + * Policies</a> in the <i>IAM User Guide</i>.</p> |
| 62 | + */ |
| 63 | + PolicyArns?: { arn?: string }[]; |
| 64 | + |
| 65 | + /** |
| 66 | + * <p>An IAM policy in JSON format that you want to use as an inline session policy.</p> |
| 67 | + * <p>This parameter is optional. Passing policies to this operation returns new |
| 68 | + * temporary credentials. The resulting session's permissions are the intersection of the |
| 69 | + * role's identity-based policy and the session policies. You can use the role's temporary |
| 70 | + * credentials in subsequent AWS API calls to access resources in the account that owns |
| 71 | + * the role. You cannot use session policies to grant more permissions than those allowed |
| 72 | + * by the identity-based policy of the role that is being assumed. For more information, see |
| 73 | + * <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session |
| 74 | + * Policies</a> in the <i>IAM User Guide</i>.</p> |
| 75 | + * <p>The plain text that you use for both inline and managed session policies can't exceed |
| 76 | + * 2,048 characters. The JSON policy characters can be any ASCII character from the space |
| 77 | + * character to the end of the valid character list (\u0020 through \u00FF). It can also |
| 78 | + * include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D) |
| 79 | + * characters.</p> |
| 80 | + * <note> |
| 81 | + * <p>An AWS conversion compresses the passed session policies and session tags into a |
| 82 | + * packed binary format that has a separate limit. Your request can fail for this limit |
| 83 | + * even if your plain text meets the other requirements. The <code>PackedPolicySize</code> |
| 84 | + * response element indicates by percentage how close the policies and tags for your |
| 85 | + * request are to the upper size limit. |
| 86 | + * </p> |
| 87 | + * </note> |
| 88 | + */ |
| 89 | + Policy?: string; |
| 90 | + |
| 91 | + /** |
| 92 | + * <p>The duration, in seconds, of the role session. The value can range from 900 seconds (15 |
| 93 | + * minutes) up to the maximum session duration setting for the role. This setting can have a |
| 94 | + * value from 1 hour to 12 hours. If you specify a value higher than this setting, the |
| 95 | + * operation fails. For example, if you specify a session duration of 12 hours, but your |
| 96 | + * administrator set the maximum session duration to 6 hours, your operation fails. To learn |
| 97 | + * how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the |
| 98 | + * Maximum Session Duration Setting for a Role</a> in the |
| 99 | + * <i>IAM User Guide</i>.</p> |
| 100 | + * <p>By default, the value is set to <code>3600</code> seconds. </p> |
| 101 | + * <note> |
| 102 | + * <p>The <code>DurationSeconds</code> parameter is separate from the duration of a console |
| 103 | + * session that you might request using the returned credentials. The request to the |
| 104 | + * federation endpoint for a console sign-in token takes a <code>SessionDuration</code> |
| 105 | + * parameter that specifies the maximum length of the console session. For more |
| 106 | + * information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating a URL |
| 107 | + * that Enables Federated Users to Access the AWS Management Console</a> in the |
| 108 | + * <i>IAM User Guide</i>.</p> |
| 109 | + * </note> |
| 110 | + */ |
| 111 | + DurationSeconds?: number; |
| 112 | +} |
| 113 | + |
| 114 | +type LowerCaseKey<T> = { [K in keyof T as `${Uncapitalize<string & K>}`]: T[K] }; |
| 115 | +export interface FromWebTokenInit extends Omit<LowerCaseKey<AssumeRoleWithWebIdentityParams>, "roleSessionName"> { |
| 116 | + /** |
| 117 | + * The IAM session name used to distinguish sessions. |
| 118 | + */ |
| 119 | + roleSessionName?: string; |
| 120 | + |
| 121 | + /** |
| 122 | + * A function that assumes a role with web identity and returns a promise fulfilled with |
| 123 | + * credentials for the assumed role. |
| 124 | + * |
| 125 | + * @param params input parameter of sts:AssumeRoleWithWebIdentity API. |
| 126 | + */ |
| 127 | + roleAssumerWithWebIdentity?: (params: AssumeRoleWithWebIdentityParams) => Promise<Credentials>; |
| 128 | +} |
| 129 | + |
| 130 | +export const fromWebToken = (init: FromWebTokenInit): CredentialProvider => () => { |
| 131 | + const { |
| 132 | + roleArn, |
| 133 | + roleSessionName, |
| 134 | + webIdentityToken, |
| 135 | + providerId, |
| 136 | + policyArns, |
| 137 | + policy, |
| 138 | + durationSeconds, |
| 139 | + roleAssumerWithWebIdentity, |
| 140 | + } = init; |
| 141 | + |
| 142 | + if (!roleAssumerWithWebIdentity) { |
| 143 | + throw new ProviderError( |
| 144 | + `Role Arn '${roleArn}' needs to be assumed with web identity,` + ` but no role assumption callback was provided.`, |
| 145 | + false |
| 146 | + ); |
| 147 | + } |
| 148 | + |
| 149 | + return roleAssumerWithWebIdentity({ |
| 150 | + RoleArn: roleArn, |
| 151 | + RoleSessionName: roleSessionName ?? "web-identity", |
| 152 | + WebIdentityToken: webIdentityToken, |
| 153 | + ProviderId: providerId, |
| 154 | + PolicyArns: policyArns, |
| 155 | + Policy: policy, |
| 156 | + DurationSeconds: durationSeconds, |
| 157 | + }); |
| 158 | +}; |
0 commit comments