Skip to content

Commit 795bda9

Browse files
author
awstools
committed
feat(client-iot): This release adds support for Custom Authentication with X.509 Client Certificates, support for Custom Client Certificate validation, and support for selecting application protocol and authentication type without requiring TLS ALPN for customer's AWS IoT Domain Configurations.
1 parent f783a42 commit 795bda9

17 files changed

+638
-169
lines changed

‎clients/client-iot/src/commands/AssociateSbomWithPackageVersionCommand.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ export interface AssociateSbomWithPackageVersionCommandOutput
3333
__MetadataBearer {}
3434

3535
/**
36-
* <p>Associates a software bill of materials (SBOM) with a specific software package version.</p>
36+
* <p>Associates the selected software bill of materials (SBOM) with a specific software package version.</p>
3737
* <p>Requires permission to access the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions">AssociateSbomWithPackageVersion</a> action.</p>
3838
* @example
3939
* Use a bare-bones client and the command you need to make an API call.

‎clients/client-iot/src/commands/CreateBillingGroupCommand.ts

+3-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,9 @@ export interface CreateBillingGroupCommandInput extends CreateBillingGroupReques
2828
export interface CreateBillingGroupCommandOutput extends CreateBillingGroupResponse, __MetadataBearer {}
2929

3030
/**
31-
* <p>Creates a billing group.</p>
31+
* <p>Creates a billing group. If this call is made multiple times using
32+
* the same billing group name and configuration, the call will succeed. If this call is made with
33+
* the same billing group name but different configuration a <code>ResourceAlreadyExistsException</code> is thrown.</p>
3234
* <p>Requires permission to access the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions">CreateBillingGroup</a> action.</p>
3335
* @example
3436
* Use a bare-bones client and the command you need to make an API call.

‎clients/client-iot/src/commands/CreateDomainConfigurationCommand.ts

+5
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,11 @@ export interface CreateDomainConfigurationCommandOutput extends CreateDomainConf
6060
* serverCertificateConfig: { // ServerCertificateConfig
6161
* enableOCSPCheck: true || false,
6262
* },
63+
* authenticationType: "CUSTOM_AUTH_X509" || "CUSTOM_AUTH" || "AWS_X509" || "AWS_SIGV4" || "DEFAULT",
64+
* applicationProtocol: "SECURE_MQTT" || "MQTT_WSS" || "HTTPS" || "DEFAULT",
65+
* clientCertificateConfig: { // ClientCertificateConfig
66+
* clientCertificateCallbackArn: "STRING_VALUE",
67+
* },
6368
* };
6469
* const command = new CreateDomainConfigurationCommand(input);
6570
* const response = await client.send(command);

‎clients/client-iot/src/commands/CreateRoleAliasCommand.ts

+8
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,14 @@ export interface CreateRoleAliasCommandOutput extends CreateRoleAliasResponse, _
3030
/**
3131
* <p>Creates a role alias.</p>
3232
* <p>Requires permission to access the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions">CreateRoleAlias</a> action.</p>
33+
* <important>
34+
* <p>The value of <a href="https://docs.aws.amazon.com/iot/latest/apireference/API_CreateRoleAlias.html#iot-CreateRoleAlias-request-credentialDurationSeconds">
35+
* <code>credentialDurationSeconds</code>
36+
* </a> must be less than or equal to the maximum session
37+
* duration of the IAM role that the role alias references. For more information, see
38+
* <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-managingrole-editing-api.html#roles-modify_max-session-duration-api">
39+
* Modifying a role maximum session duration (Amazon Web Services API)</a> from the Amazon Web Services Identity and Access Management User Guide.</p>
40+
* </important>
3341
* @example
3442
* Use a bare-bones client and the command you need to make an API call.
3543
* ```javascript

‎clients/client-iot/src/commands/CreateThingTypeCommand.ts

+4-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,10 @@ export interface CreateThingTypeCommandInput extends CreateThingTypeRequest {}
2828
export interface CreateThingTypeCommandOutput extends CreateThingTypeResponse, __MetadataBearer {}
2929

3030
/**
31-
* <p>Creates a new thing type.</p>
31+
* <p>Creates a new thing type. If this call is made multiple times using
32+
* the same thing type name and configuration, the call will succeed. If this call is made with
33+
* the same thing type name but different configuration a <code>ResourceAlreadyExistsException</code> is thrown.
34+
* </p>
3235
* <p>Requires permission to access the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions">CreateThingType</a> action.</p>
3336
* @example
3437
* Use a bare-bones client and the command you need to make an API call.

‎clients/client-iot/src/commands/DeleteBillingGroupCommand.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import { MetadataBearer as __MetadataBearer } from "@smithy/types";
66

77
import { commonParams } from "../endpoint/EndpointParameters";
88
import { IoTClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../IoTClient";
9-
import { DeleteBillingGroupRequest, DeleteBillingGroupResponse } from "../models/models_0";
9+
import { DeleteBillingGroupRequest, DeleteBillingGroupResponse } from "../models/models_1";
1010
import { de_DeleteBillingGroupCommand, se_DeleteBillingGroupCommand } from "../protocols/Aws_restJson1";
1111

1212
/**

‎clients/client-iot/src/commands/DescribeDomainConfigurationCommand.ts

+5
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,11 @@ export interface DescribeDomainConfigurationCommandOutput
7171
* // serverCertificateConfig: { // ServerCertificateConfig
7272
* // enableOCSPCheck: true || false,
7373
* // },
74+
* // authenticationType: "CUSTOM_AUTH_X509" || "CUSTOM_AUTH" || "AWS_X509" || "AWS_SIGV4" || "DEFAULT",
75+
* // applicationProtocol: "SECURE_MQTT" || "MQTT_WSS" || "HTTPS" || "DEFAULT",
76+
* // clientCertificateConfig: { // ClientCertificateConfig
77+
* // clientCertificateCallbackArn: "STRING_VALUE",
78+
* // },
7479
* // };
7580
*
7681
* ```

‎clients/client-iot/src/commands/DisassociateSbomFromPackageVersionCommand.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ export interface DisassociateSbomFromPackageVersionCommandOutput
3636
__MetadataBearer {}
3737

3838
/**
39-
* <p>Disassociates a software bill of materials (SBOM) from a specific software package version.</p>
39+
* <p>Disassociates the selected software bill of materials (SBOM) from a specific software package version.</p>
4040
* <p>Requires permission to access the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions">DisassociateSbomWithPackageVersion</a> action.</p>
4141
* @example
4242
* Use a bare-bones client and the command you need to make an API call.

‎clients/client-iot/src/commands/ListManagedJobTemplatesCommand.ts

+2-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@ import { MetadataBearer as __MetadataBearer } from "@smithy/types";
66

77
import { commonParams } from "../endpoint/EndpointParameters";
88
import { IoTClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../IoTClient";
9-
import { ListManagedJobTemplatesRequest, ListManagedJobTemplatesResponse } from "../models/models_1";
9+
import { ListManagedJobTemplatesRequest } from "../models/models_1";
10+
import { ListManagedJobTemplatesResponse } from "../models/models_2";
1011
import { de_ListManagedJobTemplatesCommand, se_ListManagedJobTemplatesCommand } from "../protocols/Aws_restJson1";
1112

1213
/**

‎clients/client-iot/src/commands/ListMetricValuesCommand.ts

+1-2
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@ import { MetadataBearer as __MetadataBearer } from "@smithy/types";
66

77
import { commonParams } from "../endpoint/EndpointParameters";
88
import { IoTClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../IoTClient";
9-
import { ListMetricValuesRequest } from "../models/models_1";
10-
import { ListMetricValuesResponse } from "../models/models_2";
9+
import { ListMetricValuesRequest, ListMetricValuesResponse } from "../models/models_2";
1110
import { de_ListMetricValuesCommand, se_ListMetricValuesCommand } from "../protocols/Aws_restJson1";
1211

1312
/**

‎clients/client-iot/src/commands/UpdateDomainConfigurationCommand.ts

+5
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ export interface UpdateDomainConfigurationCommandOutput extends UpdateDomainConf
5151
* serverCertificateConfig: { // ServerCertificateConfig
5252
* enableOCSPCheck: true || false,
5353
* },
54+
* authenticationType: "CUSTOM_AUTH_X509" || "CUSTOM_AUTH" || "AWS_X509" || "AWS_SIGV4" || "DEFAULT",
55+
* applicationProtocol: "SECURE_MQTT" || "MQTT_WSS" || "HTTPS" || "DEFAULT",
56+
* clientCertificateConfig: { // ClientCertificateConfig
57+
* clientCertificateCallbackArn: "STRING_VALUE",
58+
* },
5459
* };
5560
* const command = new UpdateDomainConfigurationCommand(input);
5661
* const response = await client.send(command);

‎clients/client-iot/src/commands/UpdateRoleAliasCommand.ts

+8
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,14 @@ export interface UpdateRoleAliasCommandOutput extends UpdateRoleAliasResponse, _
3030
/**
3131
* <p>Updates a role alias.</p>
3232
* <p>Requires permission to access the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions">UpdateRoleAlias</a> action.</p>
33+
* <important>
34+
* <p>The value of <a href="https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateRoleAlias.html#iot-UpdateRoleAlias-request-credentialDurationSeconds">
35+
* <code>credentialDurationSeconds</code>
36+
* </a> must be less than or equal to the
37+
* maximum session duration of the IAM role that the role alias references. For more
38+
* information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-managingrole-editing-api.html#roles-modify_max-session-duration-api"> Modifying a role maximum session duration (Amazon Web Services API)</a> from the Amazon Web Services
39+
* Identity and Access Management User Guide.</p>
40+
* </important>
3341
* @example
3442
* Use a bare-bones client and the command you need to make an API call.
3543
* ```javascript

‎clients/client-iot/src/models/models_0.ts

+127-52
Original file line numberDiff line numberDiff line change
@@ -2301,6 +2301,22 @@ export interface Allowed {
23012301
policies?: Policy[];
23022302
}
23032303

2304+
/**
2305+
* @public
2306+
* @enum
2307+
*/
2308+
export const ApplicationProtocol = {
2309+
DEFAULT: "DEFAULT",
2310+
HTTPS: "HTTPS",
2311+
MQTT_WSS: "MQTT_WSS",
2312+
SECURE_MQTT: "SECURE_MQTT",
2313+
} as const;
2314+
2315+
/**
2316+
* @public
2317+
*/
2318+
export type ApplicationProtocol = (typeof ApplicationProtocol)[keyof typeof ApplicationProtocol];
2319+
23042320
/**
23052321
* <p>The S3 location.</p>
23062322
* @public
@@ -2326,7 +2342,7 @@ export interface S3Location {
23262342
}
23272343

23282344
/**
2329-
* <p>The Amazon S3 location for the software bill of materials associated with a software
2345+
* <p>A specific software bill of matrerials associated with a software
23302346
* package version.</p>
23312347
* @public
23322348
*/
@@ -2355,7 +2371,7 @@ export interface AssociateSbomWithPackageVersionRequest {
23552371
versionName: string | undefined;
23562372

23572373
/**
2358-
* <p>The Amazon S3 location for the software bill of materials associated with a software
2374+
* <p>A specific software bill of matrerials associated with a software
23592375
* package version.</p>
23602376
* @public
23612377
*/
@@ -2400,14 +2416,14 @@ export interface AssociateSbomWithPackageVersionResponse {
24002416
versionName?: string;
24012417

24022418
/**
2403-
* <p>The Amazon S3 location for the software bill of materials associated with a software
2419+
* <p>A specific software bill of matrerials associated with a software
24042420
* package version.</p>
24052421
* @public
24062422
*/
24072423
sbom?: Sbom;
24082424

24092425
/**
2410-
* <p>The status of the initial validation for the SBOM against the Software Package Data Exchange (SPDX) and CycloneDX industry standard format.</p>
2426+
* <p>The status of the initial validation for the software bill of materials against the Software Package Data Exchange (SPDX) and CycloneDX industry standard formats.</p>
24112427
* @public
24122428
*/
24132429
sbomValidationStatus?: SbomValidationStatus;
@@ -3414,6 +3430,23 @@ export const AuthDecision = {
34143430
*/
34153431
export type AuthDecision = (typeof AuthDecision)[keyof typeof AuthDecision];
34163432

3433+
/**
3434+
* @public
3435+
* @enum
3436+
*/
3437+
export const AuthenticationType = {
3438+
AWS_SIGV4: "AWS_SIGV4",
3439+
AWS_X509: "AWS_X509",
3440+
CUSTOM_AUTH: "CUSTOM_AUTH",
3441+
CUSTOM_AUTH_X509: "CUSTOM_AUTH_X509",
3442+
DEFAULT: "DEFAULT",
3443+
} as const;
3444+
3445+
/**
3446+
* @public
3447+
*/
3448+
export type AuthenticationType = (typeof AuthenticationType)[keyof typeof AuthenticationType];
3449+
34173450
/**
34183451
* <p>A collection of authorization information.</p>
34193452
* @public
@@ -4448,6 +4481,18 @@ export class CertificateValidationException extends __BaseException {
44484481
}
44494482
}
44504483

4484+
/**
4485+
* <p>An object that specifies the client certificate configuration for a domain.</p>
4486+
* @public
4487+
*/
4488+
export interface ClientCertificateConfig {
4489+
/**
4490+
* <p>The ARN of the Lambda function that IoT invokes after mutual TLS authentication during the connection.</p>
4491+
* @public
4492+
*/
4493+
clientCertificateCallbackArn?: string;
4494+
}
4495+
44514496
/**
44524497
* <p>The server certificate configuration.</p>
44534498
* @public
@@ -4561,6 +4606,82 @@ export interface CreateDomainConfigurationRequest {
45614606
* @public
45624607
*/
45634608
serverCertificateConfig?: ServerCertificateConfig;
4609+
4610+
/**
4611+
* <p>An enumerated string that specifies the authentication type.</p>
4612+
* <ul>
4613+
* <li>
4614+
* <p>
4615+
* <code>CUSTOM_AUTH_X509</code> - Use custom authentication and authorization with additional details from the X.509 client certificate.</p>
4616+
* </li>
4617+
* </ul>
4618+
* <ul>
4619+
* <li>
4620+
* <p>
4621+
* <code>CUSTOM_AUTH</code> - Use custom authentication and authorization. For more
4622+
* information, see <a href="https://docs.aws.amazon.com/iot/latest/developerguide/custom-authentication.html">Custom authentication and authorization</a>.</p>
4623+
* </li>
4624+
* </ul>
4625+
* <ul>
4626+
* <li>
4627+
* <p>
4628+
* <code>AWS_X509</code> - Use X.509 client certificates without custom authentication and authorization. For more information,
4629+
* see <a href="https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html">X.509 client certificates</a>.</p>
4630+
* </li>
4631+
* </ul>
4632+
* <ul>
4633+
* <li>
4634+
* <p>
4635+
* <code>AWS_SIGV4</code> - Use Amazon Web Services Signature Version 4. For more information, see <a href="https://docs.aws.amazon.com/iot/latest/developerguide/custom-authentication.html">IAM users, groups, and roles</a>.</p>
4636+
* </li>
4637+
* </ul>
4638+
* <ul>
4639+
* <li>
4640+
* <p>
4641+
* <code>DEFAULT</code> - Use a combination of port and Application Layer Protocol Negotiation (ALPN) to specify authentication type.
4642+
* For more information, see <a href="https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html">Device communication protocols</a>.</p>
4643+
* </li>
4644+
* </ul>
4645+
* @public
4646+
*/
4647+
authenticationType?: AuthenticationType;
4648+
4649+
/**
4650+
* <p>An enumerated string that specifies the application-layer protocol.</p>
4651+
* <ul>
4652+
* <li>
4653+
* <p>
4654+
* <code>SECURE_MQTT</code> - MQTT over TLS.</p>
4655+
* </li>
4656+
* </ul>
4657+
* <ul>
4658+
* <li>
4659+
* <p>
4660+
* <code>MQTT_WSS</code> - MQTT over WebSocket.</p>
4661+
* </li>
4662+
* </ul>
4663+
* <ul>
4664+
* <li>
4665+
* <p>
4666+
* <code>HTTPS</code> - HTTP over TLS.</p>
4667+
* </li>
4668+
* </ul>
4669+
* <ul>
4670+
* <li>
4671+
* <p>
4672+
* <code>DEFAULT</code> - Use a combination of port and Application Layer Protocol Negotiation (ALPN) to specify application_layer protocol.
4673+
* For more information, see <a href="https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html">Device communication protocols</a>.</p>
4674+
* </li>
4675+
* </ul>
4676+
* @public
4677+
*/
4678+
applicationProtocol?: ApplicationProtocol;
4679+
4680+
/**
4681+
* <p>An object that specifies the client certificate configuration for a domain.</p>
4682+
* @public
4683+
*/
4684+
clientCertificateConfig?: ClientCertificateConfig;
45644685
}
45654686

45664687
/**
@@ -6300,8 +6421,7 @@ export interface CreatePackageResponse {
63006421
}
63016422

63026423
/**
6303-
* <p>The Amazon S3 location for the artifacts associated with a software package
6304-
* version.</p>
6424+
* <p>A specific package version artifact associated with a software package version.</p>
63056425
* @public
63066426
*/
63076427
export interface PackageVersionArtifact {
@@ -6350,7 +6470,7 @@ export interface CreatePackageVersionRequest {
63506470

63516471
/**
63526472
* <p>The inline job document associated with a software package version used for a quick job
6353-
* deployment via IoT Jobs.</p>
6473+
* deployment.</p>
63546474
* @public
63556475
*/
63566476
recipe?: string;
@@ -7710,51 +7830,6 @@ export class DeleteConflictException extends __BaseException {
77107830
}
77117831
}
77127832

7713-
/**
7714-
* @public
7715-
*/
7716-
export interface DeleteBillingGroupRequest {
7717-
/**
7718-
* <p>The name of the billing group.</p>
7719-
* @public
7720-
*/
7721-
billingGroupName: string | undefined;
7722-
7723-
/**
7724-
* <p>The expected version of the billing group. If the version of the billing group does
7725-
* not match the expected version specified in the request, the
7726-
* <code>DeleteBillingGroup</code> request is rejected with a
7727-
* <code>VersionConflictException</code>.</p>
7728-
* @public
7729-
*/
7730-
expectedVersion?: number;
7731-
}
7732-
7733-
/**
7734-
* @public
7735-
*/
7736-
export interface DeleteBillingGroupResponse {}
7737-
7738-
/**
7739-
* <p>The certificate operation is not allowed.</p>
7740-
* @public
7741-
*/
7742-
export class CertificateStateException extends __BaseException {
7743-
readonly name: "CertificateStateException" = "CertificateStateException";
7744-
readonly $fault: "client" = "client";
7745-
/**
7746-
* @internal
7747-
*/
7748-
constructor(opts: __ExceptionOptionType<CertificateStateException, __BaseException>) {
7749-
super({
7750-
name: "CertificateStateException",
7751-
$fault: "client",
7752-
...opts,
7753-
});
7754-
Object.setPrototypeOf(this, CertificateStateException.prototype);
7755-
}
7756-
}
7757-
77587833
/**
77597834
* @internal
77607835
*/

0 commit comments

Comments
 (0)