You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* <a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK for iOS Developer Guide</a> and the <a href="http://aws.amazon.com/sdkforandroid/">Amazon Web Services SDK for Android Developer Guide</a> to uniquely
51
51
* identify a user. You can also supply the user with a consistent identity throughout the
52
52
* lifetime of an application.</p>
53
-
* <p>To learn more about Amazon Cognito, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html">Amazon Cognito identity pools</a> in
54
-
* <i>Amazon Cognito Developer Guide</i>.</p>
53
+
* <p>To learn more about Amazon Cognito, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html">Amazon Cognito identity
54
+
* pools</a> in <i>Amazon Cognito Developer Guide</i>.</p>
55
55
* </note>
56
56
* <p>Calling <code>AssumeRoleWithWebIdentity</code> does not require the use of Amazon Web Services
57
57
* security credentials. Therefore, you can distribute an application (for example, on mobile
* <p>When you pass an access key ID to this operation, it returns the ID of the Amazon Web Services account
47
47
* to which the keys belong. Access key IDs beginning with <code>AKIA</code> are long-term
48
-
* credentials for an IAM user or the Amazon Web Services account root user. Access key IDs beginning with
49
-
* <code>ASIA</code> are temporary credentials that are created using STS operations. If
50
-
* the account in the response belongs to you, you can sign in as the root user and review
51
-
* your root user access keys. Then, you can pull a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html">credentials report</a> to
52
-
* learn which IAM user owns the keys. To learn who requested the temporary credentials for
53
-
* an <code>ASIA</code> access key, view the STS events in your <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html">CloudTrail logs</a> in the
54
-
* <i>IAM User Guide</i>.</p>
48
+
* credentials for an IAM user or the Amazon Web Services account root user. Access key IDs
49
+
* beginning with <code>ASIA</code> are temporary credentials that are created using STS
50
+
* operations. If the account in the response belongs to you, you can sign in as the root user and review your root user access keys. Then, you can pull a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html">credentials
51
+
* report</a> to learn which IAM user owns the keys. To learn who
52
+
* requested the temporary credentials for an <code>ASIA</code> access key, view the STS
53
+
* events in your <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html">CloudTrail logs</a> in the <i>IAM User Guide</i>.</p>
55
54
* <p>This operation does not indicate the state of the access key. The key might be active,
56
55
* inactive, or deleted. Active keys might not have permissions to perform an operation.
57
56
* Providing a deleted access key might return an error that the key doesn't exist.</p>
* <p>Returns details about the IAM user or role whose credentials are used to call the operation.</p>
40
+
* <p>Returns details about the IAM user or role whose credentials are used to
41
+
* call the operation.</p>
41
42
* <note>
42
-
* <p>No permissions are required to perform this operation. If an administrator
43
-
* attaches a policy to your identity that explicitly denies access to the
43
+
* <p>No permissions are required to perform this operation. If an administrator attaches a
44
+
* policy to your identity that explicitly denies access to the
44
45
* <code>sts:GetCallerIdentity</code> action, you can still perform this operation.
45
-
* Permissions are not required because the same information is returned when access is denied. To view an example response, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa">I Am Not Authorized to Perform: iam:DeleteVirtualMFADevice</a> in the
46
+
* Permissions are not required because the same information is returned when access is
47
+
* denied. To view an example response, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa">I Am Not Authorized to Perform: iam:DeleteVirtualMFADevice</a> in the
* secret access key, and a security token) for a user. A typical use is in a proxy
46
46
* application that gets temporary security credentials on behalf of distributed applications
47
47
* inside a corporate network.</p>
48
-
* <p>You must call the <code>GetFederationToken</code> operation
49
-
* using the long-term security credentials of an IAM user. As a result, this call is
50
-
* appropriate in contexts where those credentials can be safeguarded, usually in a
51
-
* server-based application. For a comparison of <code>GetFederationToken</code> with the
52
-
* other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting Temporary Security
48
+
* <p>You must call the <code>GetFederationToken</code> operation using the long-term security
49
+
* credentials of an IAM user. As a result, this call is appropriate in
50
+
* contexts where those credentials can be safeguarded, usually in a server-based application.
51
+
* For a comparison of <code>GetFederationToken</code> with the other API operations that
52
+
* produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting Temporary Security
53
53
* Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing the
54
54
* Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.</p>
55
-
* <p>Although it is possible to call <code>GetFederationToken</code> using the security credentials of an
56
-
* Amazon Web Services account root user rather than an IAM user that you create for the purpose of a proxy application, we do not recommend it. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials">Safeguard your root user credentials and don't use them for everyday tasks</a> in the
57
-
* <i>IAM User Guide</i>. </p>
55
+
* <p>Although it is possible to call <code>GetFederationToken</code> using the security
56
+
* credentials of an Amazon Web Services account root user rather than an IAM user that you
57
+
* create for the purpose of a proxy application, we do not recommend it. For more
58
+
* information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials">Safeguard your root user credentials and don't use them for everyday tasks</a> in the
59
+
* <i>IAM User Guide</i>. </p>
58
60
* <note>
59
61
* <p>You can create a mobile-based or browser-based app that can authenticate users using
60
62
* a web identity provider like Login with Amazon, Facebook, Google, or an OpenID
* <p>Though the session policy parameters are optional, if you do not pass a policy, then the
91
95
* resulting federated user session has no permissions. When you pass session policies, the
92
-
* session permissions are the intersection of the IAM user policies and the session
93
-
* policies that you pass. This gives you a way to further restrict the permissions for a
94
-
* federated user. You cannot use session policies to grant more permissions than those that
95
-
* are defined in the permissions policy of the IAM user. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
96
-
* Policies</a> in the <i>IAM User Guide</i>. For information about
97
-
* using <code>GetFederationToken</code> to create temporary security credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken">GetFederationToken—Federation Through a Custom Identity Broker</a>. </p>
96
+
* session permissions are the intersection of the IAM user policies and the
97
+
* session policies that you pass. This gives you a way to further restrict the permissions
98
+
* for a federated user. You cannot use session policies to grant more permissions than those
99
+
* that are defined in the permissions policy of the IAM user. For more
100
+
* information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
101
+
* the <i>IAM User Guide</i>. For information about using
102
+
* <code>GetFederationToken</code> to create temporary security credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken">GetFederationToken—Federation Through a Custom Identity Broker</a>. </p>
98
103
* <p>You can use the credentials to access a resource that has a resource-based policy. If
99
104
* that policy specifically references the federated user session in the
100
105
* <code>Principal</code> element of the policy, the session has the permissions allowed by
* <p>Returns a set of temporary credentials for an Amazon Web Services account or IAM user. The
45
-
* credentials consist of an access key ID, a secret access key, and a security token.
44
+
* <p>Returns a set of temporary credentials for an Amazon Web Services account or IAM user.
45
+
* The credentials consist of an access key ID, a secret access key, and a security token.
46
46
* Typically, you use <code>GetSessionToken</code> if you want to use MFA to protect
47
-
* programmatic calls to specific Amazon Web Services API operations like Amazon EC2 <code>StopInstances</code>.</p>
48
-
* <p>MFA-enabled IAM users must call <code>GetSessionToken</code> and submit an MFA
49
-
* code that is associated with their MFA device. Using the temporary security credentials
50
-
* that the call returns, IAM users can then make programmatic calls to API
51
-
* operations that require MFA authentication. An incorrect MFA code causes the API to return an access denied error. For a comparison of <code>GetSessionToken</code>
52
-
* with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
47
+
* programmatic calls to specific Amazon Web Services API operations like Amazon EC2
48
+
* <code>StopInstances</code>.</p>
49
+
* <p>MFA-enabled IAM users must call <code>GetSessionToken</code> and submit
50
+
* an MFA code that is associated with their MFA device. Using the temporary security
51
+
* credentials that the call returns, IAM users can then make programmatic
52
+
* calls to API operations that require MFA authentication. An incorrect MFA code causes the
53
+
* API to return an access denied error. For a comparison of <code>GetSessionToken</code> with
54
+
* the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
53
55
* Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing the
54
56
* Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.</p>
* <code>AssumeRole</code> or <code>GetCallerIdentity</code>.</p>
84
85
* </li>
85
86
* </ul>
86
-
* <p>The credentials that <code>GetSessionToken</code> returns are based on
87
-
* permissions associated with the IAM user whose credentials were used to call the operation. The
88
-
* temporary credentials have the same permissions as the IAM user.</p>
87
+
* <p>The credentials that <code>GetSessionToken</code> returns are based on permissions
88
+
* associated with the IAM user whose credentials were used to call the
89
+
* operation. The temporary credentials have the same permissions as the IAM user.</p>
89
90
* <note>
90
-
* <p>Although it is possible to call <code>GetSessionToken</code> using the security credentials of an
91
-
* Amazon Web Services account root user rather than an IAM user, we do not recommend it. If
92
-
* <code>GetSessionToken</code> is called using root user credentials, the
93
-
* temporary credentials have root user permissions. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials">Safeguard your root user credentials and don't use them for everyday tasks</a> in the
94
-
* <i>IAM User Guide</i>
91
+
* <p>Although it is possible to call <code>GetSessionToken</code> using the security
92
+
* credentials of an Amazon Web Services account root user rather than an IAM user, we do
93
+
* not recommend it. If <code>GetSessionToken</code> is called using root user
94
+
* credentials, the temporary credentials have root user permissions. For more
95
+
* information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials">Safeguard your root user credentials and don't use them for everyday tasks</a> in the
96
+
* <i>IAM User Guide</i>
95
97
* </p>
96
98
* </note>
97
99
* <p>For more information about using <code>GetSessionToken</code> to create temporary
0 commit comments