sts

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 33 Imported by: 0

README

STS

Parity grade: B · SDK aws-sdk-go-v2/service/sts@v1.44.0 · last audited 2026-07-11 (eb94f3c3)

Coverage

Metric Value
Operations audited 11 (11 ok)
Feature families 1 (1 ok)
Known gaps 1
Deferred items 2
Resource leaks clean
Known gaps
  • JWTPayloadSizeExceededException, OutboundWebIdentityFederationDisabledException, SessionDurationEscalationException are real error types in aws-sdk-go-v2/service/sts/types but the SDK ships no doc comment describing their trigger thresholds/semantics beyond the type name; the emulator does not currently model any of the three (no JWT-tag-payload size cap, no account-level web-identity-federation-disabled flag, no explicit escalation-attempt detection beyond the existing silent 1h role-chain clamp). Not fixed this pass — no reliable spec to implement against without further doc research. (bd: gopherstack-p05, follow-up)
Deferred
  • SESSION-POLICY EVALUATION: session Policy/PolicyArns are validated for shape/size (MalformedPolicyDocument, PackedPolicyTooLarge) and PackedPolicySize is computed, but the policy document's content is not enforced against subsequent API calls (no IAM policy-evaluation engine wired to session credentials). This mirrors the rest of the emulator's authz model and is out of scope for a service-local sts audit.
  • GetWebIdentityToken Tags payload-size cap (JWTPayloadSizeExceededException) — see gaps above.

More

Documentation

Index

Constants

View Source 
const (
	// STSNamespace is the XML namespace for STS wire responses.
	STSNamespace = "https://sts.amazonaws.com/doc/2011-06-15/"

	// MockAccountID is the default mock AWS account ID returned by GetCallerIdentity.
	MockAccountID = config.DefaultAccountID

	// MockUserID is the fixed user ID returned by GetCallerIdentity.
	MockUserID = "AKIAIOSFODNN7EXAMPLE" //nolint:gosec // well-known AWS example key, not real credentials

	// MockUserArn is the default ARN returned by GetCallerIdentity.
	MockUserArn = "arn:aws:iam::" + config.DefaultAccountID + ":root"

	// DefaultDurationSeconds is the default credential lifetime (1 hour).
	DefaultDurationSeconds = 3600

	// MinDurationSeconds is the minimum allowed credential lifetime.
	MinDurationSeconds = 900

	// MaxDurationSeconds is the maximum allowed credential lifetime for AssumeRole (12 hours).
	MaxDurationSeconds = 43200

	// DefaultSessionTokenDurationSeconds is the default lifetime for GetSessionToken (12 hours).
	DefaultSessionTokenDurationSeconds = 43200

	// MinSessionTokenDurationSeconds is the minimum allowed lifetime (15 minutes).
	MinSessionTokenDurationSeconds = 900

	// MaxSessionTokenDurationSeconds is the maximum allowed lifetime for GetSessionToken (36 hours for IAM users).
	MaxSessionTokenDurationSeconds = 129600

	// MaxTagCount is the maximum number of session tags allowed per AssumeRole call.
	MaxTagCount = 50

	// MaxFederationTokenDurationSeconds is the maximum allowed lifetime for GetFederationToken (36 hours).
	MaxFederationTokenDurationSeconds = 129600

	// MaxRootDurationSeconds is the maximum allowed lifetime for AssumeRoot (15 minutes).
	MaxRootDurationSeconds = 900

	// MaxRoleChainDurationSeconds is the AWS cap on session duration when the caller
	// uses temporary credentials (role chaining). AWS enforces 1 hour regardless of
	// the target role's MaxSessionDuration.
	MaxRoleChainDurationSeconds = 3600

	// DefaultWebIdentityTokenDurationSeconds is the default lifetime for GetWebIdentityToken (5 minutes).
	DefaultWebIdentityTokenDurationSeconds = 300

	// MinWebIdentityTokenDurationSeconds is the minimum allowed lifetime for GetWebIdentityToken (1 minute).
	MinWebIdentityTokenDurationSeconds = 60

	// MaxWebIdentityTokenDurationSeconds is the maximum allowed lifetime for GetWebIdentityToken (1 hour).
	MaxWebIdentityTokenDurationSeconds = 3600

	// MaxAudienceCount is the maximum number of audience entries for GetWebIdentityToken.
	MaxAudienceCount = 10

	// MinRoleSessionNameLen is the minimum allowed session name length per AWS.
	MinRoleSessionNameLen = 2

	// MaxRoleSessionNameLen is the maximum allowed session name length per AWS.
	MaxRoleSessionNameLen = 64

	// MaxFederationTokenNameLen is the maximum allowed federation token name length per AWS.
	MaxFederationTokenNameLen = 32

	// MinFederationTokenNameLen is the minimum allowed federation token name length per AWS.
	MinFederationTokenNameLen = 2

	// MaxPolicyArnsCount is the maximum number of managed policy ARNs allowed per operation.
	MaxPolicyArnsCount = 10

	// MaxProvidedContextsCount is the maximum number of provided contexts per operation.
	MaxProvidedContextsCount = 5

	// MaxTagKeyLen is the maximum allowed length for a session tag key.
	MaxTagKeyLen = 128

	// MaxTagValueLen is the maximum allowed length for a session tag value.
	MaxTagValueLen = 256

	// MinTagKeyLen is the minimum allowed length for a session tag key.
	MinTagKeyLen = 1

	// MinSourceIdentityLen is the minimum allowed length for SourceIdentity.
	MinSourceIdentityLen = 2

	// MaxSourceIdentityLen is the maximum allowed length for SourceIdentity.
	MaxSourceIdentityLen = 64

	// MaxProvidedContextLen is the maximum allowed length for a ProvidedContext assertion or ARN.
	MaxProvidedContextLen = 2048

	// MFATokenCodeLen is the required length for MFA token codes.
	MFATokenCodeLen = 6
)

Variables

View Source 
var (
	// ErrMFACodeRequired is returned when SerialNumber is supplied without a TokenCode.
	ErrMFACodeRequired = errors.New("TokenCode is required when SerialNumber is provided")

	// ErrTooManyTags is returned when the number of session tags exceeds MaxTagCount.
	ErrTooManyTags = errors.New("too many session tags: maximum is 50")

	// ErrTooManyAudiences is returned when the audience list exceeds MaxAudienceCount.
	ErrTooManyAudiences = errors.New("too many audience entries: maximum is 10")

	// ErrMissingRoleArn is returned when AssumeRole is called without a RoleArn.
	ErrMissingRoleArn = errors.New("RoleArn is required")

	// ErrMissingSessionName is returned when AssumeRole is called without a RoleSessionName.
	ErrMissingSessionName = errors.New("RoleSessionName is required")

	// ErrInvalidDuration is returned when DurationSeconds is out of the allowed range.
	ErrInvalidDuration = errors.New("DurationSeconds is out of the allowed range")

	// ErrAccessDenied is returned when ExternalId validation fails.
	ErrAccessDenied = errors.New("AccessDenied")

	// ErrMissingFederationTokenName is returned when GetFederationToken is called without a Name.
	ErrMissingFederationTokenName = errors.New("Name is required for GetFederationToken")

	// ErrMissingWebIdentityToken is returned when AssumeRoleWithWebIdentity is called without a WebIdentityToken.
	ErrMissingWebIdentityToken = errors.New(
		"WebIdentityToken is required for AssumeRoleWithWebIdentity",
	)

	// ErrMissingSAMLAssertion is returned when AssumeRoleWithSAML is called without a SAMLAssertion.
	ErrMissingSAMLAssertion = errors.New("SAMLAssertion is required for AssumeRoleWithSAML")

	// ErrMissingPrincipalArn is returned when AssumeRoleWithSAML is called without a PrincipalArn.
	ErrMissingPrincipalArn = errors.New("PrincipalArn is required for AssumeRoleWithSAML")

	// ErrMissingTargetPrincipal is returned when AssumeRoot is called without a TargetPrincipal.
	ErrMissingTargetPrincipal = errors.New("TargetPrincipal is required for AssumeRoot")

	// ErrMissingTaskPolicyArn is returned when AssumeRoot is called without a TaskPolicyArn.
	ErrMissingTaskPolicyArn = errors.New("TaskPolicyArn is required for AssumeRoot")

	// ErrMissingTradeInToken is returned when GetDelegatedAccessToken is called without a TradeInToken.
	ErrMissingTradeInToken = errors.New("TradeInToken is required for GetDelegatedAccessToken")

	// ErrMissingAudience is returned when GetWebIdentityToken is called without an Audience.
	ErrMissingAudience = errors.New("audience list is required for GetWebIdentityToken")

	// ErrMissingSigningAlgorithm is returned when GetWebIdentityToken is called without a SigningAlgorithm.
	ErrMissingSigningAlgorithm = errors.New("SigningAlgorithm is required for GetWebIdentityToken")

	// ErrSessionNotFound is returned when a session lookup by access key ID yields no result.
	ErrSessionNotFound = errors.New("session not found")

	// ErrInvalidSessionName is returned when the session name does not meet AWS length requirements.
	ErrInvalidSessionName = errors.New("session name must be 2-64 characters")

	// ErrInvalidFederationName is returned when the federation token name does not meet AWS length requirements.
	ErrInvalidFederationName = errors.New("federation token name must be 2-32 characters")

	// ErrMissingEncodedMessage is returned when DecodeAuthorizationMessage is called without an EncodedMessage.
	ErrMissingEncodedMessage = errors.New(
		"EncodedMessage is required for DecodeAuthorizationMessage",
	)

	// ErrEmptyAccessKeyID is returned when GetAccessKeyInfo is called with an empty AccessKeyId.
	ErrEmptyAccessKeyID = errors.New("AccessKeyId must not be empty")

	// ErrUnknownAccessKeyID is returned when GetAccessKeyInfo cannot find the given key ID.
	ErrUnknownAccessKeyID = errors.New("unknown access key ID")

	// ErrValidation is returned when a parameter value fails semantic validation.
	ErrValidation = errors.New("invalid parameter value")

	// ErrInvalidRoleArn is returned when the RoleArn is not a valid ARN.
	ErrInvalidRoleArn = errors.New("RoleArn is not a valid ARN")

	// ErrSessionExpired is returned when a session credential is presented after its expiry.
	ErrSessionExpired = errors.New("session token has expired")

	// ErrMalformedPolicyDocument is returned when an inline policy is not valid JSON.
	ErrMalformedPolicyDocument = errors.New("malformed policy document")

	// ErrPackedPolicyTooLarge is returned when the combined session policy exceeds the 2048-byte budget.
	ErrPackedPolicyTooLarge = errors.New("packed policy too large")

	// ErrExpiredToken is returned when a web-identity JWT has expired.
	ErrExpiredToken = errors.New("token has expired")

	// ErrExpiredTradeInToken is returned when GetDelegatedAccessToken's TradeInToken
	// has passed its "exp" claim (maps to the real AWS ExpiredTradeInTokenException).
	ErrExpiredTradeInToken = errors.New("trade-in token has expired")

	// ErrInvalidIdentityToken is returned when a web-identity JWT is structurally invalid or its claims are wrong.
	ErrInvalidIdentityToken = errors.New("invalid identity token")

	// ErrIDPRejectedClaim is returned when the identity provider rejects the claim.
	ErrIDPRejectedClaim = errors.New("IDP rejected claim")

	// ErrInvalidAuthorizationMessage is returned when DecodeAuthorizationMessage receives a non-STS-issued blob.
	ErrInvalidAuthorizationMessage = errors.New("invalid authorization message")

	// ErrInvalidSAMLAssertion is returned when AssumeRoleWithSAML receives a SAMLAssertion
	// that is not valid base64 or does not decode to XML.
	ErrInvalidSAMLAssertion = errors.New("SAMLAssertion must be a base64-encoded XML document")

	// ErrTooManyPolicyArns is returned when more than MaxPolicyArnsCount policy ARNs are supplied.
	ErrTooManyPolicyArns = errors.New("too many policy ARNs: maximum is 10")

	// ErrInvalidSourceIdentity is returned when SourceIdentity fails regex or length validation.
	ErrInvalidSourceIdentity = errors.New("invalid SourceIdentity value")

	// ErrInvalidMFASerialNumber is returned when SerialNumber does not match the expected ARN shape.
	ErrInvalidMFASerialNumber = errors.New("invalid MFA serial number format")

	// ErrInvalidMFATokenCode is returned when TokenCode is not exactly 6 digits.
	ErrInvalidMFATokenCode = errors.New("TokenCode must be exactly 6 digits")

	// ErrInvalidTagKey is returned when a session tag key fails length or charset validation.
	ErrInvalidTagKey = errors.New("invalid session tag key")

	// ErrInvalidTagValue is returned when a session tag value exceeds the allowed length.
	ErrInvalidTagValue = errors.New("invalid session tag value")

	// ErrInvalidPolicyArn is returned when a policy ARN fails shape validation.
	ErrInvalidPolicyArn = errors.New("invalid policy ARN")

	// ErrInvalidProvidedContext is returned when a ProvidedContext entry exceeds length limits.
	ErrInvalidProvidedContext = errors.New("invalid provided context")

	// ErrInvalidTargetPrincipal is returned when AssumeRoot TargetPrincipal is not a 12-digit account ID.
	ErrInvalidTargetPrincipal = errors.New("TargetPrincipal must be a 12-digit AWS account ID")

	// ErrTokenCodeWithoutSerial is returned when a TokenCode is supplied without a SerialNumber.
	ErrTokenCodeWithoutSerial = errors.New("SerialNumber is required when TokenCode is provided")

	// ErrInvalidPrincipalArn is returned when AssumeRoleWithSAML PrincipalArn is not a valid SAML provider ARN.
	ErrInvalidPrincipalArn = errors.New("PrincipalArn is not a valid SAML provider ARN")

	// ErrMissingAction is returned when the Action field is absent from the request.
	ErrMissingAction = errors.New("action is required")

	// ErrInvalidAction is returned when the Action is not a supported STS operation.
	ErrInvalidAction = errors.New("invalid action")

	// ErrNilAppContext is returned when Init is called with a nil AppContext.
	ErrNilAppContext = errors.New("sts: nil app context")
)

Functions

This section is empty.

Types

type AssumeRoleInput 

type AssumeRoleInput struct {
	CallerSession     *SessionInfo
	RoleArn           string
	RoleSessionName   string
	ExternalID        string
	Policy            string
	SourceIdentity    string
	CallerAccessKeyID string
	// CallerArn is the resolved ARN of the calling principal (e.g. an assumed-role
	// ARN during role chaining). When set, the target role's trust policy is
	// evaluated against it; when empty, trust-policy Principal evaluation is
	// skipped (the emulator only enforces constraints it can positively determine).
	CallerArn         string
	Tags              []Tag
	TransitiveTagKeys []string
	PolicyArns        []string
	ProvidedContexts  []ProvidedContext
	DurationSeconds   int32
}

AssumeRoleInput holds the parameters for an AssumeRole call.

type AssumeRoleResponse 

type AssumeRoleResponse struct {
	XMLName          xml.Name         `xml:"AssumeRoleResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	AssumeRoleResult AssumeRoleResult `xml:"AssumeRoleResult"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AssumeRoleResponse is the top-level XML envelope returned by AssumeRole.

type AssumeRoleResult 

type AssumeRoleResult struct {
	AssumedRoleUser AssumedRoleUser `xml:"AssumedRoleUser"`
	Credentials     Credentials     `xml:"Credentials"`
	// SourceIdentity is the source identity set when the role was assumed.
	SourceIdentity string `xml:"SourceIdentity,omitempty"`
	// PackedPolicySize is the percentage of session policy size used (informational).
	PackedPolicySize int32 `xml:"PackedPolicySize,omitempty"`
}

AssumeRoleResult wraps the assumed-role user and credentials.

type AssumeRoleWithSAMLInput 

type AssumeRoleWithSAMLInput struct {
	RoleArn         string
	PrincipalArn    string
	SAMLAssertion   string
	Policy          string
	RoleSessionName string
	SourceIdentity  string
	PolicyArns      []string
	Tags            []Tag
	DurationSeconds int32
}

AssumeRoleWithSAMLInput holds the parameters for an AssumeRoleWithSAML call.

type AssumeRoleWithSAMLResponse 

type AssumeRoleWithSAMLResponse struct {
	XMLName                  xml.Name                 `xml:"AssumeRoleWithSAMLResponse"`
	Xmlns                    string                   `xml:"xmlns,attr"`
	AssumeRoleWithSAMLResult AssumeRoleWithSAMLResult `xml:"AssumeRoleWithSAMLResult"`
	ResponseMetadata         ResponseMetadata         `xml:"ResponseMetadata"`
}

AssumeRoleWithSAMLResponse is the top-level XML envelope returned by AssumeRoleWithSAML.

type AssumeRoleWithSAMLResult 

type AssumeRoleWithSAMLResult struct {
	AssumedRoleUser  AssumedRoleUser `xml:"AssumedRoleUser"`
	Credentials      Credentials     `xml:"Credentials"`
	Audience         string          `xml:"Audience,omitempty"`
	Issuer           string          `xml:"Issuer,omitempty"`
	NameQualifier    string          `xml:"NameQualifier,omitempty"`
	Subject          string          `xml:"Subject,omitempty"`
	SubjectType      string          `xml:"SubjectType,omitempty"`
	SourceIdentity   string          `xml:"SourceIdentity,omitempty"`
	PackedPolicySize int32           `xml:"PackedPolicySize,omitempty"`
}

AssumeRoleWithSAMLResult wraps the assumed-role user, credentials, and SAML provider details.

type AssumeRoleWithWebIdentityInput 

type AssumeRoleWithWebIdentityInput struct {
	RoleArn          string
	RoleSessionName  string
	WebIdentityToken string
	ProviderID       string
	Policy           string
	SourceIdentity   string
	Tags             []Tag
	PolicyArns       []string
	DurationSeconds  int32
}

AssumeRoleWithWebIdentityInput holds the parameters for an AssumeRoleWithWebIdentity call.

type AssumeRoleWithWebIdentityResponse 

type AssumeRoleWithWebIdentityResponse struct {
	XMLName                         xml.Name                        `xml:"AssumeRoleWithWebIdentityResponse"`
	Xmlns                           string                          `xml:"xmlns,attr"`
	AssumeRoleWithWebIdentityResult AssumeRoleWithWebIdentityResult `xml:"AssumeRoleWithWebIdentityResult"`
	ResponseMetadata                ResponseMetadata                `xml:"ResponseMetadata"`
}

AssumeRoleWithWebIdentityResponse is the top-level XML envelope returned by AssumeRoleWithWebIdentity.

type AssumeRoleWithWebIdentityResult 

type AssumeRoleWithWebIdentityResult struct {
	AssumedRoleUser             AssumedRoleUser `xml:"AssumedRoleUser"`
	Credentials                 Credentials     `xml:"Credentials"`
	SubjectFromWebIdentityToken string          `xml:"SubjectFromWebIdentityToken,omitempty"`
	Audience                    string          `xml:"Audience,omitempty"`
	Provider                    string          `xml:"Provider,omitempty"`
	SourceIdentity              string          `xml:"SourceIdentity,omitempty"`
	PackedPolicySize            int32           `xml:"PackedPolicySize,omitempty"`
}

AssumeRoleWithWebIdentityResult wraps the assumed-role user, credentials, and OIDC provider details.

type AssumeRootInput 

type AssumeRootInput struct {
	TargetPrincipal string
	TaskPolicyArn   string
	DurationSeconds int32
}

AssumeRootInput holds the parameters for an AssumeRoot call.

type AssumeRootResponse 

type AssumeRootResponse struct {
	XMLName          xml.Name         `xml:"AssumeRootResponse"`
	Xmlns            string           `xml:"xmlns,attr"`
	AssumeRootResult AssumeRootResult `xml:"AssumeRootResult"`
	ResponseMetadata ResponseMetadata `xml:"ResponseMetadata"`
}

AssumeRootResponse is the top-level XML envelope returned by AssumeRoot.

type AssumeRootResult 

type AssumeRootResult struct {
	Credentials    Credentials `xml:"Credentials"`
	SourceIdentity string      `xml:"SourceIdentity,omitempty"`
}

AssumeRootResult wraps the credentials returned by AssumeRoot.

type AssumedRoleUser 

type AssumedRoleUser struct {
	Arn           string `xml:"Arn"`
	AssumedRoleID string `xml:"AssumedRoleId"`
}

AssumedRoleUser contains the ARN and ID of the resulting assumed-role principal.

type ConfigProvider 

type ConfigProvider interface {
	GetSTSSettings() Settings
}

ConfigProvider is a private interface to extract STS configuration from the abstract AppContext Config.

type Credentials 

type Credentials struct {
	AccessKeyID     string `xml:"AccessKeyId"`
	SecretAccessKey string `xml:"SecretAccessKey"`
	SessionToken    string `xml:"SessionToken"`
	Expiration      string `xml:"Expiration"`
}

Credentials holds a set of temporary AWS security credentials.

type DecodeAuthorizationMessageResponse 

type DecodeAuthorizationMessageResponse struct {
	XMLName                          xml.Name                         `xml:"DecodeAuthorizationMessageResponse"`
	Xmlns                            string                           `xml:"xmlns,attr"`
	DecodeAuthorizationMessageResult DecodeAuthorizationMessageResult `xml:"DecodeAuthorizationMessageResult"`
	ResponseMetadata                 ResponseMetadata                 `xml:"ResponseMetadata"`
}

DecodeAuthorizationMessageResponse is the top-level XML envelope returned by DecodeAuthorizationMessage.

type DecodeAuthorizationMessageResult 

type DecodeAuthorizationMessageResult struct {
	DecodedMessage string `xml:"DecodedMessage"`
}

DecodeAuthorizationMessageResult carries the decoded message.

type ErrorDetail 

type ErrorDetail struct {
	Type    string `xml:"Type"`
	Code    string `xml:"Code"`
	Message string `xml:"Message"`
}

ErrorDetail carries the STS error code and message.

type ErrorResponse 

type ErrorResponse struct {
	XMLName   xml.Name    `xml:"ErrorResponse"`
	Xmlns     string      `xml:"xmlns,attr"`
	Error     ErrorDetail `xml:"Error"`
	RequestID string      `xml:"RequestId"`
}

ErrorResponse is the XML error envelope returned on failed STS operations.

type FederatedUser 

type FederatedUser struct {
	Arn             string `xml:"Arn"`
	FederatedUserID string `xml:"FederatedUserId"`
}

FederatedUser contains the ARN and ID of the resulting federated-user principal.

type GetAccessKeyInfoResponse 

type GetAccessKeyInfoResponse struct {
	XMLName                xml.Name               `xml:"GetAccessKeyInfoResponse"`
	Xmlns                  string                 `xml:"xmlns,attr"`
	GetAccessKeyInfoResult GetAccessKeyInfoResult `xml:"GetAccessKeyInfoResult"`
	ResponseMetadata       ResponseMetadata       `xml:"ResponseMetadata"`
}

GetAccessKeyInfoResponse is the top-level XML envelope returned by GetAccessKeyInfo.

type GetAccessKeyInfoResult 

type GetAccessKeyInfoResult struct {
	Account string `xml:"Account"`
}

GetAccessKeyInfoResult carries the account for the given access key.

type GetCallerIdentityResponse 

type GetCallerIdentityResponse struct {
	XMLName                 xml.Name                `xml:"GetCallerIdentityResponse"`
	Xmlns                   string                  `xml:"xmlns,attr"`
	GetCallerIdentityResult GetCallerIdentityResult `xml:"GetCallerIdentityResult"`
	ResponseMetadata        ResponseMetadata        `xml:"ResponseMetadata"`
}

GetCallerIdentityResponse is the top-level XML envelope returned by GetCallerIdentity.

type GetCallerIdentityResult 

type GetCallerIdentityResult struct {
	Account string `xml:"Account"`
	Arn     string `xml:"Arn"`
	UserID  string `xml:"UserId"`
}

GetCallerIdentityResult carries the caller's account, ARN, and user-ID.

type GetDelegatedAccessTokenInput 

type GetDelegatedAccessTokenInput struct {
	TradeInToken    string
	DurationSeconds int32
}

GetDelegatedAccessTokenInput holds the parameters for a GetDelegatedAccessToken call.

type GetDelegatedAccessTokenResponse 

type GetDelegatedAccessTokenResponse struct {
	XMLName                       xml.Name                      `xml:"GetDelegatedAccessTokenResponse"`
	Xmlns                         string                        `xml:"xmlns,attr"`
	GetDelegatedAccessTokenResult GetDelegatedAccessTokenResult `xml:"GetDelegatedAccessTokenResult"`
	ResponseMetadata              ResponseMetadata              `xml:"ResponseMetadata"`
}

GetDelegatedAccessTokenResponse is the top-level XML envelope returned by GetDelegatedAccessToken.

type GetDelegatedAccessTokenResult 

type GetDelegatedAccessTokenResult struct {
	AssumedPrincipal string      `xml:"AssumedPrincipal,omitempty"`
	Credentials      Credentials `xml:"Credentials"`
	PackedPolicySize int32       `xml:"PackedPolicySize,omitempty"`
}

GetDelegatedAccessTokenResult wraps the principal and credentials returned by GetDelegatedAccessToken.

type GetFederationTokenInput 

type GetFederationTokenInput struct {
	Name            string
	Policy          string
	Tags            []Tag
	PolicyArns      []string
	DurationSeconds int32
}

GetFederationTokenInput holds the parameters for a GetFederationToken call.

type GetFederationTokenResponse 

type GetFederationTokenResponse struct {
	XMLName                  xml.Name                 `xml:"GetFederationTokenResponse"`
	Xmlns                    string                   `xml:"xmlns,attr"`
	GetFederationTokenResult GetFederationTokenResult `xml:"GetFederationTokenResult"`
	ResponseMetadata         ResponseMetadata         `xml:"ResponseMetadata"`
}

GetFederationTokenResponse is the top-level XML envelope returned by GetFederationToken.

type GetFederationTokenResult 

type GetFederationTokenResult struct {
	FederatedUser    FederatedUser `xml:"FederatedUser"`
	Credentials      Credentials   `xml:"Credentials"`
	PackedPolicySize int32         `xml:"PackedPolicySize,omitempty"`
}

GetFederationTokenResult wraps the federated user and credentials.

type GetSessionTokenInput 

type GetSessionTokenInput struct {
	SerialNumber    string
	TokenCode       string
	DurationSeconds int32
}

GetSessionTokenInput holds the parameters for a GetSessionToken call.

type GetSessionTokenResponse 

type GetSessionTokenResponse struct {
	XMLName               xml.Name              `xml:"GetSessionTokenResponse"`
	Xmlns                 string                `xml:"xmlns,attr"`
	GetSessionTokenResult GetSessionTokenResult `xml:"GetSessionTokenResult"`
	ResponseMetadata      ResponseMetadata      `xml:"ResponseMetadata"`
}

GetSessionTokenResponse is the top-level XML envelope returned by GetSessionToken.

type GetSessionTokenResult 

type GetSessionTokenResult struct {
	Credentials Credentials `xml:"Credentials"`
}

GetSessionTokenResult wraps the credentials.

type GetWebIdentityTokenInput 

type GetWebIdentityTokenInput struct {
	SigningAlgorithm string
	Audience         []string
	Tags             []Tag
	DurationSeconds  int32
}

GetWebIdentityTokenInput holds the parameters for a GetWebIdentityToken call.

type GetWebIdentityTokenResponse 

type GetWebIdentityTokenResponse struct {
	XMLName                   xml.Name                  `xml:"GetWebIdentityTokenResponse"`
	Xmlns                     string                    `xml:"xmlns,attr"`
	GetWebIdentityTokenResult GetWebIdentityTokenResult `xml:"GetWebIdentityTokenResult"`
	ResponseMetadata          ResponseMetadata          `xml:"ResponseMetadata"`
}

GetWebIdentityTokenResponse is the top-level XML envelope returned by GetWebIdentityToken.

type GetWebIdentityTokenResult 

type GetWebIdentityTokenResult struct {
	WebIdentityToken string `xml:"WebIdentityToken"`
	Expiration       string `xml:"Expiration"`
}

GetWebIdentityTokenResult wraps the token and expiration returned by GetWebIdentityToken.

type Handler 

type Handler struct {
	Backend StorageBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for STS operations.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new STS handler with the given backend.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this STS instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation reads the Action parameter from the request body.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the RoleArn for AssumeRole calls, empty otherwise.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported STS operations. GetDelegatedAccessToken and GetWebIdentityToken are real actions present in aws-sdk-go-v2/service/sts (api_op_GetDelegatedAccessToken.go and api_op_GetWebIdentityToken.go); both are included here and are routed by dispatch.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for STS operations.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority for the STS handler.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state from the backend. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a matcher that identifies STS requests by Content-Type and Version. Dashboard paths are excluded so that browser form submissions (Playwright tests) are not intercepted by the STS handler.

func (*Handler) SessionMetrics 

func (h *Handler) SessionMetrics() SessionMetrics

SessionMetrics returns STS session and janitor sweep counters.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker starts the background janitor if it is configured.

func (*Handler) WithJanitor 

func (h *Handler) WithJanitor(interval time.Duration, taskTimeout ...time.Duration) *Handler

WithJanitor attaches a background janitor to the handler. The janitor periodically evicts expired sessions. interval=0 uses the default. The optional taskTimeout bounds each sweep; 0 means no per-task timeout.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is a stateful in-memory STS backend.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend with the default account ID.

func NewInMemoryBackendWithConfig 

func NewInMemoryBackendWithConfig(accountID string) *InMemoryBackend

NewInMemoryBackendWithConfig creates a new InMemoryBackend with the given account ID.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID configured for this backend.

func (*InMemoryBackend) AssumeRole 

func (b *InMemoryBackend) AssumeRole(input *AssumeRoleInput) (*AssumeRoleResponse, error)

AssumeRole generates temporary credentials for the given role.

func (*InMemoryBackend) AssumeRoleWithSAML 

func (b *InMemoryBackend) AssumeRoleWithSAML(
	input *AssumeRoleWithSAMLInput,
) (*AssumeRoleWithSAMLResponse, error)

AssumeRoleWithSAML generates temporary credentials using a SAML 2.0 assertion. In this mock, the SAMLAssertion is not cryptographically validated.

func (*InMemoryBackend) AssumeRoleWithWebIdentity 

func (b *InMemoryBackend) AssumeRoleWithWebIdentity(
	input *AssumeRoleWithWebIdentityInput,
) (*AssumeRoleWithWebIdentityResponse, error)

func (*InMemoryBackend) AssumeRoot 

func (b *InMemoryBackend) AssumeRoot(input *AssumeRootInput) (*AssumeRootResponse, error)

AssumeRoot generates short-term privileged credentials for a member account root. TaskPolicyArn must be in the AWS-approved set; TargetPrincipal must be a 12-digit account ID.

func (*InMemoryBackend) GetCallerIdentity 

func (b *InMemoryBackend) GetCallerIdentity(
	accessKeyID, sessionToken string,
) (*GetCallerIdentityResponse, error)

GetCallerIdentity returns the mock caller identity. When accessKeyID corresponds to an assumed-role session, returns the assumed-role ARN and user ID. When sessionToken is non-empty (ASIA-prefixed key), the stored token must match; a mismatch returns ErrUnknownAccessKeyID mapped to HTTP 400 InvalidClientTokenId (matching AWS).

func (*InMemoryBackend) GetDelegatedAccessToken 

func (b *InMemoryBackend) GetDelegatedAccessToken(
	input *GetDelegatedAccessTokenInput,
) (*GetDelegatedAccessTokenResponse, error)

GetDelegatedAccessToken exchanges a trade-in token for temporary AWS credentials. The TradeInToken's cryptographic signature is not verified (the external issuer's keys are unavailable to the emulator), but a JWT-shaped token's self-consistent "exp" claim is checked so an already-expired token is rejected with ErrExpiredTradeInToken (AWS ExpiredTradeInTokenException), matching real STS behaviour instead of accepting any non-empty string indefinitely.

func (*InMemoryBackend) GetFederationToken 

func (b *InMemoryBackend) GetFederationToken(
	input *GetFederationTokenInput,
) (*GetFederationTokenResponse, error)

GetFederationToken generates temporary credentials for a federated user. The federated user ARN has the form arn:aws:sts::ACCOUNT:federated-user/NAME.

func (*InMemoryBackend) GetSessionToken 

func (b *InMemoryBackend) GetSessionToken(
	input *GetSessionTokenInput,
) (*GetSessionTokenResponse, error)

GetSessionToken generates temporary credentials without role assumption.

func (*InMemoryBackend) GetWebIdentityToken 

func (b *InMemoryBackend) GetWebIdentityToken(
	input *GetWebIdentityTokenInput,
) (*GetWebIdentityTokenResponse, error)

GetWebIdentityToken returns a signed JWT representing the caller's AWS identity. In this mock, the token is an unsigned JWT containing the caller's account and audience.

func (*InMemoryBackend) IssueEncodedAuthorizationMessage 

func (b *InMemoryBackend) IssueEncodedAuthorizationMessage(decodedMsg string) string

IssueEncodedAuthorizationMessage encodes plaintext as an HMAC-signed opaque blob that DecodeAuthorizationMessage can later verify. This mirrors the AWS STS behaviour where only messages issued by the service itself can be decoded — arbitrary base64 blobs are rejected with InvalidAuthorizationMessageException.

Format (base64-encoded): HMAC-SHA256(key, plaintext) | plaintext.

func (*InMemoryBackend) LookupSession 

func (b *InMemoryBackend) LookupSession(accessKeyID, sessionToken string) *SessionInfo

LookupSession returns the active SessionInfo for the given access key and optional session token, or nil if no matching non-expired session exists or the token mismatches.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region for this STS backend (STS is global, defaults to us-east-1).

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all in-memory state from the backend. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development. Operation counters and totalSessionsCreated are also reset to zero.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. Expired sessions are discarded on load. It implements persistence.Persistable.

func (*InMemoryBackend) SessionCounts 

func (b *InMemoryBackend) SessionCounts() (int, int)

SessionCounts returns active and expired session counts at the time of invocation.

func (*InMemoryBackend) SetOIDCLookup 

func (b *InMemoryBackend) SetOIDCLookup(ol OIDCLookup)

SetOIDCLookup wires an optional OIDC-lookup implementation (e.g. the IAM backend) so that AssumeRoleWithWebIdentity can validate that the OIDC provider exists.

func (*InMemoryBackend) SetRoleLookup 

func (b *InMemoryBackend) SetRoleLookup(rl RoleLookup)

SetRoleLookup wires an optional role-lookup implementation (e.g. the IAM backend) so that AssumeRole can validate ExternalId and enforce MaxSessionDuration.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) ValidateSessionCredential 

func (b *InMemoryBackend) ValidateSessionCredential(
	accessKeyID, sessionToken string,
) (*SessionInfo, error)

ValidateSessionCredential looks up a session by (accessKeyID, sessionToken). Returns ErrSessionNotFound when the key is unknown, ErrAccessDenied on token mismatch, and ErrSessionExpired when the session has passed its expiry.

func (*InMemoryBackend) VerifyEncodedAuthorizationMessage 

func (b *InMemoryBackend) VerifyEncodedAuthorizationMessage(encoded string) (string, error)

VerifyEncodedAuthorizationMessage decodes an opaque message issued by IssueEncodedAuthorizationMessage. Returns ErrInvalidAuthorizationMessage when the message was not issued by this backend instance (wrong HMAC, bad base64, or truncated payload).

type Janitor 

type Janitor struct {
	Backend     *InMemoryBackend
	Interval    time.Duration
	TaskTimeout time.Duration
	// contains filtered or unexported fields
}

Janitor is the STS background worker that evicts expired sessions to prevent unbounded growth of the sessions map under sustained load.

func NewJanitor 

func NewJanitor(backend *InMemoryBackend, interval time.Duration) *Janitor

NewJanitor creates a new STS Janitor for the given backend. If interval is zero it falls back to defaultSTSJanitorInterval.

func (*Janitor) Metrics 

func (j *Janitor) Metrics() JanitorMetrics

Metrics returns cumulative janitor sweep counters.

func (*Janitor) Run 

func (j *Janitor) Run(ctx context.Context)

Run runs the janitor loop until ctx is cancelled.

func (*Janitor) SweepOnce 

func (j *Janitor) SweepOnce(ctx context.Context)

SweepOnce runs a single sweep pass. Exposed for testing.

type JanitorMetrics 

type JanitorMetrics struct {
	SweepCount       int64
	ExpiredEvictions int64
}

JanitorMetrics provides janitor sweep counters.

type OIDCLookup 

type OIDCLookup interface {
	// OIDCProviderExists returns true if an OIDC provider with the given issuer URL exists.
	OIDCProviderExists(issuerURL string) bool
}

OIDCLookup is implemented by services (e.g. IAM) that can validate OIDC providers for AssumeRoleWithWebIdentity.

type ProvidedContext 

type ProvidedContext struct {
	ProviderArn      string
	ContextAssertion string
}

ProvidedContext carries a federated identity context assertion.

type Provider 

type Provider struct{}

Provider implements service.Provider for the STS service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initialises the STS backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the logical name of the provider.

type ResponseMetadata 

type ResponseMetadata struct {
	RequestID string `xml:"RequestId"`
}

ResponseMetadata carries the per-request identifier.

type RoleLookup 

type RoleLookup interface {
	GetRoleByArn(arn string) (*RoleMeta, error)
}

RoleLookup is implemented by services (e.g. IAM) that can provide role metadata to STS for ExternalId validation and MaxSessionDuration enforcement.

type RoleMeta 

type RoleMeta struct {
	// TrustPolicy is the raw JSON of the role's trust (assume-role) policy document.
	TrustPolicy string
	// MaxSessionDuration is the maximum session duration (in seconds) for this role.
	// A value of 0 means the system default maximum (MaxDurationSeconds) applies.
	MaxSessionDuration int32
}

RoleMeta carries the role properties that STS needs during AssumeRole.

type SessionInfo 

type SessionInfo struct {
	// Expiration is the time at which this session expires and should be evicted.
	Expiration     time.Time `json:"expiration"`
	AssumedRoleArn string    `json:"assumed_role_arn"`
	AccountID      string    `json:"account_id"`
	SessionName    string    `json:"session_name"`
	AccessKeyID    string    `json:"access_key_id"`
	// SecretAccessKey is the secret key for this session, stored for in-process SigV4 validation.
	SecretAccessKey string `json:"secret_access_key,omitempty"`
	// SessionToken is the session token for this credential set, used to match X-Amz-Security-Token.
	SessionToken string `json:"session_token,omitempty"`
	// AssumedRoleID is the AROA-prefixed role ID + session name (e.g. "AROATESTROLEID:session").
	// It is the value returned by GetCallerIdentity as the UserId for assumed-role credentials.
	AssumedRoleID     string   `json:"assumed_role_id"`
	SourceIdentity    string   `json:"source_identity,omitempty"`
	Tags              []Tag    `json:"tags,omitempty"`
	TransitiveTagKeys []string `json:"transitive_tag_keys,omitempty"`
}

SessionInfo stores metadata about an issued assumed-role session for GetCallerIdentity lookups.

type SessionMetrics 

type SessionMetrics struct {
	ActiveSessions         int   `json:"activeSessions"`
	ExpiredSessions        int   `json:"expiredSessions"`
	SweepCount             int64 `json:"sweepCount"`
	ExpiredEvictions       int64 `json:"expiredEvictions"`
	TotalSessionsCreated   int64 `json:"totalSessionsCreated"`
	OpsAssumeRole          int64 `json:"opsAssumeRole"`
	OpsAssumeRoleWithSAML  int64 `json:"opsAssumeRoleWithSAML"`
	OpsAssumeRoleWithWI    int64 `json:"opsAssumeRoleWithWebIdentity"`
	OpsAssumeRoot          int64 `json:"opsAssumeRoot"`
	OpsGetCallerIdentity   int64 `json:"opsGetCallerIdentity"`
	OpsGetFederationToken  int64 `json:"opsGetFederationToken"`
	OpsGetSessionToken     int64 `json:"opsGetSessionToken"`
	OpsGetWebIdentityToken int64 `json:"opsGetWebIdentityToken"`
	OpsGetAccessKeyInfo    int64 `json:"opsGetAccessKeyInfo"`
	OpsDecodeAuthMessage   int64 `json:"opsDecodeAuthorizationMessage"`
	OpsGetDelegatedToken   int64 `json:"opsGetDelegatedAccessToken"`
}

SessionMetrics represents STS session and janitor sweep metrics for dashboard views.

type Settings 

type Settings struct {
	JanitorInterval time.Duration `json:"janitor_interval" env:"STS_JANITOR_INTERVAL" default:"30s" help:"Janitor tick interval."` //nolint:lll // Kong struct tag makes this line long
}

Settings holds service-level configuration for the STS backend. Fields are picked up by the Kong CLI parser when this struct is embedded in the root CLI command.

type StorageBackend 

type StorageBackend interface {
	AssumeRole(input *AssumeRoleInput) (*AssumeRoleResponse, error)
	AssumeRoleWithSAML(input *AssumeRoleWithSAMLInput) (*AssumeRoleWithSAMLResponse, error)
	AssumeRoleWithWebIdentity(
		input *AssumeRoleWithWebIdentityInput,
	) (*AssumeRoleWithWebIdentityResponse, error)
	AssumeRoot(input *AssumeRootInput) (*AssumeRootResponse, error)
	// GetCallerIdentity returns the caller's identity. sessionToken is the X-Amz-Security-Token
	// value; an empty string means long-term credentials are in use.
	GetCallerIdentity(accessKeyID, sessionToken string) (*GetCallerIdentityResponse, error)
	GetDelegatedAccessToken(
		input *GetDelegatedAccessTokenInput,
	) (*GetDelegatedAccessTokenResponse, error)
	GetFederationToken(input *GetFederationTokenInput) (*GetFederationTokenResponse, error)
	GetSessionToken(input *GetSessionTokenInput) (*GetSessionTokenResponse, error)
	GetWebIdentityToken(input *GetWebIdentityTokenInput) (*GetWebIdentityTokenResponse, error)
	// ValidateSessionCredential looks up an active session by (accessKeyID, sessionToken) pair.
	// Returns the SessionInfo on match, ErrSessionNotFound when the key is unknown,
	// or ErrAccessDenied when the session token does not match the stored value.
	ValidateSessionCredential(accessKeyID, sessionToken string) (*SessionInfo, error)
	// LookupSession returns the active SessionInfo for the given access key and optional
	// session token, or nil if no matching non-expired session exists.
	LookupSession(accessKeyID, sessionToken string) *SessionInfo
	// IssueEncodedAuthorizationMessage encodes a plaintext message in the STS-proprietary
	// format that VerifyEncodedAuthorizationMessage can later authenticate.
	IssueEncodedAuthorizationMessage(decodedMsg string) string
	// VerifyEncodedAuthorizationMessage authenticates and decodes a message previously
	// issued by IssueEncodedAuthorizationMessage. Returns ErrInvalidAuthorizationMessage
	// when the encoded value was not issued by this backend.
	VerifyEncodedAuthorizationMessage(encoded string) (string, error)
}

StorageBackend defines the STS service backend interface.

type Tag 

type Tag struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

Tag represents a session tag key-value pair passed to AssumeRole.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.