get_credentials_for_identity ¶

def get_credentials_for_identity(
    self,
    identity_id: "capo_cognito_identity.types.identity_id.IdentityId",
    *,
    config_overrides: Optional[CognitoIdentityClientConfig] = None,
    logins: Optional["capo_cognito_identity.types.logins_map.LoginsMap"] = None,
    custom_role_arn: Optional[
        "capo_cognito_identity.types.arn_string.ARNString"
    ] = None,
) -> "capo_cognito_identity.types.get_credentials_for_identity_response.GetCredentialsForIdentityResponse":
    """<p>Returns credentials for the provided identity ID. Any provided logins will be validated against supported login providers. If the token is for <code>cognito-identity.amazonaws.com</code>, it will be passed through to Security Token Service with the appropriate role for the token.</p> <p>This is a public API. You do not need any credentials to call this API.</p>

    Args:
        identity_id: <p>A unique identifier in the format REGION:GUID.</p>
        logins: <p>A set of optional name-value pairs that map provider names to provider tokens. The name-value pair will follow the syntax "provider_name": "provider_user_identifier".</p> <p>Logins should not be specified when trying to get credentials for an unauthenticated identity.</p> <p>The Logins parameter is required when using identities associated with external identity providers such as Facebook. For examples of <code>Logins</code> maps, see the code examples in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/external-identity-providers.html">External Identity Providers</a> section of the Amazon Cognito Developer Guide.</p>
        custom_role_arn: <p>The Amazon Resource Name (ARN) of the role to be assumed when multiple roles were received in the token from the identity provider. For example, a SAML-based identity provider. This parameter is optional for identity providers that do not support role customization.</p>

    Raises:
        capo_cognito_identity.errors.external_service_exception.ExternalServiceException: <p>An exception thrown when a dependent service such as Facebook or Twitter is not responding</p>
        capo_cognito_identity.errors.internal_error_exception.InternalErrorException: <p>Thrown when the service encounters an error during processing the request.</p>
        capo_cognito_identity.errors.invalid_identity_pool_configuration_exception.InvalidIdentityPoolConfigurationException: <p>If you provided authentication information in the request, the identity pool has no authenticated role configured, or STS returned an error response to the request to assume the authenticated role from the identity pool. If you provided no authentication information in the request, the identity pool has no unauthenticated role configured, or STS returned an error response to the request to assume the unauthenticated role from the identity pool.</p> <p>Your role trust policy must grant <code>AssumeRoleWithWebIdentity</code> permissions to <code>cognito-identity.amazonaws.com</code>.</p>
        capo_cognito_identity.errors.invalid_parameter_exception.InvalidParameterException: <p>Thrown for missing or bad input parameter(s).</p>
        capo_cognito_identity.errors.not_authorized_exception.NotAuthorizedException: <p>Thrown when a user is not authorized to access the requested resource.</p>
        capo_cognito_identity.errors.resource_conflict_exception.ResourceConflictException: <p>Thrown when a user tries to use a login which is already linked to another account.</p>
        capo_cognito_identity.errors.resource_not_found_exception.ResourceNotFoundException: <p>Thrown when the requested resource (for example, a dataset or record) does not exist.</p>
        capo_cognito_identity.errors.too_many_requests_exception.TooManyRequestsException: <p>Thrown when a request is throttled.</p>
        capo_cognito_identity.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_cognito_identity.types.get_credentials_for_identity_input.GetCredentialsForIdentityInput]",
    ) -> OperationResponse[
        "capo_cognito_identity.types.get_credentials_for_identity_response.GetCredentialsForIdentityResponse"
    ]:
        import capo_cognito_identity._operations.aws_cognito_identity_service.get_credentials_for_identity

        output, http_response = (
            capo_cognito_identity._operations.aws_cognito_identity_service.get_credentials_for_identity.get_credentials_for_identity(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_cognito_identity.types.get_credentials_for_identity_input.GetCredentialsForIdentityInput",
    ) -> dict[str, Any]:
        import capo_cognito_identity.types.get_credentials_for_identity_input

        return capo_cognito_identity.types.get_credentials_for_identity_input.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_cognito_identity.types.get_credentials_for_identity_response.GetCredentialsForIdentityResponse",
    ) -> dict[str, Any]:
        import capo_cognito_identity.types.get_credentials_for_identity_response

        return capo_cognito_identity.types.get_credentials_for_identity_response.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "GetCredentialsForIdentity",
            redact_input=_redact_input,
            redact_output=_redact_output,
        ),
    )
    input_: capo_cognito_identity.types.get_credentials_for_identity_input.GetCredentialsForIdentityInput = {
        "identity_id": identity_id
    }
    if logins is not None:
        input_["logins"] = logins
    if custom_role_arn is not None:
        input_["custom_role_arn"] = custom_role_arn

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output