get_web_identity_token ¶

def get_web_identity_token(
    self,
    audience: "capo_sts.types.web_identity_token_audience_list_type.webIdentityTokenAudienceListType",
    signing_algorithm: "capo_sts.types.jwt_algorithm_type.jwtAlgorithmType",
    *,
    config_overrides: Optional[STSClientConfig] = None,
    duration_seconds: Optional[
        "capo_sts.types.web_identity_token_duration_seconds_type.webIdentityTokenDurationSecondsType"
    ] = None,
    tags: Optional["capo_sts.types.tag_list_type.tagListType"] = None,
) -> "capo_sts.types.get_web_identity_token_response.GetWebIdentityTokenResponse":
    """<p>Returns a signed JSON Web Token (JWT) that represents the calling Amazon Web Services identity. The returned JWT can be used to authenticate with external services that support OIDC discovery. The token is signed by Amazon Web Services STS and can be publicly verified using the verification keys published at the issuer's JWKS endpoint.</p> <note> <p>The <code>GetWebIdentityToken</code> API is not available on the STS Global endpoint.</p> </note>

    Args:
        audience: <p>The intended recipient of the web identity token. This value populates the <code>aud</code> claim in the JWT and should identify the service or application that will validate and use the token. The external service should verify this claim to ensure the token was intended for their use.</p>
        duration_seconds: <p>The duration, in seconds, for which the JSON Web Token (JWT) will remain valid. The value can range from 60 seconds (1 minute) to 3600 seconds (1 hour). If not specified, the default duration is 300 seconds (5 minutes). The token is designed to be short-lived and should be used for proof of identity, then exchanged for credentials or short-lived tokens in the external service.</p>
        signing_algorithm: <p>The cryptographic algorithm to use for signing the JSON Web Token (JWT). Valid values are RS256 (RSA with SHA-256) and ES384 (ECDSA using P-384 curve with SHA-384). </p>
        tags: <p>An optional list of tags to include in the JSON Web Token (JWT). These tags are added as custom claims to the JWT and can be used by the downstream service for authorization decisions. </p>

    Raises:
        capo_sts.errors.jwt_payload_size_exceeded_exception.JWTPayloadSizeExceededException: <p>The requested token payload size exceeds the maximum allowed size. Reduce the number of request tags included in the <code>GetWebIdentityToken</code> API call to reduce the token payload size.</p>
        capo_sts.errors.outbound_web_identity_federation_disabled_exception.OutboundWebIdentityFederationDisabledException: <p>The outbound web identity federation feature is not enabled for this account. To use this feature, you must first enable it through the Amazon Web Services Management Console or API.</p>
        capo_sts.errors.session_duration_escalation_exception.SessionDurationEscalationException: <p>The requested token duration would extend the session beyond its original expiration time. You cannot use this operation to extend the lifetime of a session beyond what was granted when the session was originally created.</p>
        capo_sts.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_sts.types.get_web_identity_token_request.GetWebIdentityTokenRequest]",
    ) -> OperationResponse[
        "capo_sts.types.get_web_identity_token_response.GetWebIdentityTokenResponse"
    ]:
        import capo_sts._operations.aws_security_token_service_v20110615.get_web_identity_token

        output, http_response = (
            capo_sts._operations.aws_security_token_service_v20110615.get_web_identity_token.get_web_identity_token(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_output(
        output: "capo_sts.types.get_web_identity_token_response.GetWebIdentityTokenResponse",
    ) -> dict[str, Any]:
        import capo_sts.types.get_web_identity_token_response

        return capo_sts.types.get_web_identity_token_response.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging("GetWebIdentityToken", redact_output=_redact_output),
    )
    input_: capo_sts.types.get_web_identity_token_request.GetWebIdentityTokenRequest = {
        "audience": audience,
        "signing_algorithm": signing_algorithm,
    }
    if duration_seconds is not None:
        input_["duration_seconds"] = duration_seconds
    if tags is not None:
        input_["tags"] = tags

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output