Network.AWS.STS.GetSessionToken

Returns a set of temporary credentials for an AWS account or IAM user. The credentials consist of an access key ID, a secret access key, and a security token. Typically, you use GetSessionToken if you want to use MFA to protect programmatic calls to specific AWS APIs like Amazon EC2 StopInstances. MFA-enabled IAM users would need to call GetSessionToken and submit an MFA code that is associated with their MFA device. Using the temporary security credentials that are returned from the call, IAM users can then make programmatic calls to APIs that require MFA authentication. If you do not supply a correct MFA code, then the API returns an access denied error. For a comparison of GetSessionToken with the other APIs that produce temporary credentials, see Requesting Temporary Security Credentials and Comparing the AWS STS APIs in the IAM User Guide.

The GetSessionToken action must be called by using the long-term AWS security credentials of the AWS account or an IAM user. Credentials that are created by IAM users are valid for the duration that you specify, from 900 seconds (15 minutes) up to a maximum of 129600 seconds (36 hours), with a default of 43200 seconds (12 hours); credentials that are created by using account credentials can range from 900 seconds (15 minutes) up to a maximum of 3600 seconds (1 hour), with a default of 1 hour.

The temporary security credentials created by GetSessionToken can be used to make API calls to any AWS service with the following exceptions:

• You cannot call any IAM APIs unless MFA authentication information is included in the request.
• You cannot call any STS API except AssumeRole.

We recommend that you do not call GetSessionToken with root account credentials. Instead, follow our best practices by creating one or more IAM users, giving them the necessary permissions, and using IAM users for everyday interaction with AWS.

The permissions associated with the temporary security credentials returned by GetSessionToken are based on the permissions associated with account or IAM user whose credentials are used to call the action. If GetSessionToken is called using root account credentials, the temporary credentials have root account permissions. Similarly, if GetSessionToken is called using the credentials of an IAM user, the temporary credentials have the same permissions as the IAM user.

For more information about using GetSessionToken to create temporary credentials, go to Temporary Credentials for Users in Untrusted Environments in the IAM User Guide.

Creating a Request

getSessionToken :: GetSessionToken

Creates a value of GetSessionToken with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• gstTokenCode
• gstDurationSeconds
• gstSerialNumber

data GetSessionToken

See: getSessionToken smart constructor.

Instances

Eq GetSessionToken

Methods

(==) :: GetSessionToken -> GetSessionToken -> Bool

(/=) :: GetSessionToken -> GetSessionToken -> Bool

Data GetSessionToken

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> GetSessionToken -> c GetSessionToken

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c GetSessionToken

toConstr :: GetSessionToken -> Constr

dataTypeOf :: GetSessionToken -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c GetSessionToken)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c GetSessionToken)

gmapT :: (forall b. Data b => b -> b) -> GetSessionToken -> GetSessionToken

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> GetSessionToken -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> GetSessionToken -> r

gmapQ :: (forall d. Data d => d -> u) -> GetSessionToken -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> GetSessionToken -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> GetSessionToken -> m GetSessionToken

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> GetSessionToken -> m GetSessionToken

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> GetSessionToken -> m GetSessionToken

Read GetSessionToken

Methods

readsPrec :: Int -> ReadS GetSessionToken

readList :: ReadS [GetSessionToken]

readPrec :: ReadPrec GetSessionToken

readListPrec :: ReadPrec [GetSessionToken]

Show GetSessionToken

Methods

showsPrec :: Int -> GetSessionToken -> ShowS

show :: GetSessionToken -> String

showList :: [GetSessionToken] -> ShowS

Generic GetSessionToken

Associated Types

type Rep GetSessionToken :: * -> *

Methods

from :: GetSessionToken -> Rep GetSessionToken x

to :: Rep GetSessionToken x -> GetSessionToken

Hashable GetSessionToken

Methods

hashWithSalt :: Int -> GetSessionToken -> Int

hash :: GetSessionToken -> Int

NFData GetSessionToken

Methods

rnf :: GetSessionToken -> ()

AWSRequest GetSessionToken

Associated Types

type Rs GetSessionToken :: *

Methods

request :: GetSessionToken -> Request GetSessionToken

response :: MonadResource m => Logger -> Service -> Proxy * GetSessionToken -> ClientResponse -> m (Response GetSessionToken)

ToQuery GetSessionToken

Methods

toQuery :: GetSessionToken -> QueryString

ToPath GetSessionToken

Methods

toPath :: GetSessionToken -> ByteString

ToHeaders GetSessionToken

Methods

toHeaders :: GetSessionToken -> [Header]

type Rep GetSessionToken

type Rep GetSessionToken = D1 (MetaData "GetSessionToken" "Network.AWS.STS.GetSessionToken" "amazonka-sts-1.4.2-y05eCKElbULJ1YtnEI4D4" False) (C1 (MetaCons "GetSessionToken'" PrefixI True) ((:*:) (S1 (MetaSel (Just Symbol "_gstTokenCode") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text))) ((:*:) (S1 (MetaSel (Just Symbol "_gstDurationSeconds") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Nat))) (S1 (MetaSel (Just Symbol "_gstSerialNumber") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text))))))

type Rs GetSessionToken

type Rs GetSessionToken = GetSessionTokenResponse

Request Lenses

gstTokenCode :: Lens' GetSessionToken (Maybe Text)

The value provided by the MFA device, if MFA is required. If any policy requires the IAM user to submit an MFA code, specify this value. If MFA authentication is required, and the user does not provide a code when requesting a set of temporary security credentials, the user will receive an "access denied" response when requesting resources that require MFA authentication.

The format for this parameter, as described by its regex pattern, is a sequence of six numeric digits.

gstDurationSeconds :: Lens' GetSessionToken (Maybe Natural)

The duration, in seconds, that the credentials should remain valid. Acceptable durations for IAM user sessions range from 900 seconds (15 minutes) to 129600 seconds (36 hours), with 43200 seconds (12 hours) as the default. Sessions for AWS account owners are restricted to a maximum of 3600 seconds (one hour). If the duration is longer than one hour, the session for AWS account owners defaults to one hour.

gstSerialNumber :: Lens' GetSessionToken (Maybe Text)

The identification number of the MFA device that is associated with the IAM user who is making the GetSessionToken call. Specify this value if the IAM user has a policy that requires MFA authentication. The value is either the serial number for a hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device (such as 'arn:aws:iam::123456789012:mfa\/user'). You can find the device for an IAM user by going to the AWS Management Console and viewing the user's security credentials.

The format for this parameter, as described by its regex pattern, is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include any of the following characters: =,.'-

Destructuring the Response

getSessionTokenResponse

Arguments

:: Int

gstrsResponseStatus

-> GetSessionTokenResponse

Creates a value of GetSessionTokenResponse with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• gstrsCredentials
• gstrsResponseStatus

data GetSessionTokenResponse

Contains the response to a successful GetSessionToken request, including temporary AWS credentials that can be used to make AWS requests.

See: getSessionTokenResponse smart constructor.

Instances

Eq GetSessionTokenResponse

Methods

(==) :: GetSessionTokenResponse -> GetSessionTokenResponse -> Bool

(/=) :: GetSessionTokenResponse -> GetSessionTokenResponse -> Bool

Data GetSessionTokenResponse

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> GetSessionTokenResponse -> c GetSessionTokenResponse

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c GetSessionTokenResponse

toConstr :: GetSessionTokenResponse -> Constr

dataTypeOf :: GetSessionTokenResponse -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c GetSessionTokenResponse)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c GetSessionTokenResponse)

gmapT :: (forall b. Data b => b -> b) -> GetSessionTokenResponse -> GetSessionTokenResponse

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> GetSessionTokenResponse -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> GetSessionTokenResponse -> r

gmapQ :: (forall d. Data d => d -> u) -> GetSessionTokenResponse -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> GetSessionTokenResponse -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> GetSessionTokenResponse -> m GetSessionTokenResponse

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> GetSessionTokenResponse -> m GetSessionTokenResponse

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> GetSessionTokenResponse -> m GetSessionTokenResponse

Read GetSessionTokenResponse

Methods

readsPrec :: Int -> ReadS GetSessionTokenResponse

readList :: ReadS [GetSessionTokenResponse]

readPrec :: ReadPrec GetSessionTokenResponse

readListPrec :: ReadPrec [GetSessionTokenResponse]

Show GetSessionTokenResponse

Methods

showsPrec :: Int -> GetSessionTokenResponse -> ShowS

show :: GetSessionTokenResponse -> String

showList :: [GetSessionTokenResponse] -> ShowS

Generic GetSessionTokenResponse

Associated Types

type Rep GetSessionTokenResponse :: * -> *

Methods

from :: GetSessionTokenResponse -> Rep GetSessionTokenResponse x

to :: Rep GetSessionTokenResponse x -> GetSessionTokenResponse

NFData GetSessionTokenResponse

Methods

rnf :: GetSessionTokenResponse -> ()

type Rep GetSessionTokenResponse

type Rep GetSessionTokenResponse = D1 (MetaData "GetSessionTokenResponse" "Network.AWS.STS.GetSessionToken" "amazonka-sts-1.4.2-y05eCKElbULJ1YtnEI4D4" False) (C1 (MetaCons "GetSessionTokenResponse'" PrefixI True) ((:*:) (S1 (MetaSel (Just Symbol "_gstrsCredentials") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Credentials))) (S1 (MetaSel (Just Symbol "_gstrsResponseStatus") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Int))))

Response Lenses

gstrsCredentials :: Lens' GetSessionTokenResponse (Maybe Credentials)

The temporary security credentials, which include an access key ID, a secret access key, and a security (or session) token.

Note: The size of the security token that STS APIs return is not fixed. We strongly recommend that you make no assumptions about the maximum size. As of this writing, the typical size is less than 4096 bytes, but that can vary. Also, future updates to AWS might require larger sizes.

gstrsResponseStatus :: Lens' GetSessionTokenResponse Int

The response status code.