AWS Sign-In Service

Exchanges a supported token for an OAuth 2.0 access token scoped to a resource, which you can use to access AWS services from applications.

See also: AWS API Documentation

Request Syntax

client.create_o_auth2_token_with_token_exchange(
    grantType='string',
    subjectToken='string',
    subjectTokenType='string',
    resource='string',
    scope='string'
)

type grantType:

string

param grantType:

[REQUIRED]

The OAuth 2.0 grant type. Currently only supports "urn:ietf:params:oauth:grant-type:token-exchange".

type subjectToken:

string

param subjectToken:

The subject token that represents the identity of the party on whose behalf the request is made. Required when "grant_type=urn:ietf:params:oauth:grant-type:token-exchange".

type subjectTokenType:

string

param subjectTokenType:

The token type of the subject token. Currently only supports "urn:ietf:params:oauth:token-type:jwt". Required when "grant_type=urn:ietf:params:oauth:grant-type:token-exchange".

type resource:

string

param resource:

The OAuth resource for which the access token is requested. Required when "grant_type=urn:ietf:params:oauth:grant-type:token-exchange". Example: "glue.amazonaws.com".

type scope:

string

param scope:

IAM managed policy Amazon Resource Names (ARNs) to apply as session policies that further scope down the permissions of the issued access token, provided as a space-delimited list. Example: "arn:aws:iam::444455556666:policy/MyPolicy".

rtype:

dict

returns:

Response Syntax

{
    'accessToken': 'string',
    'issuedTokenType': 'string',
    'tokenType': 'string',
    'expiresIn': 123
}

Response Structure

• (dict) --

  Output structure for CreateOAuth2TokenWithTokenExchange operation.

  Contains the access token, issued token type, token type, and expiration as defined in RFC 6749 §5.1 and RFC 8693 §2.2.1.

  • accessToken (string) --

    Access token containing principal identity, resource scope, and session metadata.

  • issuedTokenType (string) --

    The token type of the issued token. Always "urn:ietf:params:oauth:token-type:access_token" as defined in RFC 8693 §2.2.1.

  • tokenType (string) --

    The token type. Currently only supports "Bearer" as defined in RFC 6749.

  • expiresIn (integer) --

    Token lifetime in seconds. Value is the minimum of the subject token's validity and 1 hour (3600 seconds).