{
  "service": "aws_sts",
  "displayName": "AWS STS",
  "categories": [
    "Security",
    "Developer Tools"
  ],
  "authTypes": [
    "custom_credential"
  ],
  "auth": [
    {
      "type": "custom_credential",
      "fields": [
        {
          "key": "accessKeyId",
          "label": "Access Key ID",
          "inputType": "text",
          "required": true,
          "secret": false,
          "placeholder": "AKIA...",
          "description": "AWS access key ID used as the source credential for STS AssumeRole. Create or manage access keys with the official IAM guide: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"
        },
        {
          "key": "secretAccessKey",
          "label": "Secret Access Key",
          "inputType": "password",
          "required": true,
          "secret": true,
          "placeholder": "Your AWS secret access key",
          "description": "AWS secret access key from the same access key pair. AWS shows it only when you create the access key: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"
        },
        {
          "key": "sessionToken",
          "label": "Session Token",
          "inputType": "password",
          "required": false,
          "secret": true,
          "placeholder": "Optional source STS session token",
          "description": "Optional AWS STS session token from the same temporary source credential set when the source access key is already temporary."
        },
        {
          "key": "defaultRoleArn",
          "label": "Default Role ARN",
          "inputType": "text",
          "required": false,
          "secret": false,
          "placeholder": "arn:aws:iam::123456789012:role/demo",
          "description": "Optional default IAM role ARN used by assume_role when the action input omits roleArn. If this is left blank, each assume_role action call must provide roleArn."
        }
      ]
    }
  ],
  "homepageUrl": "https://aws.amazon.com/iam/",
  "actions": [
    {
      "id": "aws_sts.assume_role",
      "service": "aws_sts",
      "name": "assume_role",
      "description": "Use a connected AWS access key pair to call STS AssumeRole and return temporary credentials.",
      "requiredScopes": [],
      "providerPermissions": [],
      "inputSchema": {
        "type": "object",
        "properties": {
          "roleArn": {
            "type": "string",
            "minLength": 1,
            "description": "The AWS IAM role ARN to assume. Required when the connection has no saved Role ARN; otherwise the saved Role ARN is used when this field is omitted."
          },
          "roleSessionName": {
            "type": "string",
            "minLength": 2,
            "description": "The AWS STS role session name."
          },
          "durationSeconds": {
            "type": "integer",
            "minimum": 900,
            "maximum": 43200,
            "description": "The temporary credential duration in seconds. AWS STS accepts 900 to 43200, limited by the role maximum session duration."
          },
          "policy": {
            "type": "string",
            "minLength": 1,
            "description": "An optional inline session policy JSON string used only to narrow the temporary credential permissions."
          },
          "policyArns": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "arn": {
                  "type": "string",
                  "minLength": 1,
                  "description": "The ARN of the managed session policy."
                }
              },
              "additionalProperties": false,
              "description": "A managed policy reference for the AssumeRole request."
            },
            "description": "Optional managed policy ARNs used only to narrow the temporary credential permissions.",
            "minItems": 1,
            "maxItems": 10
          },
          "externalId": {
            "type": "string",
            "minLength": 1,
            "description": "The external ID to pass when the target role requires one."
          },
          "serialNumber": {
            "type": "string",
            "minLength": 1,
            "description": "The MFA device serial number or ARN."
          },
          "tokenCode": {
            "type": "string",
            "minLength": 1,
            "description": "The time-based MFA token code."
          },
          "sourceIdentity": {
            "type": "string",
            "minLength": 1,
            "description": "The source identity to attach to the role session."
          },
          "tags": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "key": {
                  "type": "string",
                  "minLength": 1,
                  "description": "The session tag key."
                },
                "value": {
                  "type": "string",
                  "description": "The session tag value."
                }
              },
              "additionalProperties": false,
              "description": "A session tag to pass to AWS STS AssumeRole."
            },
            "description": "Session tags to pass to the assumed role session.",
            "minItems": 1,
            "maxItems": 50
          },
          "transitiveTagKeys": {
            "type": "array",
            "items": {
              "type": "string",
              "minLength": 1,
              "description": "A transitive session tag key."
            },
            "description": "Session tag keys that AWS should mark as transitive for role chaining.",
            "minItems": 1,
            "maxItems": 50
          }
        },
        "additionalProperties": false,
        "description": "Input parameters for assuming an AWS IAM role with saved AWS access key credentials."
      },
      "outputSchema": {
        "type": "object",
        "properties": {
          "accessKeyId": {
            "type": "string",
            "description": "The temporary AWS access key ID."
          },
          "secretAccessKey": {
            "type": "string",
            "description": "The temporary AWS secret access key."
          },
          "sessionToken": {
            "type": "string",
            "description": "The AWS STS session token used with the temporary access key pair."
          },
          "expiration": {
            "type": "string",
            "description": "The ISO timestamp when the temporary credential expires."
          },
          "requestId": {
            "anyOf": [
              {
                "type": "string",
                "description": "The AWS STS request ID."
              },
              {
                "type": "null"
              }
            ]
          },
          "assumedRoleUser": {
            "anyOf": [
              {
                "type": "object",
                "properties": {
                  "arn": {
                    "anyOf": [
                      {
                        "type": "string",
                        "description": "The assumed role user ARN."
                      },
                      {
                        "type": "null"
                      }
                    ]
                  },
                  "assumedRoleId": {
                    "anyOf": [
                      {
                        "type": "string",
                        "description": "The assumed role user ID."
                      },
                      {
                        "type": "null"
                      }
                    ]
                  }
                },
                "additionalProperties": false,
                "description": "The assumed role user identity returned by AWS STS."
              },
              {
                "type": "null"
              }
            ]
          },
          "packedPolicySize": {
            "anyOf": [
              {
                "type": "integer",
                "description": "The percentage of the packed policy and tag size quota used by the request."
              },
              {
                "type": "null"
              }
            ]
          },
          "sourceIdentity": {
            "anyOf": [
              {
                "type": "string",
                "description": "The source identity associated with the role session."
              },
              {
                "type": "null"
              }
            ]
          }
        },
        "additionalProperties": false,
        "description": "The normalized AWS STS temporary credential returned by the connector."
      }
    }
  ]
}