SignInService / Client / create_o_auth2_token_with_token_exchange

create_o_auth2_token_with_token_exchange

SignInService.Client.create_o_auth2_token_with_token_exchange(**kwargs)

Exchanges a supported token for an OAuth 2.0 access token scoped to a resource, which you can use to access AWS services from applications.

See also: AWS API Documentation

Request Syntax

response = client.create_o_auth2_token_with_token_exchange(
    grantType='string',
    subjectToken='string',
    subjectTokenType='string',
    resource='string',
    scope='string'
)
Parameters:

  • grantType (string) –

    [REQUIRED]

    The OAuth 2.0 grant type. Currently only supports “urn:ietf:params:oauth:grant-type:token-exchange”.

  • subjectToken (string) – The subject token that represents the identity of the party on whose behalf the request is made. Required when “grant_type=urn:ietf:params:oauth:grant-type:token-exchange”.

  • subjectTokenType (string) – The token type of the subject token. Currently only supports “urn:ietf:params:oauth:token-type:jwt”. Required when “grant_type=urn:ietf:params:oauth:grant-type:token-exchange”.

  • resource (string) – The OAuth resource for which the access token is requested. Required when “grant_type=urn:ietf:params:oauth:grant-type:token-exchange”. Example: “glue.amazonaws.com”.

  • scope (string) – IAM managed policy Amazon Resource Names (ARNs) to apply as session policies that further scope down the permissions of the issued access token, provided as a space-delimited list. Example: “arn:aws:iam::444455556666:policy/MyPolicy”.

Return type:

dict

Returns:

Response Syntax

{
    'accessToken': 'string',
    'issuedTokenType': 'string',
    'tokenType': 'string',
    'expiresIn': 123
}

Response Structure

  • (dict) –

    Output structure for CreateOAuth2TokenWithTokenExchange operation.

    Contains the access token, issued token type, token type, and expiration as defined in RFC 6749 §5.1 and RFC 8693 §2.2.1.

    • accessToken (string) –

      Access token containing principal identity, resource scope, and session metadata.

    • issuedTokenType (string) –

      The token type of the issued token. Always “urn:ietf:params:oauth:token-type:access_token” as defined in RFC 8693 §2.2.1.

    • tokenType (string) –

      The token type. Currently only supports “Bearer” as defined in RFC 6749.

    • expiresIn (integer) –

      Token lifetime in seconds. Value is the minimum of the subject token’s validity and 1 hour (3600 seconds).

Exceptions