export interface PolicyDescriptorType {
    /** The Amazon Resource Name (ARN) of the IAM managed policy to use as a session policy for the role. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Name */
    arn?: string;
}
export interface Tag {
    /** The key for a session tag. You can pass up to 50 session tags. The plain text session tag keys can’t exceed 128 characters. For these and additional limits, see IAM and STS Character Limits in the IAM */
    Key: string;
    /** The value for a session tag. You can pass up to 50 session tags. The plain text session tag values can’t exceed 256 characters. For these and additional limits, see IAM and STS Character Limits in the */
    Value: string;
}
export interface ProvidedContext {
    /** The context provider ARN from which the trusted context assertion was generated. */
    ProviderArn?: string;
    /** The signed and encrypted trusted context assertion generated by the context provider. The trusted context assertion is signed and encrypted by Amazon Web Services STS. */
    ContextAssertion?: string;
}
export interface AssumeRoleInput {
    /** The Amazon Resource Name (ARN) of the role to assume. */
    RoleArn: string;
    /** An identifier for the assumed role session. Use the role session name to uniquely identify a session when the same role is assumed by different principals or for different reasons. In cross-account sc */
    RoleSessionName: string;
    /** The duration, in seconds, of the role session. The value specified can range from 900 seconds (15 minutes) up to the maximum session duration set for the role. The maximum session duration setting can */
    DurationSeconds?: number;
    /** A unique identifier that might be required when you assume a role in another account. If the administrator of the account to which the role belongs provided you with an external ID, then provide that  */
    ExternalId?: string;
    /** An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's */
    Policy?: string;
    /** The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as managed session policies. The policies must exist in the same account as the role. This parameter is optional. You  */
    PolicyArns?: PolicyDescriptorType[];
    /** A list of previously acquired trusted context assertions in the format of a JSON array. The trusted context assertion is signed and encrypted by Amazon Web Services STS. The following is an example of */
    ProvidedContexts?: ProvidedContext[];
    /** The identification number of the MFA device that is associated with the user who is making the AssumeRole call. Specify this value if the trust policy of the role being assumed includes a condition th */
    SerialNumber?: string;
    /** The source identity specified by the principal that is calling the AssumeRole operation. The source identity value persists across chained role sessions. You can require users to specify a source iden */
    SourceIdentity?: string;
    /** A list of session tags that you want to pass. Each session tag consists of a key name and an associated value. For more information about session tags, see Tagging Amazon Web Services STS Sessions in  */
    Tags?: Tag[];
    /** The value provided by the MFA device, if the trust policy of the role being assumed requires MFA. (In other words, if the policy includes a condition that tests for MFA). If the role being assumed req */
    TokenCode?: string;
    /** A list of keys for session tags that you want to set as transitive. If you set a tag key as transitive, the corresponding key and value passes to subsequent sessions in a role chain. For more informat */
    TransitiveTagKeys?: string[];
}
export interface AssumeRoleWithSAMLInput {
    /** The Amazon Resource Name (ARN) of the SAML provider in IAM that describes the IdP. */
    PrincipalArn: string;
    /** The Amazon Resource Name (ARN) of the role that the caller is assuming. */
    RoleArn: string;
    /** The base64 encoded SAML authentication response provided by the IdP. For more information, see Configuring a Relying Party and Adding Claims in the IAM User Guide. */
    SAMLAssertion: string;
    /** The duration, in seconds, of the role session. Your role session lasts for the duration that you specify for the DurationSeconds parameter, or until the time specified in the SAML authentication respo */
    DurationSeconds?: number;
    /** An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's */
    Policy?: string;
    /** The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as managed session policies. The policies must exist in the same account as the role. This parameter is optional. You  */
    PolicyArns?: PolicyDescriptorType[];
}
export interface AssumeRoleWithWebIdentityInput {
    /** The Amazon Resource Name (ARN) of the role that the caller is assuming. Additional considerations apply to Amazon Cognito identity pools that assume cross-account IAM roles. The trust policies of thes */
    RoleArn: string;
    /** An identifier for the assumed role session. Typically, you pass the name or identifier that is associated with the user who is using your application. That way, the temporary security credentials that */
    RoleSessionName: string;
    /** The OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity provider. Your application must get this token by authenticating the user who is using your application with a we */
    WebIdentityToken: string;
    /** The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. This setting can have a value from 1 hour to 1 */
    DurationSeconds?: number;
    /** An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's */
    Policy?: string;
    /** The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as managed session policies. The policies must exist in the same account as the role. This parameter is optional. You  */
    PolicyArns?: PolicyDescriptorType[];
    /** The fully qualified host component of the domain name of the OAuth 2.0 identity provider. Do not specify this value for an OpenID Connect identity provider. Currently www.amazon.com and graph.facebook */
    ProviderId?: string;
}
export interface AssumeRootInput {
    /** The member account principal ARN or account ID. */
    TargetPrincipal: string;
    /** The identity based policy that scopes the session to the privileged tasks that can be performed. You must use one of following Amazon Web Services managed policies to scope root session actions: IAMAu */
    TaskPolicyArn: PolicyDescriptorType;
    /** The duration, in seconds, of the privileged session. The value can range from 0 seconds up to the maximum session duration of 900 seconds (15 minutes). If you specify a value higher than this setting, */
    DurationSeconds?: number;
}
export interface DecodeAuthorizationMessageInput {
    /** The encoded message that was returned with the response. */
    EncodedMessage: string;
}
export interface GetAccessKeyInfoInput {
    /** The identifier of an access key. This parameter allows (through its regex pattern) a string of characters that can consist of any upper- or lowercase letter or digit. */
    AccessKeyId: string;
}
export interface GetDelegatedAccessTokenInput {
    /** The token to exchange for temporary Amazon Web Services credentials. This token must be valid and unexpired at the time of the request. */
    TradeInToken: string;
}
export interface GetFederationTokenInput {
    /** The name of the federated user. The name is used as an identifier for the temporary security credentials (such as Bob). For example, you can reference the federated user name in a resource-based polic */
    Name: string;
    /** The duration, in seconds, that the session should last. Acceptable durations for federation sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with 43,200 seconds (12 hours) a */
    DurationSeconds?: number;
    /** An IAM policy in JSON format that you want to use as an inline session policy. You must pass an inline or managed session policy to this operation. You can pass a single JSON policy document to use as */
    Policy?: string;
    /** The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as a managed session policy. The policies must exist in the same account as the IAM user that is requesting federated  */
    PolicyArns?: PolicyDescriptorType[];
    /** A list of session tags. Each session tag consists of a key name and an associated value. For more information about session tags, see Passing Session Tags in STS in the IAM User Guide. This parameter  */
    Tags?: Tag[];
}
export interface GetSessionTokenInput {
    /** The duration, in seconds, that the credentials should remain valid. Acceptable durations for IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with 43,200 seconds (1 */
    DurationSeconds?: number;
    /** The identification number of the MFA device that is associated with the IAM user who is making the GetSessionToken call. Specify this value if the IAM user has a policy that requires MFA authenticatio */
    SerialNumber?: string;
    /** The value provided by the MFA device, if MFA is required. If any policy requires the IAM user to submit an MFA code, specify this value. If MFA authentication is required, the user must provide a code */
    TokenCode?: string;
}
export interface GetWebIdentityTokenInput {
    /** The intended recipient of the web identity token. This value populates the aud claim in the JWT and should identify the service or application that will validate and use the token. The external servic */
    Audience: string[];
    /** The cryptographic algorithm to use for signing the JSON Web Token (JWT). Valid values are RS256 (RSA with SHA-256) and ES384 (ECDSA using P-384 curve with SHA-384). */
    SigningAlgorithm: string;
    /** The duration, in seconds, for which the JSON Web Token (JWT) will remain valid. The value can range from 60 seconds (1 minute) to 3600 seconds (1 hour). If not specified, the default duration is 300 s */
    DurationSeconds?: number;
    /** An optional list of tags to include in the JSON Web Token (JWT). These tags are added as custom claims to the JWT and can be used by the downstream service for authorization decisions. */
    Tags?: Tag[];
}
/** STS service binding for Step Functions SDK integrations. */
export declare class STS {
    constructor();
    assumeRole<T>(params: AssumeRoleInput): Promise<T>;
    assumeRoleWithSAML<T>(params: AssumeRoleWithSAMLInput): Promise<T>;
    assumeRoleWithWebIdentity<T>(params: AssumeRoleWithWebIdentityInput): Promise<T>;
    assumeRoot<T>(params: AssumeRootInput): Promise<T>;
    decodeAuthorizationMessage<T>(params: DecodeAuthorizationMessageInput): Promise<T>;
    getAccessKeyInfo<T>(params: GetAccessKeyInfoInput): Promise<T>;
    getCallerIdentity<T>(params: Record<string, any>): Promise<T>;
    getDelegatedAccessToken<T>(params: GetDelegatedAccessTokenInput): Promise<T>;
    getFederationToken<T>(params: GetFederationTokenInput): Promise<T>;
    getSessionToken<T>(params: GetSessionTokenInput): Promise<T>;
    getWebIdentityToken<T>(params: GetWebIdentityTokenInput): Promise<T>;
}
//# sourceMappingURL=STS.d.ts.map