// Code generated by software.amazon.smithy.rust.codegen.smithy-rs. DO NOT EDIT.
#[derive(Debug)]
pub(crate) struct Handle<
    C = aws_smithy_client::erase::DynConnector,
    M = aws_hyper::AwsMiddleware,
    R = aws_smithy_client::retry::Standard,
> {
    client: aws_smithy_client::Client<C, M, R>,
    conf: crate::Config,
}

/// An ergonomic service client for `AWSSecurityTokenServiceV20110615`.
///
/// This client allows ergonomic access to a `AWSSecurityTokenServiceV20110615`-shaped service.
/// Each method corresponds to an endpoint defined in the service's Smithy model,
/// and the request and response shapes are auto-generated from that same model.
///
/// # Using a Client
///
/// Once you have a client set up, you can access the service's endpoints
/// by calling the appropriate method on [`Client`]. Each such method
/// returns a request builder for that endpoint, with methods for setting
/// the various fields of the request. Once your request is complete, use
/// the `send` method to send the request. `send` returns a future, which
/// you then have to `.await` to get the service's response.
///
/// [builder pattern]: https://rust-lang.github.io/api-guidelines/type-safety.html#c-builder
/// [SigV4-signed requests]: https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
#[derive(std::fmt::Debug)]
pub struct Client<
    C = aws_smithy_client::erase::DynConnector,
    M = aws_hyper::AwsMiddleware,
    R = aws_smithy_client::retry::Standard,
> {
    handle: std::sync::Arc<Handle<C, M, R>>,
}

impl<C, M, R> std::clone::Clone for Client<C, M, R> {
    fn clone(&self) -> Self {
        Self {
            handle: self.handle.clone(),
        }
    }
}

#[doc(inline)]
pub use aws_smithy_client::Builder;

impl<C, M, R> From<aws_smithy_client::Client<C, M, R>> for Client<C, M, R> {
    fn from(client: aws_smithy_client::Client<C, M, R>) -> Self {
        Self::with_config(client, crate::Config::builder().build())
    }
}

impl<C, M, R> Client<C, M, R> {
    /// Creates a client with the given service configuration.
    pub fn with_config(client: aws_smithy_client::Client<C, M, R>, conf: crate::Config) -> Self {
        Self {
            handle: std::sync::Arc::new(Handle { client, conf }),
        }
    }

    /// Returns the client's configuration.
    pub fn conf(&self) -> &crate::Config {
        &self.handle.conf
    }
}
impl<C, M, R> Client<C, M, R>
where
    C: aws_smithy_client::bounds::SmithyConnector,
    M: aws_smithy_client::bounds::SmithyMiddleware<C>,
    R: aws_smithy_client::retry::NewRequestPolicy,
{
    /// Constructs a fluent builder for the `AssumeRole` operation.
    ///
    /// See [`AssumeRole`](crate::client::fluent_builders::AssumeRole) for more information about the
    /// operation and its arguments.
    pub fn assume_role(&self) -> fluent_builders::AssumeRole<C, M, R> {
        fluent_builders::AssumeRole::new(self.handle.clone())
    }
    /// Constructs a fluent builder for the `AssumeRoleWithSAML` operation.
    ///
    /// See [`AssumeRoleWithSAML`](crate::client::fluent_builders::AssumeRoleWithSAML) for more information about the
    /// operation and its arguments.
    pub fn assume_role_with_saml(&self) -> fluent_builders::AssumeRoleWithSAML<C, M, R> {
        fluent_builders::AssumeRoleWithSAML::new(self.handle.clone())
    }
    /// Constructs a fluent builder for the `AssumeRoleWithWebIdentity` operation.
    ///
    /// See [`AssumeRoleWithWebIdentity`](crate::client::fluent_builders::AssumeRoleWithWebIdentity) for more information about the
    /// operation and its arguments.
    pub fn assume_role_with_web_identity(
        &self,
    ) -> fluent_builders::AssumeRoleWithWebIdentity<C, M, R> {
        fluent_builders::AssumeRoleWithWebIdentity::new(self.handle.clone())
    }
    /// Constructs a fluent builder for the `DecodeAuthorizationMessage` operation.
    ///
    /// See [`DecodeAuthorizationMessage`](crate::client::fluent_builders::DecodeAuthorizationMessage) for more information about the
    /// operation and its arguments.
    pub fn decode_authorization_message(
        &self,
    ) -> fluent_builders::DecodeAuthorizationMessage<C, M, R> {
        fluent_builders::DecodeAuthorizationMessage::new(self.handle.clone())
    }
    /// Constructs a fluent builder for the `GetAccessKeyInfo` operation.
    ///
    /// See [`GetAccessKeyInfo`](crate::client::fluent_builders::GetAccessKeyInfo) for more information about the
    /// operation and its arguments.
    pub fn get_access_key_info(&self) -> fluent_builders::GetAccessKeyInfo<C, M, R> {
        fluent_builders::GetAccessKeyInfo::new(self.handle.clone())
    }
    /// Constructs a fluent builder for the `GetCallerIdentity` operation.
    ///
    /// See [`GetCallerIdentity`](crate::client::fluent_builders::GetCallerIdentity) for more information about the
    /// operation and its arguments.
    pub fn get_caller_identity(&self) -> fluent_builders::GetCallerIdentity<C, M, R> {
        fluent_builders::GetCallerIdentity::new(self.handle.clone())
    }
    /// Constructs a fluent builder for the `GetFederationToken` operation.
    ///
    /// See [`GetFederationToken`](crate::client::fluent_builders::GetFederationToken) for more information about the
    /// operation and its arguments.
    pub fn get_federation_token(&self) -> fluent_builders::GetFederationToken<C, M, R> {
        fluent_builders::GetFederationToken::new(self.handle.clone())
    }
    /// Constructs a fluent builder for the `GetSessionToken` operation.
    ///
    /// See [`GetSessionToken`](crate::client::fluent_builders::GetSessionToken) for more information about the
    /// operation and its arguments.
    pub fn get_session_token(&self) -> fluent_builders::GetSessionToken<C, M, R> {
        fluent_builders::GetSessionToken::new(self.handle.clone())
    }
}
pub mod fluent_builders {
    //!
    //! Utilities to ergonomically construct a request to the service.
    //!
    //! Fluent builders are created through the [`Client`](crate::client::Client) by calling
    //! one if its operation methods. After parameters are set using the builder methods,
    //! the `send` method can be called to initiate the request.
    //!
    /// Fluent builder constructing a request to `AssumeRole`.
    ///
    /// <p>Returns a set of temporary security credentials that you can use to access Amazon Web Services
    /// resources that you might not normally have access to. These temporary credentials
    /// consist of an access key ID, a secret access key, and a security token. Typically, you
    /// use <code>AssumeRole</code> within your account or for cross-account access. For a
    /// comparison of <code>AssumeRole</code> with other API operations that produce temporary
    /// credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting Temporary Security
    /// Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
    /// the STS API operations</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>
    /// <b>Permissions</b>
    /// </p>
    /// <p>The temporary security credentials created by <code>AssumeRole</code> can be used to
    /// make API calls to any Amazon Web Services service with the following exception: You cannot call the
    /// STS <code>GetFederationToken</code> or <code>GetSessionToken</code> API
    /// operations.</p>
    /// <p>(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policies</a> to
    /// this operation. You can pass a single JSON policy document to use as an inline session
    /// policy. You can also specify up to 10 managed policies to use as managed session policies.
    /// The plaintext that you use for both inline and managed session policies can't exceed 2,048
    /// characters. Passing policies to this operation returns new
    /// temporary credentials. The resulting session's permissions are the intersection of the
    /// role's identity-based policy and the session policies. You can use the role's temporary
    /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
    /// the role. You cannot use session policies to grant more permissions than those allowed
    /// by the identity-based policy of the role that is being assumed. For more information, see
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
    /// Policies</a> in the <i>IAM User Guide</i>.</p>
    /// <p>To assume a role from a different account, your account must be trusted by the
    /// role. The trust relationship is defined in the role's trust policy when the role is
    /// created. That trust policy states which accounts are allowed to delegate that access to
    /// users in the account. </p>
    /// <p>A user who wants to access a role in a different account must also have permissions that
    /// are delegated from the user account administrator. The administrator must attach a policy
    /// that allows the user to call <code>AssumeRole</code> for the ARN of the role in the other
    /// account. If the user is in the same account as the role, then you can do either of the
    /// following:</p>
    /// <ul>
    /// <li>
    /// <p>Attach a policy to the user (identical to the previous user in a different
    /// account).</p>
    /// </li>
    /// <li>
    /// <p>Add the user as a principal directly in the role's trust policy.</p>
    /// </li>
    /// </ul>
    /// <p>In this case, the trust policy acts as an IAM resource-based policy. Users in the same
    /// account as the role do not need explicit permission to assume the role. For more
    /// information about trust policies and resource-based policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html">IAM Policies</a> in
    /// the <i>IAM User Guide</i>.</p>
    /// <p>
    /// <b>Tags</b>
    /// </p>
    /// <p>(Optional) You can pass tag key-value pairs to your session. These tags are called
    /// session tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>An administrator must grant you the permissions necessary to pass session tags. The
    /// administrator can also create granular permissions to allow you to pass only specific
    /// session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial: Using Tags
    /// for Attribute-Based Access Control</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>You can set the session tags as transitive. Transitive tags persist during role
    /// chaining. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining Roles
    /// with Session Tags</a> in the <i>IAM User Guide</i>.</p>
    /// <p>
    /// <b>Using MFA with AssumeRole</b>
    /// </p>
    /// <p>(Optional) You can include multi-factor authentication (MFA) information when you call
    /// <code>AssumeRole</code>. This is useful for cross-account scenarios to ensure that the
    /// user that assumes the role has been authenticated with an Amazon Web Services MFA device. In that
    /// scenario, the trust policy of the role being assumed includes a condition that tests for
    /// MFA authentication. If the caller does not include valid MFA information, the request to
    /// assume the role is denied. The condition in a trust policy that tests for MFA
    /// authentication might look like the following example.</p>
    /// <p>
    /// <code>"Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}</code>
    /// </p>
    /// <p>For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html">Configuring MFA-Protected API Access</a>
    /// in the <i>IAM User Guide</i> guide.</p>
    /// <p>To use MFA with <code>AssumeRole</code>, you pass values for the
    /// <code>SerialNumber</code> and <code>TokenCode</code> parameters. The
    /// <code>SerialNumber</code> value identifies the user's hardware or virtual MFA device.
    /// The <code>TokenCode</code> is the time-based one-time password (TOTP) that the MFA device
    /// produces. </p>
    #[derive(std::fmt::Debug)]
    pub struct AssumeRole<
        C = aws_smithy_client::erase::DynConnector,
        M = aws_hyper::AwsMiddleware,
        R = aws_smithy_client::retry::Standard,
    > {
        handle: std::sync::Arc<super::Handle<C, M, R>>,
        inner: crate::input::assume_role_input::Builder,
    }
    impl<C, M, R> AssumeRole<C, M, R>
    where
        C: aws_smithy_client::bounds::SmithyConnector,
        M: aws_smithy_client::bounds::SmithyMiddleware<C>,
        R: aws_smithy_client::retry::NewRequestPolicy,
    {
        /// Creates a new `AssumeRole`.
        pub(crate) fn new(handle: std::sync::Arc<super::Handle<C, M, R>>) -> Self {
            Self {
                handle,
                inner: Default::default(),
            }
        }

        /// Sends the request and returns the response.
        ///
        /// If an error occurs, an `SdkError` will be returned with additional details that
        /// can be matched against.
        ///
        /// By default, any retryable failures will be retried twice. Retry behavior
        /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
        /// set when configuring the client.
        pub async fn send(
            self,
        ) -> std::result::Result<
            crate::output::AssumeRoleOutput,
            aws_smithy_http::result::SdkError<crate::error::AssumeRoleError>,
        >
        where
            R::Policy: aws_smithy_client::bounds::SmithyRetryPolicy<
                crate::input::AssumeRoleInputOperationOutputAlias,
                crate::output::AssumeRoleOutput,
                crate::error::AssumeRoleError,
                crate::input::AssumeRoleInputOperationRetryAlias,
            >,
        {
            let input = self.inner.build().map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            let op = input.make_operation(&self.handle.conf).map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            self.handle.client.call(op).await
        }
        /// <p>The Amazon Resource Name (ARN) of the role to assume.</p>
        pub fn role_arn(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.role_arn(inp);
            self
        }
        /// <p>The Amazon Resource Name (ARN) of the role to assume.</p>
        pub fn set_role_arn(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_role_arn(input);
            self
        }
        /// <p>An identifier for the assumed role session.</p>
        /// <p>Use the role session name to uniquely identify a session when the same role is assumed
        /// by different principals or for different reasons. In cross-account scenarios, the role
        /// session name is visible to, and can be logged by the account that owns the role. The role
        /// session name is also used in the ARN of the assumed role principal. This means that
        /// subsequent cross-account API requests that use the temporary security credentials will
        /// expose the role session name to the external account in their CloudTrail logs.</p>
        /// <p>The regex used to validate this parameter is a string of characters
        /// consisting of upper- and lower-case alphanumeric characters with no spaces. You can
        /// also include underscores or any of the following characters: =,.@-</p>
        pub fn role_session_name(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.role_session_name(inp);
            self
        }
        /// <p>An identifier for the assumed role session.</p>
        /// <p>Use the role session name to uniquely identify a session when the same role is assumed
        /// by different principals or for different reasons. In cross-account scenarios, the role
        /// session name is visible to, and can be logged by the account that owns the role. The role
        /// session name is also used in the ARN of the assumed role principal. This means that
        /// subsequent cross-account API requests that use the temporary security credentials will
        /// expose the role session name to the external account in their CloudTrail logs.</p>
        /// <p>The regex used to validate this parameter is a string of characters
        /// consisting of upper- and lower-case alphanumeric characters with no spaces. You can
        /// also include underscores or any of the following characters: =,.@-</p>
        pub fn set_role_session_name(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_role_session_name(input);
            self
        }
        /// Appends an item to `PolicyArns`.
        ///
        /// To override the contents of this collection use [`set_policy_arns`](Self::set_policy_arns).
        ///
        /// <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
        /// managed session policies. The policies must exist in the same account as the role.</p>
        /// <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
        /// plaintext that you use for both inline and managed session policies can't exceed 2,048
        /// characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs) and Amazon Web Services
        /// Service Namespaces</a> in the Amazon Web Services General Reference.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        ///
        /// <p>Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        pub fn policy_arns(mut self, inp: impl Into<crate::model::PolicyDescriptorType>) -> Self {
            self.inner = self.inner.policy_arns(inp);
            self
        }
        /// <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
        /// managed session policies. The policies must exist in the same account as the role.</p>
        /// <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
        /// plaintext that you use for both inline and managed session policies can't exceed 2,048
        /// characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs) and Amazon Web Services
        /// Service Namespaces</a> in the Amazon Web Services General Reference.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        ///
        /// <p>Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        pub fn set_policy_arns(
            mut self,
            input: std::option::Option<std::vec::Vec<crate::model::PolicyDescriptorType>>,
        ) -> Self {
            self.inner = self.inner.set_policy_arns(input);
            self
        }
        /// <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
        /// <p>This parameter is optional. Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        /// <p>The plaintext that you use for both inline and managed session policies can't exceed
        /// 2,048 characters. The JSON policy characters can be any ASCII character from the space
        /// character to the end of the valid character list (\u0020 through \u00FF). It can also
        /// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D)
        /// characters.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn policy(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.policy(inp);
            self
        }
        /// <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
        /// <p>This parameter is optional. Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        /// <p>The plaintext that you use for both inline and managed session policies can't exceed
        /// 2,048 characters. The JSON policy characters can be any ASCII character from the space
        /// character to the end of the valid character list (\u0020 through \u00FF). It can also
        /// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D)
        /// characters.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn set_policy(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_policy(input);
            self
        }
        /// <p>The duration, in seconds, of the role session. The value specified can can range from
        /// 900 seconds (15 minutes) up to the maximum session duration that is set for the role. The
        /// maximum session duration setting can have a value from 1 hour to 12 hours. If you specify a
        /// value higher than this setting or the administrator setting (whichever is lower), the
        /// operation fails. For example, if you specify a session duration of 12 hours, but your
        /// administrator set the maximum session duration to 6 hours, your operation fails. To learn
        /// how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the
        /// Maximum Session Duration Setting for a Role</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>By default, the value is set to <code>3600</code> seconds. </p>
        /// <note>
        /// <p>The <code>DurationSeconds</code> parameter is separate from the duration of a console
        /// session that you might request using the returned credentials. The request to the
        /// federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
        /// parameter that specifies the maximum length of the console session. For more
        /// information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating a URL
        /// that Enables Federated Users to Access the Management Console</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// </note>
        pub fn duration_seconds(mut self, inp: i32) -> Self {
            self.inner = self.inner.duration_seconds(inp);
            self
        }
        /// <p>The duration, in seconds, of the role session. The value specified can can range from
        /// 900 seconds (15 minutes) up to the maximum session duration that is set for the role. The
        /// maximum session duration setting can have a value from 1 hour to 12 hours. If you specify a
        /// value higher than this setting or the administrator setting (whichever is lower), the
        /// operation fails. For example, if you specify a session duration of 12 hours, but your
        /// administrator set the maximum session duration to 6 hours, your operation fails. To learn
        /// how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the
        /// Maximum Session Duration Setting for a Role</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>By default, the value is set to <code>3600</code> seconds. </p>
        /// <note>
        /// <p>The <code>DurationSeconds</code> parameter is separate from the duration of a console
        /// session that you might request using the returned credentials. The request to the
        /// federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
        /// parameter that specifies the maximum length of the console session. For more
        /// information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating a URL
        /// that Enables Federated Users to Access the Management Console</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// </note>
        pub fn set_duration_seconds(mut self, input: std::option::Option<i32>) -> Self {
            self.inner = self.inner.set_duration_seconds(input);
            self
        }
        /// Appends an item to `Tags`.
        ///
        /// To override the contents of this collection use [`set_tags`](Self::set_tags).
        ///
        /// <p>A list of session tags that you want to pass. Each session tag consists of a key name
        /// and an associated value. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Tagging STS
        /// Sessions</a> in the <i>IAM User Guide</i>.</p>
        /// <p>This parameter is optional. You can pass up to 50 session tags. The plaintext session
        /// tag keys can’t exceed 128 characters, and the values can’t exceed 256 characters. For these
        /// and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
        /// and STS Character Limits</a> in the <i>IAM User Guide</i>.</p>
        ///
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        /// <p>You can pass a session tag with the same key as a tag that is already
        /// attached to the role. When you do, session tags override a role tag with the same key. </p>
        /// <p>Tag key–value pairs are not case sensitive, but case is preserved. This means that you
        /// cannot have separate <code>Department</code> and <code>department</code> tag keys. Assume
        /// that the role has the <code>Department</code>=<code>Marketing</code> tag and you pass the
        /// <code>department</code>=<code>engineering</code> session tag. <code>Department</code>
        /// and <code>department</code> are not saved as separate tags, and the session tag passed in
        /// the request takes precedence over the role tag.</p>
        /// <p>Additionally, if you used temporary credentials to perform this operation, the new
        /// session inherits any transitive session tags from the calling session. If you pass a
        /// session tag with the same key as an inherited tag, the operation fails. To view the
        /// inherited tags for a session, see the CloudTrail logs. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/session-tags.html#id_session-tags_ctlogs">Viewing Session Tags in CloudTrail</a> in the
        /// <i>IAM User Guide</i>.</p>
        pub fn tags(mut self, inp: impl Into<crate::model::Tag>) -> Self {
            self.inner = self.inner.tags(inp);
            self
        }
        /// <p>A list of session tags that you want to pass. Each session tag consists of a key name
        /// and an associated value. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Tagging STS
        /// Sessions</a> in the <i>IAM User Guide</i>.</p>
        /// <p>This parameter is optional. You can pass up to 50 session tags. The plaintext session
        /// tag keys can’t exceed 128 characters, and the values can’t exceed 256 characters. For these
        /// and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
        /// and STS Character Limits</a> in the <i>IAM User Guide</i>.</p>
        ///
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        /// <p>You can pass a session tag with the same key as a tag that is already
        /// attached to the role. When you do, session tags override a role tag with the same key. </p>
        /// <p>Tag key–value pairs are not case sensitive, but case is preserved. This means that you
        /// cannot have separate <code>Department</code> and <code>department</code> tag keys. Assume
        /// that the role has the <code>Department</code>=<code>Marketing</code> tag and you pass the
        /// <code>department</code>=<code>engineering</code> session tag. <code>Department</code>
        /// and <code>department</code> are not saved as separate tags, and the session tag passed in
        /// the request takes precedence over the role tag.</p>
        /// <p>Additionally, if you used temporary credentials to perform this operation, the new
        /// session inherits any transitive session tags from the calling session. If you pass a
        /// session tag with the same key as an inherited tag, the operation fails. To view the
        /// inherited tags for a session, see the CloudTrail logs. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/session-tags.html#id_session-tags_ctlogs">Viewing Session Tags in CloudTrail</a> in the
        /// <i>IAM User Guide</i>.</p>
        pub fn set_tags(
            mut self,
            input: std::option::Option<std::vec::Vec<crate::model::Tag>>,
        ) -> Self {
            self.inner = self.inner.set_tags(input);
            self
        }
        /// Appends an item to `TransitiveTagKeys`.
        ///
        /// To override the contents of this collection use [`set_transitive_tag_keys`](Self::set_transitive_tag_keys).
        ///
        /// <p>A list of keys for session tags that you want to set as transitive. If you set a tag key
        /// as transitive, the corresponding key and value passes to subsequent sessions in a role
        /// chain. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining Roles
        /// with Session Tags</a> in the <i>IAM User Guide</i>.</p>
        /// <p>This parameter is optional. When you set session tags as transitive, the session policy
        /// and session tags packed binary limit is not affected.</p>
        /// <p>If you choose not to specify a transitive tag key, then no tags are passed from this
        /// session to any subsequent sessions.</p>
        pub fn transitive_tag_keys(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.transitive_tag_keys(inp);
            self
        }
        /// <p>A list of keys for session tags that you want to set as transitive. If you set a tag key
        /// as transitive, the corresponding key and value passes to subsequent sessions in a role
        /// chain. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining Roles
        /// with Session Tags</a> in the <i>IAM User Guide</i>.</p>
        /// <p>This parameter is optional. When you set session tags as transitive, the session policy
        /// and session tags packed binary limit is not affected.</p>
        /// <p>If you choose not to specify a transitive tag key, then no tags are passed from this
        /// session to any subsequent sessions.</p>
        pub fn set_transitive_tag_keys(
            mut self,
            input: std::option::Option<std::vec::Vec<std::string::String>>,
        ) -> Self {
            self.inner = self.inner.set_transitive_tag_keys(input);
            self
        }
        /// <p>A unique identifier that might be required when you assume a role in another account. If
        /// the administrator of the account to which the role belongs provided you with an external
        /// ID, then provide that value in the <code>ExternalId</code> parameter. This value can be any
        /// string, such as a passphrase or account number. A cross-account role is usually set up to
        /// trust everyone in an account. Therefore, the administrator of the trusting account might
        /// send an external ID to the administrator of the trusted account. That way, only someone
        /// with the ID can assume the role, rather than everyone in the account. For more information
        /// about the external ID, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html">How to Use an External ID
        /// When Granting Access to Your Amazon Web Services Resources to a Third Party</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>The regex used to validate this parameter is a string of
        /// characters consisting of upper- and lower-case alphanumeric characters with no spaces.
        /// You can also include underscores or any of the following characters: =,.@:/-</p>
        pub fn external_id(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.external_id(inp);
            self
        }
        /// <p>A unique identifier that might be required when you assume a role in another account. If
        /// the administrator of the account to which the role belongs provided you with an external
        /// ID, then provide that value in the <code>ExternalId</code> parameter. This value can be any
        /// string, such as a passphrase or account number. A cross-account role is usually set up to
        /// trust everyone in an account. Therefore, the administrator of the trusting account might
        /// send an external ID to the administrator of the trusted account. That way, only someone
        /// with the ID can assume the role, rather than everyone in the account. For more information
        /// about the external ID, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html">How to Use an External ID
        /// When Granting Access to Your Amazon Web Services Resources to a Third Party</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>The regex used to validate this parameter is a string of
        /// characters consisting of upper- and lower-case alphanumeric characters with no spaces.
        /// You can also include underscores or any of the following characters: =,.@:/-</p>
        pub fn set_external_id(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_external_id(input);
            self
        }
        /// <p>The identification number of the MFA device that is associated with the user who is
        /// making the <code>AssumeRole</code> call. Specify this value if the trust policy of the role
        /// being assumed includes a condition that requires MFA authentication. The value is either
        /// the serial number for a hardware device (such as <code>GAHT12345678</code>) or an Amazon
        /// Resource Name (ARN) for a virtual device (such as
        /// <code>arn:aws:iam::123456789012:mfa/user</code>).</p>
        /// <p>The regex used to validate this parameter is a string of characters
        /// consisting of upper- and lower-case alphanumeric characters with no spaces. You can
        /// also include underscores or any of the following characters: =,.@-</p>
        pub fn serial_number(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.serial_number(inp);
            self
        }
        /// <p>The identification number of the MFA device that is associated with the user who is
        /// making the <code>AssumeRole</code> call. Specify this value if the trust policy of the role
        /// being assumed includes a condition that requires MFA authentication. The value is either
        /// the serial number for a hardware device (such as <code>GAHT12345678</code>) or an Amazon
        /// Resource Name (ARN) for a virtual device (such as
        /// <code>arn:aws:iam::123456789012:mfa/user</code>).</p>
        /// <p>The regex used to validate this parameter is a string of characters
        /// consisting of upper- and lower-case alphanumeric characters with no spaces. You can
        /// also include underscores or any of the following characters: =,.@-</p>
        pub fn set_serial_number(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_serial_number(input);
            self
        }
        /// <p>The value provided by the MFA device, if the trust policy of the role being assumed
        /// requires MFA. (In other words, if the policy includes a condition that tests for MFA). If
        /// the role being assumed requires MFA and if the <code>TokenCode</code> value is missing or
        /// expired, the <code>AssumeRole</code> call returns an "access denied" error.</p>
        /// <p>The format for this parameter, as described by its regex pattern, is a sequence of six
        /// numeric digits.</p>
        pub fn token_code(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.token_code(inp);
            self
        }
        /// <p>The value provided by the MFA device, if the trust policy of the role being assumed
        /// requires MFA. (In other words, if the policy includes a condition that tests for MFA). If
        /// the role being assumed requires MFA and if the <code>TokenCode</code> value is missing or
        /// expired, the <code>AssumeRole</code> call returns an "access denied" error.</p>
        /// <p>The format for this parameter, as described by its regex pattern, is a sequence of six
        /// numeric digits.</p>
        pub fn set_token_code(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_token_code(input);
            self
        }
        /// <p>The source identity specified by the principal that is calling the
        /// <code>AssumeRole</code> operation.</p>
        /// <p>You can require users to specify a source identity when they assume a role. You do this
        /// by using the <code>sts:SourceIdentity</code> condition key in a role trust policy. You can
        /// use source identity information in CloudTrail logs to determine who took actions with a role.
        /// You can use the <code>aws:SourceIdentity</code> condition key to further control access to
        /// Amazon Web Services resources based on the value of source identity. For more information about using
        /// source identity, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html">Monitor and control
        /// actions taken with assumed roles</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>The regex used to validate this parameter is a string of characters consisting of upper-
        /// and lower-case alphanumeric characters with no spaces. You can also include underscores or
        /// any of the following characters: =,.@-. You cannot use a value that begins with the text
        /// <code>aws:</code>. This prefix is reserved for Amazon Web Services internal
        /// use.</p>
        pub fn source_identity(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.source_identity(inp);
            self
        }
        /// <p>The source identity specified by the principal that is calling the
        /// <code>AssumeRole</code> operation.</p>
        /// <p>You can require users to specify a source identity when they assume a role. You do this
        /// by using the <code>sts:SourceIdentity</code> condition key in a role trust policy. You can
        /// use source identity information in CloudTrail logs to determine who took actions with a role.
        /// You can use the <code>aws:SourceIdentity</code> condition key to further control access to
        /// Amazon Web Services resources based on the value of source identity. For more information about using
        /// source identity, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html">Monitor and control
        /// actions taken with assumed roles</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>The regex used to validate this parameter is a string of characters consisting of upper-
        /// and lower-case alphanumeric characters with no spaces. You can also include underscores or
        /// any of the following characters: =,.@-. You cannot use a value that begins with the text
        /// <code>aws:</code>. This prefix is reserved for Amazon Web Services internal
        /// use.</p>
        pub fn set_source_identity(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_source_identity(input);
            self
        }
    }
    /// Fluent builder constructing a request to `AssumeRoleWithSAML`.
    ///
    /// <p>Returns a set of temporary security credentials for users who have been authenticated
    /// via a SAML authentication response. This operation provides a mechanism for tying an
    /// enterprise identity store or directory to role-based Amazon Web Services access without user-specific
    /// credentials or configuration. For a comparison of <code>AssumeRoleWithSAML</code> with the
    /// other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting Temporary Security
    /// Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing the
    /// STS API operations</a> in the <i>IAM User Guide</i>.</p>
    /// <p>The temporary security credentials returned by this operation consist of an access key
    /// ID, a secret access key, and a security token. Applications can use these temporary
    /// security credentials to sign calls to Amazon Web Services services.</p>
    /// <p>
    /// <b>Session Duration</b>
    /// </p>
    /// <p>By default, the temporary security credentials created by
    /// <code>AssumeRoleWithSAML</code> last for one hour. However, you can use the optional
    /// <code>DurationSeconds</code> parameter to specify the duration of your session. Your
    /// role session lasts for the duration that you specify, or until the time specified in the
    /// SAML authentication response's <code>SessionNotOnOrAfter</code> value, whichever is
    /// shorter. You can provide a <code>DurationSeconds</code> value from 900 seconds (15 minutes)
    /// up to the maximum session duration setting for the role. This setting can have a value from
    /// 1 hour to 12 hours. To learn how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the
    /// Maximum Session Duration Setting for a Role</a> in the
    /// <i>IAM User Guide</i>. The maximum session duration limit applies when
    /// you use the <code>AssumeRole*</code> API operations or the <code>assume-role*</code> CLI
    /// commands. However the limit does not apply when you use those operations to create a
    /// console URL. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using IAM Roles</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <note>
    /// <p>
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining">Role chaining</a> limits your CLI or Amazon Web Services API
    /// role session to a maximum of one hour. When you use the <code>AssumeRole</code> API
    /// operation to assume a role, you can specify the duration of your role session with
    /// the <code>DurationSeconds</code> parameter. You can specify a parameter value of up
    /// to 43200 seconds (12 hours), depending on the maximum session duration setting for
    /// your role. However, if you assume a role using role chaining and provide a
    /// <code>DurationSeconds</code> parameter value greater than one hour, the
    /// operation fails.</p>
    /// </note>
    /// <p>
    /// <b>Permissions</b>
    /// </p>
    /// <p>The temporary security credentials created by <code>AssumeRoleWithSAML</code> can be
    /// used to make API calls to any Amazon Web Services service with the following exception: you cannot call
    /// the STS <code>GetFederationToken</code> or <code>GetSessionToken</code> API
    /// operations.</p>
    /// <p>(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policies</a> to
    /// this operation. You can pass a single JSON policy document to use as an inline session
    /// policy. You can also specify up to 10 managed policies to use as managed session policies.
    /// The plaintext that you use for both inline and managed session policies can't exceed 2,048
    /// characters. Passing policies to this operation returns new
    /// temporary credentials. The resulting session's permissions are the intersection of the
    /// role's identity-based policy and the session policies. You can use the role's temporary
    /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
    /// the role. You cannot use session policies to grant more permissions than those allowed
    /// by the identity-based policy of the role that is being assumed. For more information, see
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
    /// Policies</a> in the <i>IAM User Guide</i>.</p>
    /// <p>Calling <code>AssumeRoleWithSAML</code> does not require the use of Amazon Web Services security
    /// credentials. The identity of the caller is validated by using keys in the metadata document
    /// that is uploaded for the SAML provider entity for your identity provider. </p>
    /// <important>
    /// <p>Calling <code>AssumeRoleWithSAML</code> can result in an entry in your CloudTrail logs.
    /// The entry includes the value in the <code>NameID</code> element of the SAML assertion.
    /// We recommend that you use a <code>NameIDType</code> that is not associated with any
    /// personally identifiable information (PII). For example, you could instead use the
    /// persistent identifier
    /// (<code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code>).</p>
    /// </important>
    /// <p>
    /// <b>Tags</b>
    /// </p>
    /// <p>(Optional) You can configure your IdP to pass attributes into your SAML assertion as
    /// session tags. Each session tag consists of a key name and an associated value. For more
    /// information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128
    /// characters and the values can’t exceed 256 characters. For these and additional limits, see
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
    /// and STS Character Limits</a> in the <i>IAM User Guide</i>.</p>
    ///
    /// <note>
    /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
    /// packed binary format that has a separate limit. Your request can fail for this limit
    /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
    /// response element indicates by percentage how close the policies and tags for your
    /// request are to the upper size limit.
    /// </p>
    /// </note>
    /// <p>You can pass a session tag with the same key as a tag that is
    /// attached to the role. When you do, session tags override the role's tags with the same
    /// key.</p>
    /// <p>An administrator must grant you the permissions necessary to pass session tags. The
    /// administrator can also create granular permissions to allow you to pass only specific
    /// session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial: Using Tags
    /// for Attribute-Based Access Control</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>You can set the session tags as transitive. Transitive tags persist during role
    /// chaining. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining Roles
    /// with Session Tags</a> in the <i>IAM User Guide</i>.</p>
    /// <p>
    /// <b>SAML Configuration</b>
    /// </p>
    /// <p>Before your application can call <code>AssumeRoleWithSAML</code>, you must configure
    /// your SAML identity provider (IdP) to issue the claims required by Amazon Web Services. Additionally, you
    /// must use Identity and Access Management (IAM) to create a SAML provider entity in your Amazon Web Services account that
    /// represents your identity provider. You must also create an IAM role that specifies this
    /// SAML provider in its trust policy. </p>
    /// <p>For more information, see the following resources:</p>
    /// <ul>
    /// <li>
    /// <p>
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html">About
    /// SAML 2.0-based Federation</a> in the <i>IAM User Guide</i>.
    /// </p>
    /// </li>
    /// <li>
    /// <p>
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html">Creating SAML Identity Providers</a> in the
    /// <i>IAM User Guide</i>. </p>
    /// </li>
    /// <li>
    /// <p>
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_relying-party.html">Configuring
    /// a Relying Party and Claims</a> in the <i>IAM User Guide</i>.
    /// </p>
    /// </li>
    /// <li>
    /// <p>
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_saml.html">Creating a Role for SAML 2.0 Federation</a> in the
    /// <i>IAM User Guide</i>. </p>
    /// </li>
    /// </ul>
    #[derive(std::fmt::Debug)]
    pub struct AssumeRoleWithSAML<
        C = aws_smithy_client::erase::DynConnector,
        M = aws_hyper::AwsMiddleware,
        R = aws_smithy_client::retry::Standard,
    > {
        handle: std::sync::Arc<super::Handle<C, M, R>>,
        inner: crate::input::assume_role_with_saml_input::Builder,
    }
    impl<C, M, R> AssumeRoleWithSAML<C, M, R>
    where
        C: aws_smithy_client::bounds::SmithyConnector,
        M: aws_smithy_client::bounds::SmithyMiddleware<C>,
        R: aws_smithy_client::retry::NewRequestPolicy,
    {
        /// Creates a new `AssumeRoleWithSAML`.
        pub(crate) fn new(handle: std::sync::Arc<super::Handle<C, M, R>>) -> Self {
            Self {
                handle,
                inner: Default::default(),
            }
        }

        /// Sends the request and returns the response.
        ///
        /// If an error occurs, an `SdkError` will be returned with additional details that
        /// can be matched against.
        ///
        /// By default, any retryable failures will be retried twice. Retry behavior
        /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
        /// set when configuring the client.
        pub async fn send(
            self,
        ) -> std::result::Result<
            crate::output::AssumeRoleWithSamlOutput,
            aws_smithy_http::result::SdkError<crate::error::AssumeRoleWithSAMLError>,
        >
        where
            R::Policy: aws_smithy_client::bounds::SmithyRetryPolicy<
                crate::input::AssumeRoleWithSamlInputOperationOutputAlias,
                crate::output::AssumeRoleWithSamlOutput,
                crate::error::AssumeRoleWithSAMLError,
                crate::input::AssumeRoleWithSamlInputOperationRetryAlias,
            >,
        {
            let input = self.inner.build().map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            let op = input.make_operation(&self.handle.conf).map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            self.handle.client.call(op).await
        }
        /// <p>The Amazon Resource Name (ARN) of the role that the caller is assuming.</p>
        pub fn role_arn(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.role_arn(inp);
            self
        }
        /// <p>The Amazon Resource Name (ARN) of the role that the caller is assuming.</p>
        pub fn set_role_arn(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_role_arn(input);
            self
        }
        /// <p>The Amazon Resource Name (ARN) of the SAML provider in IAM that describes the
        /// IdP.</p>
        pub fn principal_arn(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.principal_arn(inp);
            self
        }
        /// <p>The Amazon Resource Name (ARN) of the SAML provider in IAM that describes the
        /// IdP.</p>
        pub fn set_principal_arn(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_principal_arn(input);
            self
        }
        /// <p>The base64 encoded SAML authentication response provided by the IdP.</p>
        /// <p>For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html">Configuring a Relying Party and
        /// Adding Claims</a> in the <i>IAM User Guide</i>. </p>
        pub fn saml_assertion(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.saml_assertion(inp);
            self
        }
        /// <p>The base64 encoded SAML authentication response provided by the IdP.</p>
        /// <p>For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html">Configuring a Relying Party and
        /// Adding Claims</a> in the <i>IAM User Guide</i>. </p>
        pub fn set_saml_assertion(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_saml_assertion(input);
            self
        }
        /// Appends an item to `PolicyArns`.
        ///
        /// To override the contents of this collection use [`set_policy_arns`](Self::set_policy_arns).
        ///
        /// <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
        /// managed session policies. The policies must exist in the same account as the role.</p>
        /// <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
        /// plaintext that you use for both inline and managed session policies can't exceed 2,048
        /// characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs) and Amazon Web Services
        /// Service Namespaces</a> in the Amazon Web Services General Reference.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        ///
        /// <p>Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        pub fn policy_arns(mut self, inp: impl Into<crate::model::PolicyDescriptorType>) -> Self {
            self.inner = self.inner.policy_arns(inp);
            self
        }
        /// <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
        /// managed session policies. The policies must exist in the same account as the role.</p>
        /// <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
        /// plaintext that you use for both inline and managed session policies can't exceed 2,048
        /// characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs) and Amazon Web Services
        /// Service Namespaces</a> in the Amazon Web Services General Reference.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        ///
        /// <p>Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        pub fn set_policy_arns(
            mut self,
            input: std::option::Option<std::vec::Vec<crate::model::PolicyDescriptorType>>,
        ) -> Self {
            self.inner = self.inner.set_policy_arns(input);
            self
        }
        /// <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
        /// <p>This parameter is optional. Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>. </p>
        /// <p>The plaintext that you use for both inline and managed session policies can't exceed
        /// 2,048 characters. The JSON policy characters can be any ASCII character from the space
        /// character to the end of the valid character list (\u0020 through \u00FF). It can also
        /// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D)
        /// characters.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn policy(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.policy(inp);
            self
        }
        /// <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
        /// <p>This parameter is optional. Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>. </p>
        /// <p>The plaintext that you use for both inline and managed session policies can't exceed
        /// 2,048 characters. The JSON policy characters can be any ASCII character from the space
        /// character to the end of the valid character list (\u0020 through \u00FF). It can also
        /// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D)
        /// characters.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn set_policy(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_policy(input);
            self
        }
        /// <p>The duration, in seconds, of the role session. Your role session lasts for the duration
        /// that you specify for the <code>DurationSeconds</code> parameter, or until the time
        /// specified in the SAML authentication response's <code>SessionNotOnOrAfter</code> value,
        /// whichever is shorter. You can provide a <code>DurationSeconds</code> value from 900 seconds
        /// (15 minutes) up to the maximum session duration setting for the role. This setting can have
        /// a value from 1 hour to 12 hours. If you specify a value higher than this setting, the
        /// operation fails. For example, if you specify a session duration of 12 hours, but your
        /// administrator set the maximum session duration to 6 hours, your operation fails. To learn
        /// how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the
        /// Maximum Session Duration Setting for a Role</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>By default, the value is set to <code>3600</code> seconds. </p>
        /// <note>
        /// <p>The <code>DurationSeconds</code> parameter is separate from the duration of a console
        /// session that you might request using the returned credentials. The request to the
        /// federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
        /// parameter that specifies the maximum length of the console session. For more
        /// information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating a URL
        /// that Enables Federated Users to Access the Management Console</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// </note>
        pub fn duration_seconds(mut self, inp: i32) -> Self {
            self.inner = self.inner.duration_seconds(inp);
            self
        }
        /// <p>The duration, in seconds, of the role session. Your role session lasts for the duration
        /// that you specify for the <code>DurationSeconds</code> parameter, or until the time
        /// specified in the SAML authentication response's <code>SessionNotOnOrAfter</code> value,
        /// whichever is shorter. You can provide a <code>DurationSeconds</code> value from 900 seconds
        /// (15 minutes) up to the maximum session duration setting for the role. This setting can have
        /// a value from 1 hour to 12 hours. If you specify a value higher than this setting, the
        /// operation fails. For example, if you specify a session duration of 12 hours, but your
        /// administrator set the maximum session duration to 6 hours, your operation fails. To learn
        /// how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the
        /// Maximum Session Duration Setting for a Role</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>By default, the value is set to <code>3600</code> seconds. </p>
        /// <note>
        /// <p>The <code>DurationSeconds</code> parameter is separate from the duration of a console
        /// session that you might request using the returned credentials. The request to the
        /// federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
        /// parameter that specifies the maximum length of the console session. For more
        /// information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating a URL
        /// that Enables Federated Users to Access the Management Console</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// </note>
        pub fn set_duration_seconds(mut self, input: std::option::Option<i32>) -> Self {
            self.inner = self.inner.set_duration_seconds(input);
            self
        }
    }
    /// Fluent builder constructing a request to `AssumeRoleWithWebIdentity`.
    ///
    /// <p>Returns a set of temporary security credentials for users who have been authenticated in
    /// a mobile or web application with a web identity provider. Example providers include Amazon Cognito,
    /// Login with Amazon, Facebook, Google, or any OpenID Connect-compatible identity
    /// provider.</p>
    /// <note>
    /// <p>For mobile applications, we recommend that you use Amazon Cognito. You can use Amazon Cognito with the
    /// <a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK for iOS Developer Guide</a> and the <a href="http://aws.amazon.com/sdkforandroid/">Amazon Web Services SDK for Android Developer Guide</a> to uniquely
    /// identify a user. You can also supply the user with a consistent identity throughout the
    /// lifetime of an application.</p>
    /// <p>To learn more about Amazon Cognito, see <a href="https://docs.aws.amazon.com/mobile/sdkforandroid/developerguide/cognito-auth.html#d0e840">Amazon Cognito Overview</a> in
    /// <i>Amazon Web Services SDK for Android Developer Guide</i> and <a href="https://docs.aws.amazon.com/mobile/sdkforios/developerguide/cognito-auth.html#d0e664">Amazon Cognito Overview</a> in the
    /// <i>Amazon Web Services SDK for iOS Developer Guide</i>.</p>
    /// </note>
    /// <p>Calling <code>AssumeRoleWithWebIdentity</code> does not require the use of Amazon Web Services
    /// security credentials. Therefore, you can distribute an application (for example, on mobile
    /// devices) that requests temporary security credentials without including long-term Amazon Web Services
    /// credentials in the application. You also don't need to deploy server-based proxy services
    /// that use long-term Amazon Web Services credentials. Instead, the identity of the caller is validated by
    /// using a token from the web identity provider. For a comparison of
    /// <code>AssumeRoleWithWebIdentity</code> with the other API operations that produce
    /// temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting Temporary Security
    /// Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing the
    /// STS API operations</a> in the <i>IAM User Guide</i>.</p>
    /// <p>The temporary security credentials returned by this API consist of an access key ID, a
    /// secret access key, and a security token. Applications can use these temporary security
    /// credentials to sign calls to Amazon Web Services service API operations.</p>
    /// <p>
    /// <b>Session Duration</b>
    /// </p>
    /// <p>By default, the temporary security credentials created by
    /// <code>AssumeRoleWithWebIdentity</code> last for one hour. However, you can use the
    /// optional <code>DurationSeconds</code> parameter to specify the duration of your session.
    /// You can provide a value from 900 seconds (15 minutes) up to the maximum session duration
    /// setting for the role. This setting can have a value from 1 hour to 12 hours. To learn how
    /// to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the
    /// Maximum Session Duration Setting for a Role</a> in the
    /// <i>IAM User Guide</i>. The maximum session duration limit applies when
    /// you use the <code>AssumeRole*</code> API operations or the <code>assume-role*</code> CLI
    /// commands. However the limit does not apply when you use those operations to create a
    /// console URL. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using IAM Roles</a> in the
    /// <i>IAM User Guide</i>. </p>
    /// <p>
    /// <b>Permissions</b>
    /// </p>
    /// <p>The temporary security credentials created by <code>AssumeRoleWithWebIdentity</code> can
    /// be used to make API calls to any Amazon Web Services service with the following exception: you cannot
    /// call the STS <code>GetFederationToken</code> or <code>GetSessionToken</code> API
    /// operations.</p>
    /// <p>(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policies</a> to
    /// this operation. You can pass a single JSON policy document to use as an inline session
    /// policy. You can also specify up to 10 managed policies to use as managed session policies.
    /// The plaintext that you use for both inline and managed session policies can't exceed 2,048
    /// characters. Passing policies to this operation returns new
    /// temporary credentials. The resulting session's permissions are the intersection of the
    /// role's identity-based policy and the session policies. You can use the role's temporary
    /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
    /// the role. You cannot use session policies to grant more permissions than those allowed
    /// by the identity-based policy of the role that is being assumed. For more information, see
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
    /// Policies</a> in the <i>IAM User Guide</i>.</p>
    /// <p>
    /// <b>Tags</b>
    /// </p>
    /// <p>(Optional) You can configure your IdP to pass attributes into your web identity token as
    /// session tags. Each session tag consists of a key name and an associated value. For more
    /// information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128
    /// characters and the values can’t exceed 256 characters. For these and additional limits, see
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
    /// and STS Character Limits</a> in the <i>IAM User Guide</i>.</p>
    ///
    /// <note>
    /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
    /// packed binary format that has a separate limit. Your request can fail for this limit
    /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
    /// response element indicates by percentage how close the policies and tags for your
    /// request are to the upper size limit.
    /// </p>
    /// </note>
    /// <p>You can pass a session tag with the same key as a tag that is
    /// attached to the role. When you do, the session tag overrides the role tag with the same
    /// key.</p>
    /// <p>An administrator must grant you the permissions necessary to pass session tags. The
    /// administrator can also create granular permissions to allow you to pass only specific
    /// session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial: Using Tags
    /// for Attribute-Based Access Control</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>You can set the session tags as transitive. Transitive tags persist during role
    /// chaining. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining Roles
    /// with Session Tags</a> in the <i>IAM User Guide</i>.</p>
    /// <p>
    /// <b>Identities</b>
    /// </p>
    /// <p>Before your application can call <code>AssumeRoleWithWebIdentity</code>, you must have
    /// an identity token from a supported identity provider and create a role that the application
    /// can assume. The role that your application assumes must trust the identity provider that is
    /// associated with the identity token. In other words, the identity provider must be specified
    /// in the role's trust policy. </p>
    /// <important>
    /// <p>Calling <code>AssumeRoleWithWebIdentity</code> can result in an entry in your
    /// CloudTrail logs. The entry includes the <a href="http://openid.net/specs/openid-connect-core-1_0.html#Claims">Subject</a> of
    /// the provided web identity token. We recommend that you avoid using any personally
    /// identifiable information (PII) in this field. For example, you could instead use a GUID
    /// or a pairwise identifier, as <a href="http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes">suggested
    /// in the OIDC specification</a>.</p>
    /// </important>
    /// <p>For more information about how to use web identity federation and the
    /// <code>AssumeRoleWithWebIdentity</code> API, see the following resources: </p>
    /// <ul>
    /// <li>
    /// <p>
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html">Using Web Identity Federation API Operations for Mobile Apps</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation Through a Web-based Identity Provider</a>. </p>
    /// </li>
    /// <li>
    /// <p>
    /// <a href="https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/"> Web Identity Federation Playground</a>. Walk through the process of
    /// authenticating through Login with Amazon, Facebook, or Google, getting temporary
    /// security credentials, and then using those credentials to make a request to Amazon Web Services.
    /// </p>
    /// </li>
    /// <li>
    /// <p>
    /// <a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK for iOS Developer Guide</a> and <a href="http://aws.amazon.com/sdkforandroid/">Amazon Web Services SDK for Android Developer Guide</a>. These toolkits
    /// contain sample apps that show how to invoke the identity providers. The toolkits then
    /// show how to use the information from these providers to get and use temporary
    /// security credentials. </p>
    /// </li>
    /// <li>
    /// <p>
    /// <a href="http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications">Web Identity
    /// Federation with Mobile Applications</a>. This article discusses web identity
    /// federation and shows an example of how to use web identity federation to get access
    /// to content in Amazon S3. </p>
    /// </li>
    /// </ul>
    #[derive(std::fmt::Debug)]
    pub struct AssumeRoleWithWebIdentity<
        C = aws_smithy_client::erase::DynConnector,
        M = aws_hyper::AwsMiddleware,
        R = aws_smithy_client::retry::Standard,
    > {
        handle: std::sync::Arc<super::Handle<C, M, R>>,
        inner: crate::input::assume_role_with_web_identity_input::Builder,
    }
    impl<C, M, R> AssumeRoleWithWebIdentity<C, M, R>
    where
        C: aws_smithy_client::bounds::SmithyConnector,
        M: aws_smithy_client::bounds::SmithyMiddleware<C>,
        R: aws_smithy_client::retry::NewRequestPolicy,
    {
        /// Creates a new `AssumeRoleWithWebIdentity`.
        pub(crate) fn new(handle: std::sync::Arc<super::Handle<C, M, R>>) -> Self {
            Self {
                handle,
                inner: Default::default(),
            }
        }

        /// Sends the request and returns the response.
        ///
        /// If an error occurs, an `SdkError` will be returned with additional details that
        /// can be matched against.
        ///
        /// By default, any retryable failures will be retried twice. Retry behavior
        /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
        /// set when configuring the client.
        pub async fn send(
            self,
        ) -> std::result::Result<
            crate::output::AssumeRoleWithWebIdentityOutput,
            aws_smithy_http::result::SdkError<crate::error::AssumeRoleWithWebIdentityError>,
        >
        where
            R::Policy: aws_smithy_client::bounds::SmithyRetryPolicy<
                crate::input::AssumeRoleWithWebIdentityInputOperationOutputAlias,
                crate::output::AssumeRoleWithWebIdentityOutput,
                crate::error::AssumeRoleWithWebIdentityError,
                crate::input::AssumeRoleWithWebIdentityInputOperationRetryAlias,
            >,
        {
            let input = self.inner.build().map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            let op = input.make_operation(&self.handle.conf).map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            self.handle.client.call(op).await
        }
        /// <p>The Amazon Resource Name (ARN) of the role that the caller is assuming.</p>
        pub fn role_arn(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.role_arn(inp);
            self
        }
        /// <p>The Amazon Resource Name (ARN) of the role that the caller is assuming.</p>
        pub fn set_role_arn(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_role_arn(input);
            self
        }
        /// <p>An identifier for the assumed role session. Typically, you pass the name or identifier
        /// that is associated with the user who is using your application. That way, the temporary
        /// security credentials that your application will use are associated with that user. This
        /// session name is included as part of the ARN and assumed role ID in the
        /// <code>AssumedRoleUser</code> response element.</p>
        /// <p>The regex used to validate this parameter is a string of characters
        /// consisting of upper- and lower-case alphanumeric characters with no spaces. You can
        /// also include underscores or any of the following characters: =,.@-</p>
        pub fn role_session_name(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.role_session_name(inp);
            self
        }
        /// <p>An identifier for the assumed role session. Typically, you pass the name or identifier
        /// that is associated with the user who is using your application. That way, the temporary
        /// security credentials that your application will use are associated with that user. This
        /// session name is included as part of the ARN and assumed role ID in the
        /// <code>AssumedRoleUser</code> response element.</p>
        /// <p>The regex used to validate this parameter is a string of characters
        /// consisting of upper- and lower-case alphanumeric characters with no spaces. You can
        /// also include underscores or any of the following characters: =,.@-</p>
        pub fn set_role_session_name(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_role_session_name(input);
            self
        }
        /// <p>The OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity
        /// provider. Your application must get this token by authenticating the user who is using your
        /// application with a web identity provider before the application makes an
        /// <code>AssumeRoleWithWebIdentity</code> call. </p>
        pub fn web_identity_token(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.web_identity_token(inp);
            self
        }
        /// <p>The OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity
        /// provider. Your application must get this token by authenticating the user who is using your
        /// application with a web identity provider before the application makes an
        /// <code>AssumeRoleWithWebIdentity</code> call. </p>
        pub fn set_web_identity_token(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_web_identity_token(input);
            self
        }
        /// <p>The fully qualified host component of the domain name of the identity provider.</p>
        /// <p>Specify this value only for OAuth 2.0 access tokens. Currently
        /// <code>www.amazon.com</code> and <code>graph.facebook.com</code> are the only supported
        /// identity providers for OAuth 2.0 access tokens. Do not include URL schemes and port
        /// numbers.</p>
        /// <p>Do not specify this value for OpenID Connect ID tokens.</p>
        pub fn provider_id(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.provider_id(inp);
            self
        }
        /// <p>The fully qualified host component of the domain name of the identity provider.</p>
        /// <p>Specify this value only for OAuth 2.0 access tokens. Currently
        /// <code>www.amazon.com</code> and <code>graph.facebook.com</code> are the only supported
        /// identity providers for OAuth 2.0 access tokens. Do not include URL schemes and port
        /// numbers.</p>
        /// <p>Do not specify this value for OpenID Connect ID tokens.</p>
        pub fn set_provider_id(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_provider_id(input);
            self
        }
        /// Appends an item to `PolicyArns`.
        ///
        /// To override the contents of this collection use [`set_policy_arns`](Self::set_policy_arns).
        ///
        /// <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
        /// managed session policies. The policies must exist in the same account as the role.</p>
        /// <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
        /// plaintext that you use for both inline and managed session policies can't exceed 2,048
        /// characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs) and Amazon Web Services
        /// Service Namespaces</a> in the Amazon Web Services General Reference.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        ///
        /// <p>Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        pub fn policy_arns(mut self, inp: impl Into<crate::model::PolicyDescriptorType>) -> Self {
            self.inner = self.inner.policy_arns(inp);
            self
        }
        /// <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as
        /// managed session policies. The policies must exist in the same account as the role.</p>
        /// <p>This parameter is optional. You can provide up to 10 managed policy ARNs. However, the
        /// plaintext that you use for both inline and managed session policies can't exceed 2,048
        /// characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs) and Amazon Web Services
        /// Service Namespaces</a> in the Amazon Web Services General Reference.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        ///
        /// <p>Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        pub fn set_policy_arns(
            mut self,
            input: std::option::Option<std::vec::Vec<crate::model::PolicyDescriptorType>>,
        ) -> Self {
            self.inner = self.inner.set_policy_arns(input);
            self
        }
        /// <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
        /// <p>This parameter is optional. Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        /// <p>The plaintext that you use for both inline and managed session policies can't exceed
        /// 2,048 characters. The JSON policy characters can be any ASCII character from the space
        /// character to the end of the valid character list (\u0020 through \u00FF). It can also
        /// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D)
        /// characters.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn policy(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.policy(inp);
            self
        }
        /// <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
        /// <p>This parameter is optional. Passing policies to this operation returns new
        /// temporary credentials. The resulting session's permissions are the intersection of the
        /// role's identity-based policy and the session policies. You can use the role's temporary
        /// credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
        /// the role. You cannot use session policies to grant more permissions than those allowed
        /// by the identity-based policy of the role that is being assumed. For more information, see
        /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
        /// Policies</a> in the <i>IAM User Guide</i>.</p>
        /// <p>The plaintext that you use for both inline and managed session policies can't exceed
        /// 2,048 characters. The JSON policy characters can be any ASCII character from the space
        /// character to the end of the valid character list (\u0020 through \u00FF). It can also
        /// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D)
        /// characters.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn set_policy(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_policy(input);
            self
        }
        /// <p>The duration, in seconds, of the role session. The value can range from 900 seconds (15
        /// minutes) up to the maximum session duration setting for the role. This setting can have a
        /// value from 1 hour to 12 hours. If you specify a value higher than this setting, the
        /// operation fails. For example, if you specify a session duration of 12 hours, but your
        /// administrator set the maximum session duration to 6 hours, your operation fails. To learn
        /// how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the
        /// Maximum Session Duration Setting for a Role</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>By default, the value is set to <code>3600</code> seconds. </p>
        /// <note>
        /// <p>The <code>DurationSeconds</code> parameter is separate from the duration of a console
        /// session that you might request using the returned credentials. The request to the
        /// federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
        /// parameter that specifies the maximum length of the console session. For more
        /// information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating a URL
        /// that Enables Federated Users to Access the Management Console</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// </note>
        pub fn duration_seconds(mut self, inp: i32) -> Self {
            self.inner = self.inner.duration_seconds(inp);
            self
        }
        /// <p>The duration, in seconds, of the role session. The value can range from 900 seconds (15
        /// minutes) up to the maximum session duration setting for the role. This setting can have a
        /// value from 1 hour to 12 hours. If you specify a value higher than this setting, the
        /// operation fails. For example, if you specify a session duration of 12 hours, but your
        /// administrator set the maximum session duration to 6 hours, your operation fails. To learn
        /// how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View the
        /// Maximum Session Duration Setting for a Role</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>By default, the value is set to <code>3600</code> seconds. </p>
        /// <note>
        /// <p>The <code>DurationSeconds</code> parameter is separate from the duration of a console
        /// session that you might request using the returned credentials. The request to the
        /// federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
        /// parameter that specifies the maximum length of the console session. For more
        /// information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating a URL
        /// that Enables Federated Users to Access the Management Console</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// </note>
        pub fn set_duration_seconds(mut self, input: std::option::Option<i32>) -> Self {
            self.inner = self.inner.set_duration_seconds(input);
            self
        }
    }
    /// Fluent builder constructing a request to `DecodeAuthorizationMessage`.
    ///
    /// <p>Decodes additional information about the authorization status of a request from an
    /// encoded message returned in response to an Amazon Web Services request.</p>
    /// <p>For example, if a user is not authorized to perform an operation that he or she has
    /// requested, the request returns a <code>Client.UnauthorizedOperation</code> response (an
    /// HTTP 403 response). Some Amazon Web Services operations additionally return an encoded message that can
    /// provide details about this authorization failure. </p>
    /// <note>
    /// <p>Only certain Amazon Web Services operations return an encoded authorization message. The
    /// documentation for an individual operation indicates whether that operation returns an
    /// encoded message in addition to returning an HTTP code.</p>
    /// </note>
    /// <p>The message is encoded because the details of the authorization status can constitute
    /// privileged information that the user who requested the operation should not see. To decode
    /// an authorization status message, a user must be granted permissions via an IAM policy to
    /// request the <code>DecodeAuthorizationMessage</code>
    /// (<code>sts:DecodeAuthorizationMessage</code>) action. </p>
    /// <p>The decoded message includes the following type of information:</p>
    /// <ul>
    /// <li>
    /// <p>Whether the request was denied due to an explicit deny or due to the absence of an
    /// explicit allow. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow">Determining Whether a Request is Allowed or Denied</a> in the
    /// <i>IAM User Guide</i>. </p>
    /// </li>
    /// <li>
    /// <p>The principal who made the request.</p>
    /// </li>
    /// <li>
    /// <p>The requested action.</p>
    /// </li>
    /// <li>
    /// <p>The requested resource.</p>
    /// </li>
    /// <li>
    /// <p>The values of condition keys in the context of the user's request.</p>
    /// </li>
    /// </ul>
    #[derive(std::fmt::Debug)]
    pub struct DecodeAuthorizationMessage<
        C = aws_smithy_client::erase::DynConnector,
        M = aws_hyper::AwsMiddleware,
        R = aws_smithy_client::retry::Standard,
    > {
        handle: std::sync::Arc<super::Handle<C, M, R>>,
        inner: crate::input::decode_authorization_message_input::Builder,
    }
    impl<C, M, R> DecodeAuthorizationMessage<C, M, R>
    where
        C: aws_smithy_client::bounds::SmithyConnector,
        M: aws_smithy_client::bounds::SmithyMiddleware<C>,
        R: aws_smithy_client::retry::NewRequestPolicy,
    {
        /// Creates a new `DecodeAuthorizationMessage`.
        pub(crate) fn new(handle: std::sync::Arc<super::Handle<C, M, R>>) -> Self {
            Self {
                handle,
                inner: Default::default(),
            }
        }

        /// Sends the request and returns the response.
        ///
        /// If an error occurs, an `SdkError` will be returned with additional details that
        /// can be matched against.
        ///
        /// By default, any retryable failures will be retried twice. Retry behavior
        /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
        /// set when configuring the client.
        pub async fn send(
            self,
        ) -> std::result::Result<
            crate::output::DecodeAuthorizationMessageOutput,
            aws_smithy_http::result::SdkError<crate::error::DecodeAuthorizationMessageError>,
        >
        where
            R::Policy: aws_smithy_client::bounds::SmithyRetryPolicy<
                crate::input::DecodeAuthorizationMessageInputOperationOutputAlias,
                crate::output::DecodeAuthorizationMessageOutput,
                crate::error::DecodeAuthorizationMessageError,
                crate::input::DecodeAuthorizationMessageInputOperationRetryAlias,
            >,
        {
            let input = self.inner.build().map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            let op = input.make_operation(&self.handle.conf).map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            self.handle.client.call(op).await
        }
        /// <p>The encoded message that was returned with the response.</p>
        pub fn encoded_message(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.encoded_message(inp);
            self
        }
        /// <p>The encoded message that was returned with the response.</p>
        pub fn set_encoded_message(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_encoded_message(input);
            self
        }
    }
    /// Fluent builder constructing a request to `GetAccessKeyInfo`.
    ///
    /// <p>Returns the account identifier for the specified access key ID.</p>
    /// <p>Access keys consist of two parts: an access key ID (for example,
    /// <code>AKIAIOSFODNN7EXAMPLE</code>) and a secret access key (for example,
    /// <code>wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY</code>). For more information about
    /// access keys, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html">Managing Access Keys for IAM
    /// Users</a> in the <i>IAM User Guide</i>.</p>
    /// <p>When you pass an access key ID to this operation, it returns the ID of the Amazon Web Services
    /// account to which the keys belong. Access key IDs beginning with <code>AKIA</code> are
    /// long-term credentials for an IAM user or the Amazon Web Services account root user. Access key IDs
    /// beginning with <code>ASIA</code> are temporary credentials that are created using STS
    /// operations. If the account in the response belongs to you, you can sign in as the root
    /// user and review your root user access keys. Then, you can pull a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html">credentials report</a> to learn which IAM user owns the keys. To learn who
    /// requested the temporary credentials for an <code>ASIA</code> access key, view the STS
    /// events in your <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html">CloudTrail logs</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>This operation does not indicate the state of the access key. The key might be active,
    /// inactive, or deleted. Active keys might not have permissions to perform an operation.
    /// Providing a deleted access key might return an error that the key doesn't exist.</p>
    #[derive(std::fmt::Debug)]
    pub struct GetAccessKeyInfo<
        C = aws_smithy_client::erase::DynConnector,
        M = aws_hyper::AwsMiddleware,
        R = aws_smithy_client::retry::Standard,
    > {
        handle: std::sync::Arc<super::Handle<C, M, R>>,
        inner: crate::input::get_access_key_info_input::Builder,
    }
    impl<C, M, R> GetAccessKeyInfo<C, M, R>
    where
        C: aws_smithy_client::bounds::SmithyConnector,
        M: aws_smithy_client::bounds::SmithyMiddleware<C>,
        R: aws_smithy_client::retry::NewRequestPolicy,
    {
        /// Creates a new `GetAccessKeyInfo`.
        pub(crate) fn new(handle: std::sync::Arc<super::Handle<C, M, R>>) -> Self {
            Self {
                handle,
                inner: Default::default(),
            }
        }

        /// Sends the request and returns the response.
        ///
        /// If an error occurs, an `SdkError` will be returned with additional details that
        /// can be matched against.
        ///
        /// By default, any retryable failures will be retried twice. Retry behavior
        /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
        /// set when configuring the client.
        pub async fn send(
            self,
        ) -> std::result::Result<
            crate::output::GetAccessKeyInfoOutput,
            aws_smithy_http::result::SdkError<crate::error::GetAccessKeyInfoError>,
        >
        where
            R::Policy: aws_smithy_client::bounds::SmithyRetryPolicy<
                crate::input::GetAccessKeyInfoInputOperationOutputAlias,
                crate::output::GetAccessKeyInfoOutput,
                crate::error::GetAccessKeyInfoError,
                crate::input::GetAccessKeyInfoInputOperationRetryAlias,
            >,
        {
            let input = self.inner.build().map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            let op = input.make_operation(&self.handle.conf).map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            self.handle.client.call(op).await
        }
        /// <p>The identifier of an access key.</p>
        /// <p>This parameter allows (through its regex pattern) a string of characters that can
        /// consist of any upper- or lowercase letter or digit.</p>
        pub fn access_key_id(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.access_key_id(inp);
            self
        }
        /// <p>The identifier of an access key.</p>
        /// <p>This parameter allows (through its regex pattern) a string of characters that can
        /// consist of any upper- or lowercase letter or digit.</p>
        pub fn set_access_key_id(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_access_key_id(input);
            self
        }
    }
    /// Fluent builder constructing a request to `GetCallerIdentity`.
    ///
    /// <p>Returns details about the IAM user or role whose credentials are used to call the
    /// operation.</p>
    /// <note>
    /// <p>No permissions are required to perform this operation. If an administrator adds a
    /// policy to your IAM user or role that explicitly denies access to the
    /// <code>sts:GetCallerIdentity</code> action, you can still perform this operation.
    /// Permissions are not required because the same information is returned when an IAM
    /// user or role is denied access. To view an example response, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa">I Am Not Authorized to Perform: iam:DeleteVirtualMFADevice</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// </note>
    #[derive(std::fmt::Debug)]
    pub struct GetCallerIdentity<
        C = aws_smithy_client::erase::DynConnector,
        M = aws_hyper::AwsMiddleware,
        R = aws_smithy_client::retry::Standard,
    > {
        handle: std::sync::Arc<super::Handle<C, M, R>>,
        inner: crate::input::get_caller_identity_input::Builder,
    }
    impl<C, M, R> GetCallerIdentity<C, M, R>
    where
        C: aws_smithy_client::bounds::SmithyConnector,
        M: aws_smithy_client::bounds::SmithyMiddleware<C>,
        R: aws_smithy_client::retry::NewRequestPolicy,
    {
        /// Creates a new `GetCallerIdentity`.
        pub(crate) fn new(handle: std::sync::Arc<super::Handle<C, M, R>>) -> Self {
            Self {
                handle,
                inner: Default::default(),
            }
        }

        /// Sends the request and returns the response.
        ///
        /// If an error occurs, an `SdkError` will be returned with additional details that
        /// can be matched against.
        ///
        /// By default, any retryable failures will be retried twice. Retry behavior
        /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
        /// set when configuring the client.
        pub async fn send(
            self,
        ) -> std::result::Result<
            crate::output::GetCallerIdentityOutput,
            aws_smithy_http::result::SdkError<crate::error::GetCallerIdentityError>,
        >
        where
            R::Policy: aws_smithy_client::bounds::SmithyRetryPolicy<
                crate::input::GetCallerIdentityInputOperationOutputAlias,
                crate::output::GetCallerIdentityOutput,
                crate::error::GetCallerIdentityError,
                crate::input::GetCallerIdentityInputOperationRetryAlias,
            >,
        {
            let input = self.inner.build().map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            let op = input.make_operation(&self.handle.conf).map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            self.handle.client.call(op).await
        }
    }
    /// Fluent builder constructing a request to `GetFederationToken`.
    ///
    /// <p>Returns a set of temporary security credentials (consisting of an access key ID, a
    /// secret access key, and a security token) for a federated user. A typical use is in a proxy
    /// application that gets temporary security credentials on behalf of distributed applications
    /// inside a corporate network. You must call the <code>GetFederationToken</code> operation
    /// using the long-term security credentials of an IAM user. As a result, this call is
    /// appropriate in contexts where those credentials can be safely stored, usually in a
    /// server-based application. For a comparison of <code>GetFederationToken</code> with the
    /// other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting Temporary Security
    /// Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing the
    /// STS API operations</a> in the <i>IAM User Guide</i>.</p>
    /// <note>
    /// <p>You can create a mobile-based or browser-based app that can authenticate users using
    /// a web identity provider like Login with Amazon, Facebook, Google, or an OpenID
    /// Connect-compatible identity provider. In this case, we recommend that you use <a href="http://aws.amazon.com/cognito/">Amazon Cognito</a> or
    /// <code>AssumeRoleWithWebIdentity</code>. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation Through a Web-based Identity Provider</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// </note>
    /// <p>You can also call <code>GetFederationToken</code> using the security credentials of an
    /// Amazon Web Services account root user, but we do not recommend it. Instead, we recommend that you create
    /// an IAM user for the purpose of the proxy application. Then attach a policy to the IAM
    /// user that limits federated users to only the actions and resources that they need to
    /// access. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html">IAM Best Practices</a> in the
    /// <i>IAM User Guide</i>. </p>
    /// <p>
    /// <b>Session duration</b>
    /// </p>
    /// <p>The temporary credentials are valid for the specified duration, from 900 seconds (15
    /// minutes) up to a maximum of 129,600 seconds (36 hours). The default session duration is
    /// 43,200 seconds (12 hours). Temporary credentials that are obtained by using Amazon Web Services account
    /// root user credentials have a maximum duration of 3,600 seconds (1 hour).</p>
    /// <p>
    /// <b>Permissions</b>
    /// </p>
    /// <p>You can use the temporary credentials created by <code>GetFederationToken</code> in any
    /// Amazon Web Services service except the following:</p>
    /// <ul>
    /// <li>
    /// <p>You cannot call any IAM operations using the CLI or the Amazon Web Services API. </p>
    /// </li>
    /// <li>
    /// <p>You cannot call any STS operations except <code>GetCallerIdentity</code>.</p>
    /// </li>
    /// </ul>
    /// <p>You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policy</a> to
    /// this operation. You can pass a single JSON policy document to use as an inline session
    /// policy. You can also specify up to 10 managed policies to use as managed session policies.
    /// The plaintext that you use for both inline and managed session policies can't exceed 2,048
    /// characters.</p>
    /// <p>Though the session policy parameters are optional, if you do not pass a policy, then the
    /// resulting federated user session has no permissions. When you pass session policies, the
    /// session permissions are the intersection of the IAM user policies and the session
    /// policies that you pass. This gives you a way to further restrict the permissions for a
    /// federated user. You cannot use session policies to grant more permissions than those that
    /// are defined in the permissions policy of the IAM user. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
    /// Policies</a> in the <i>IAM User Guide</i>. For information about
    /// using <code>GetFederationToken</code> to create temporary security credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken">GetFederationToken—Federation Through a Custom Identity Broker</a>. </p>
    /// <p>You can use the credentials to access a resource that has a resource-based policy. If
    /// that policy specifically references the federated user session in the
    /// <code>Principal</code> element of the policy, the session has the permissions allowed by
    /// the policy. These permissions are granted in addition to the permissions granted by the
    /// session policies.</p>
    /// <p>
    /// <b>Tags</b>
    /// </p>
    /// <p>(Optional) You can pass tag key-value pairs to your session. These are called session
    /// tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <note>
    /// <p>You can create a mobile-based or browser-based app that can authenticate users
    /// using a web identity provider like Login with Amazon, Facebook, Google, or an OpenID
    /// Connect-compatible identity provider. In this case, we recommend that you use <a href="http://aws.amazon.com/cognito/">Amazon Cognito</a> or
    /// <code>AssumeRoleWithWebIdentity</code>. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation Through a Web-based Identity Provider</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// </note>
    /// <p>You can also call <code>GetFederationToken</code> using the security credentials of an
    /// Amazon Web Services account root user, but we do not recommend it. Instead, we recommend that you
    /// create an IAM user for the purpose of the proxy application. Then attach a policy to
    /// the IAM user that limits federated users to only the actions and resources that they
    /// need to access. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html">IAM Best Practices</a> in the
    /// <i>IAM User Guide</i>. </p>
    /// <p>
    /// <b>Session duration</b>
    /// </p>
    /// <p>The temporary credentials are valid for the specified duration, from 900 seconds (15
    /// minutes) up to a maximum of 129,600 seconds (36 hours). The default session duration is
    /// 43,200 seconds (12 hours). Temporary credentials that are obtained by using Amazon Web Services
    /// account root user credentials have a maximum duration of 3,600 seconds (1 hour).</p>
    /// <p>
    /// <b>Permissions</b>
    /// </p>
    /// <p>You can use the temporary credentials created by <code>GetFederationToken</code> in
    /// any Amazon Web Services service except the following:</p>
    /// <ul>
    /// <li>
    /// <p>You cannot call any IAM operations using the CLI or the Amazon Web Services API.
    /// </p>
    /// </li>
    /// <li>
    /// <p>You cannot call any STS operations except
    /// <code>GetCallerIdentity</code>.</p>
    /// </li>
    /// </ul>
    /// <p>You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policy</a> to
    /// this operation. You can pass a single JSON policy document to use as an inline session
    /// policy. You can also specify up to 10 managed policies to use as managed session
    /// policies. The plain text that you use for both inline and managed session policies can't
    /// exceed 2,048 characters.</p>
    /// <p>Though the session policy parameters are optional, if you do not pass a policy, then
    /// the resulting federated user session has no permissions. When you pass session policies,
    /// the session permissions are the intersection of the IAM user policies and the session
    /// policies that you pass. This gives you a way to further restrict the permissions for a
    /// federated user. You cannot use session policies to grant more permissions than those
    /// that are defined in the permissions policy of the IAM user. For more information, see
    /// <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a>
    /// in the <i>IAM User Guide</i>. For information about using
    /// <code>GetFederationToken</code> to create temporary security credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken">GetFederationToken—Federation Through a Custom Identity Broker</a>. </p>
    /// <p>You can use the credentials to access a resource that has a resource-based policy. If
    /// that policy specifically references the federated user session in the
    /// <code>Principal</code> element of the policy, the session has the permissions
    /// allowed by the policy. These permissions are granted in addition to the permissions
    /// granted by the session policies.</p>
    /// <p>
    /// <b>Tags</b>
    /// </p>
    /// <p>(Optional) You can pass tag key-value pairs to your session. These are called session
    /// tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in
    /// the <i>IAM User Guide</i>.</p>
    /// <p>An administrator must grant you the permissions necessary to pass session tags. The
    /// administrator can also create granular permissions to allow you to pass only specific
    /// session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial: Using
    /// Tags for Attribute-Based Access Control</a> in the
    /// <i>IAM User Guide</i>.</p>
    /// <p>Tag key–value pairs are not case sensitive, but case is preserved. This means that you
    /// cannot have separate <code>Department</code> and <code>department</code> tag keys.
    /// Assume that the user that you are federating has the
    /// <code>Department</code>=<code>Marketing</code> tag and you pass the
    /// <code>department</code>=<code>engineering</code> session tag.
    /// <code>Department</code> and <code>department</code> are not saved as separate tags,
    /// and the session tag passed in the request takes precedence over the user tag.</p>
    #[derive(std::fmt::Debug)]
    pub struct GetFederationToken<
        C = aws_smithy_client::erase::DynConnector,
        M = aws_hyper::AwsMiddleware,
        R = aws_smithy_client::retry::Standard,
    > {
        handle: std::sync::Arc<super::Handle<C, M, R>>,
        inner: crate::input::get_federation_token_input::Builder,
    }
    impl<C, M, R> GetFederationToken<C, M, R>
    where
        C: aws_smithy_client::bounds::SmithyConnector,
        M: aws_smithy_client::bounds::SmithyMiddleware<C>,
        R: aws_smithy_client::retry::NewRequestPolicy,
    {
        /// Creates a new `GetFederationToken`.
        pub(crate) fn new(handle: std::sync::Arc<super::Handle<C, M, R>>) -> Self {
            Self {
                handle,
                inner: Default::default(),
            }
        }

        /// Sends the request and returns the response.
        ///
        /// If an error occurs, an `SdkError` will be returned with additional details that
        /// can be matched against.
        ///
        /// By default, any retryable failures will be retried twice. Retry behavior
        /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
        /// set when configuring the client.
        pub async fn send(
            self,
        ) -> std::result::Result<
            crate::output::GetFederationTokenOutput,
            aws_smithy_http::result::SdkError<crate::error::GetFederationTokenError>,
        >
        where
            R::Policy: aws_smithy_client::bounds::SmithyRetryPolicy<
                crate::input::GetFederationTokenInputOperationOutputAlias,
                crate::output::GetFederationTokenOutput,
                crate::error::GetFederationTokenError,
                crate::input::GetFederationTokenInputOperationRetryAlias,
            >,
        {
            let input = self.inner.build().map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            let op = input.make_operation(&self.handle.conf).map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            self.handle.client.call(op).await
        }
        /// <p>The name of the federated user. The name is used as an identifier for the temporary
        /// security credentials (such as <code>Bob</code>). For example, you can reference the
        /// federated user name in a resource-based policy, such as in an Amazon S3 bucket policy.</p>
        /// <p>The regex used to validate this parameter is a string of characters
        /// consisting of upper- and lower-case alphanumeric characters with no spaces. You can
        /// also include underscores or any of the following characters: =,.@-</p>
        pub fn name(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.name(inp);
            self
        }
        /// <p>The name of the federated user. The name is used as an identifier for the temporary
        /// security credentials (such as <code>Bob</code>). For example, you can reference the
        /// federated user name in a resource-based policy, such as in an Amazon S3 bucket policy.</p>
        /// <p>The regex used to validate this parameter is a string of characters
        /// consisting of upper- and lower-case alphanumeric characters with no spaces. You can
        /// also include underscores or any of the following characters: =,.@-</p>
        pub fn set_name(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_name(input);
            self
        }
        /// <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
        /// <p>You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policy</a> to
        /// this operation. You can pass a single JSON policy document to use as an inline session
        /// policy. You can also specify up to 10 managed policies to use as managed session
        /// policies.</p>
        /// <p>This parameter is optional. However, if you do not pass any session policies, then the
        /// resulting federated user session has no permissions.</p>
        /// <p>When you pass session policies, the session permissions are the intersection of the
        /// IAM user policies and the session policies that you pass. This gives you a way to further
        /// restrict the permissions for a federated user. You cannot use session policies to grant
        /// more permissions than those that are defined in the permissions policy of the IAM user.
        /// For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
        /// the <i>IAM User Guide</i>.</p>
        /// <p>The resulting credentials can be used to access a resource that has a resource-based
        /// policy. If that policy specifically references the federated user session in the
        /// <code>Principal</code> element of the policy, the session has the permissions allowed by
        /// the policy. These permissions are granted in addition to the permissions that are granted
        /// by the session policies.</p>
        /// <p>The plaintext that you use for both inline and managed session policies can't exceed
        /// 2,048 characters. The JSON policy characters can be any ASCII character from the space
        /// character to the end of the valid character list (\u0020 through \u00FF). It can also
        /// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D)
        /// characters.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn policy(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.policy(inp);
            self
        }
        /// <p>An IAM policy in JSON format that you want to use as an inline session policy.</p>
        /// <p>You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policy</a> to
        /// this operation. You can pass a single JSON policy document to use as an inline session
        /// policy. You can also specify up to 10 managed policies to use as managed session
        /// policies.</p>
        /// <p>This parameter is optional. However, if you do not pass any session policies, then the
        /// resulting federated user session has no permissions.</p>
        /// <p>When you pass session policies, the session permissions are the intersection of the
        /// IAM user policies and the session policies that you pass. This gives you a way to further
        /// restrict the permissions for a federated user. You cannot use session policies to grant
        /// more permissions than those that are defined in the permissions policy of the IAM user.
        /// For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
        /// the <i>IAM User Guide</i>.</p>
        /// <p>The resulting credentials can be used to access a resource that has a resource-based
        /// policy. If that policy specifically references the federated user session in the
        /// <code>Principal</code> element of the policy, the session has the permissions allowed by
        /// the policy. These permissions are granted in addition to the permissions that are granted
        /// by the session policies.</p>
        /// <p>The plaintext that you use for both inline and managed session policies can't exceed
        /// 2,048 characters. The JSON policy characters can be any ASCII character from the space
        /// character to the end of the valid character list (\u0020 through \u00FF). It can also
        /// include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D)
        /// characters.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn set_policy(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_policy(input);
            self
        }
        /// Appends an item to `PolicyArns`.
        ///
        /// To override the contents of this collection use [`set_policy_arns`](Self::set_policy_arns).
        ///
        /// <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as a
        /// managed session policy. The policies must exist in the same account as the IAM user that
        /// is requesting federated access.</p>
        /// <p>You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policy</a> to
        /// this operation. You can pass a single JSON policy document to use as an inline session
        /// policy. You can also specify up to 10 managed policies to use as managed session policies.
        /// The plaintext that you use for both inline and managed session policies can't exceed 2,048
        /// characters. You can provide up to 10 managed policy ARNs. For more information about ARNs,
        /// see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon
        /// Resource Names (ARNs) and Amazon Web Services Service Namespaces</a> in the Amazon Web Services General Reference.</p>
        /// <p>This parameter is optional. However, if you do not pass any session policies, then the
        /// resulting federated user session has no permissions.</p>
        /// <p>When you pass session policies, the session permissions are the intersection of the
        /// IAM user policies and the session policies that you pass. This gives you a way to further
        /// restrict the permissions for a federated user. You cannot use session policies to grant
        /// more permissions than those that are defined in the permissions policy of the IAM user.
        /// For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
        /// the <i>IAM User Guide</i>.</p>
        /// <p>The resulting credentials can be used to access a resource that has a resource-based
        /// policy. If that policy specifically references the federated user session in the
        /// <code>Principal</code> element of the policy, the session has the permissions allowed by
        /// the policy. These permissions are granted in addition to the permissions that are granted
        /// by the session policies.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn policy_arns(mut self, inp: impl Into<crate::model::PolicyDescriptorType>) -> Self {
            self.inner = self.inner.policy_arns(inp);
            self
        }
        /// <p>The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as a
        /// managed session policy. The policies must exist in the same account as the IAM user that
        /// is requesting federated access.</p>
        /// <p>You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policy</a> to
        /// this operation. You can pass a single JSON policy document to use as an inline session
        /// policy. You can also specify up to 10 managed policies to use as managed session policies.
        /// The plaintext that you use for both inline and managed session policies can't exceed 2,048
        /// characters. You can provide up to 10 managed policy ARNs. For more information about ARNs,
        /// see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon
        /// Resource Names (ARNs) and Amazon Web Services Service Namespaces</a> in the Amazon Web Services General Reference.</p>
        /// <p>This parameter is optional. However, if you do not pass any session policies, then the
        /// resulting federated user session has no permissions.</p>
        /// <p>When you pass session policies, the session permissions are the intersection of the
        /// IAM user policies and the session policies that you pass. This gives you a way to further
        /// restrict the permissions for a federated user. You cannot use session policies to grant
        /// more permissions than those that are defined in the permissions policy of the IAM user.
        /// For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session Policies</a> in
        /// the <i>IAM User Guide</i>.</p>
        /// <p>The resulting credentials can be used to access a resource that has a resource-based
        /// policy. If that policy specifically references the federated user session in the
        /// <code>Principal</code> element of the policy, the session has the permissions allowed by
        /// the policy. These permissions are granted in addition to the permissions that are granted
        /// by the session policies.</p>
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        pub fn set_policy_arns(
            mut self,
            input: std::option::Option<std::vec::Vec<crate::model::PolicyDescriptorType>>,
        ) -> Self {
            self.inner = self.inner.set_policy_arns(input);
            self
        }
        /// <p>The duration, in seconds, that the session should last. Acceptable durations for
        /// federation sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with
        /// 43,200 seconds (12 hours) as the default. Sessions obtained using Amazon Web Services account root user
        /// credentials are restricted to a maximum of 3,600 seconds (one hour). If the specified
        /// duration is longer than one hour, the session obtained by using root user credentials
        /// defaults to one hour.</p>
        pub fn duration_seconds(mut self, inp: i32) -> Self {
            self.inner = self.inner.duration_seconds(inp);
            self
        }
        /// <p>The duration, in seconds, that the session should last. Acceptable durations for
        /// federation sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with
        /// 43,200 seconds (12 hours) as the default. Sessions obtained using Amazon Web Services account root user
        /// credentials are restricted to a maximum of 3,600 seconds (one hour). If the specified
        /// duration is longer than one hour, the session obtained by using root user credentials
        /// defaults to one hour.</p>
        pub fn set_duration_seconds(mut self, input: std::option::Option<i32>) -> Self {
            self.inner = self.inner.set_duration_seconds(input);
            self
        }
        /// Appends an item to `Tags`.
        ///
        /// To override the contents of this collection use [`set_tags`](Self::set_tags).
        ///
        /// <p>A list of session tags. Each session tag consists of a key name and an associated value.
        /// For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>This parameter is optional. You can pass up to 50 session tags. The plaintext session
        /// tag keys can’t exceed 128 characters and the values can’t exceed 256 characters. For these
        /// and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
        /// and STS Character Limits</a> in the <i>IAM User Guide</i>.</p>
        ///
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        /// <p>You can pass a session tag with the same key as a tag that is already
        /// attached to the user you are federating. When you do, session tags override a user tag with
        /// the same key. </p>
        /// <p>Tag key–value pairs are not case sensitive, but case is preserved. This means that you
        /// cannot have separate <code>Department</code> and <code>department</code> tag keys. Assume
        /// that the role has the <code>Department</code>=<code>Marketing</code> tag and you pass the
        /// <code>department</code>=<code>engineering</code> session tag. <code>Department</code>
        /// and <code>department</code> are not saved as separate tags, and the session tag passed in
        /// the request takes precedence over the role tag.</p>
        pub fn tags(mut self, inp: impl Into<crate::model::Tag>) -> Self {
            self.inner = self.inner.tags(inp);
            self
        }
        /// <p>A list of session tags. Each session tag consists of a key name and an associated value.
        /// For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
        /// <i>IAM User Guide</i>.</p>
        /// <p>This parameter is optional. You can pass up to 50 session tags. The plaintext session
        /// tag keys can’t exceed 128 characters and the values can’t exceed 256 characters. For these
        /// and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
        /// and STS Character Limits</a> in the <i>IAM User Guide</i>.</p>
        ///
        /// <note>
        /// <p>An Amazon Web Services conversion compresses the passed session policies and session tags into a
        /// packed binary format that has a separate limit. Your request can fail for this limit
        /// even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
        /// response element indicates by percentage how close the policies and tags for your
        /// request are to the upper size limit.
        /// </p>
        /// </note>
        /// <p>You can pass a session tag with the same key as a tag that is already
        /// attached to the user you are federating. When you do, session tags override a user tag with
        /// the same key. </p>
        /// <p>Tag key–value pairs are not case sensitive, but case is preserved. This means that you
        /// cannot have separate <code>Department</code> and <code>department</code> tag keys. Assume
        /// that the role has the <code>Department</code>=<code>Marketing</code> tag and you pass the
        /// <code>department</code>=<code>engineering</code> session tag. <code>Department</code>
        /// and <code>department</code> are not saved as separate tags, and the session tag passed in
        /// the request takes precedence over the role tag.</p>
        pub fn set_tags(
            mut self,
            input: std::option::Option<std::vec::Vec<crate::model::Tag>>,
        ) -> Self {
            self.inner = self.inner.set_tags(input);
            self
        }
    }
    /// Fluent builder constructing a request to `GetSessionToken`.
    ///
    /// <p>Returns a set of temporary credentials for an Amazon Web Services account or IAM user. The
    /// credentials consist of an access key ID, a secret access key, and a security token.
    /// Typically, you use <code>GetSessionToken</code> if you want to use MFA to protect
    /// programmatic calls to specific Amazon Web Services API operations like Amazon EC2 <code>StopInstances</code>.
    /// MFA-enabled IAM users would need to call <code>GetSessionToken</code> and submit an MFA
    /// code that is associated with their MFA device. Using the temporary security credentials
    /// that are returned from the call, IAM users can then make programmatic calls to API
    /// operations that require MFA authentication. If you do not supply a correct MFA code, then
    /// the API returns an access denied error. For a comparison of <code>GetSessionToken</code>
    /// with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
    /// Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing the
    /// STS API operations</a> in the <i>IAM User Guide</i>.</p>
    /// <p>
    /// <b>Session Duration</b>
    /// </p>
    /// <p>The <code>GetSessionToken</code> operation must be called by using the long-term Amazon Web Services
    /// security credentials of the Amazon Web Services account root user or an IAM user. Credentials that are
    /// created by IAM users are valid for the duration that you specify. This duration can range
    /// from 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours), with a default
    /// of 43,200 seconds (12 hours). Credentials based on account credentials can range from 900
    /// seconds (15 minutes) up to 3,600 seconds (1 hour), with a default of 1 hour. </p>
    /// <p>
    /// <b>Permissions</b>
    /// </p>
    /// <p>The temporary security credentials created by <code>GetSessionToken</code> can be used
    /// to make API calls to any Amazon Web Services service with the following exceptions:</p>
    /// <ul>
    /// <li>
    /// <p>You cannot call any IAM API operations unless MFA authentication information is
    /// included in the request.</p>
    /// </li>
    /// <li>
    /// <p>You cannot call any STS API <i>except</i>
    /// <code>AssumeRole</code> or <code>GetCallerIdentity</code>.</p>
    /// </li>
    /// </ul>
    /// <note>
    /// <p>We recommend that you do not call <code>GetSessionToken</code> with Amazon Web Services account
    /// root user credentials. Instead, follow our <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users">best practices</a> by
    /// creating one or more IAM users, giving them the necessary permissions, and using IAM
    /// users for everyday interaction with Amazon Web Services. </p>
    /// </note>
    /// <p>The credentials that are returned by <code>GetSessionToken</code> are based on
    /// permissions associated with the user whose credentials were used to call the operation. If
    /// <code>GetSessionToken</code> is called using Amazon Web Services account root user credentials, the
    /// temporary credentials have root user permissions. Similarly, if
    /// <code>GetSessionToken</code> is called using the credentials of an IAM user, the
    /// temporary credentials have the same permissions as the IAM user. </p>
    /// <p>For more information about using <code>GetSessionToken</code> to create temporary
    /// credentials, go to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken">Temporary
    /// Credentials for Users in Untrusted Environments</a> in the
    /// <i>IAM User Guide</i>. </p>
    #[derive(std::fmt::Debug)]
    pub struct GetSessionToken<
        C = aws_smithy_client::erase::DynConnector,
        M = aws_hyper::AwsMiddleware,
        R = aws_smithy_client::retry::Standard,
    > {
        handle: std::sync::Arc<super::Handle<C, M, R>>,
        inner: crate::input::get_session_token_input::Builder,
    }
    impl<C, M, R> GetSessionToken<C, M, R>
    where
        C: aws_smithy_client::bounds::SmithyConnector,
        M: aws_smithy_client::bounds::SmithyMiddleware<C>,
        R: aws_smithy_client::retry::NewRequestPolicy,
    {
        /// Creates a new `GetSessionToken`.
        pub(crate) fn new(handle: std::sync::Arc<super::Handle<C, M, R>>) -> Self {
            Self {
                handle,
                inner: Default::default(),
            }
        }

        /// Sends the request and returns the response.
        ///
        /// If an error occurs, an `SdkError` will be returned with additional details that
        /// can be matched against.
        ///
        /// By default, any retryable failures will be retried twice. Retry behavior
        /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
        /// set when configuring the client.
        pub async fn send(
            self,
        ) -> std::result::Result<
            crate::output::GetSessionTokenOutput,
            aws_smithy_http::result::SdkError<crate::error::GetSessionTokenError>,
        >
        where
            R::Policy: aws_smithy_client::bounds::SmithyRetryPolicy<
                crate::input::GetSessionTokenInputOperationOutputAlias,
                crate::output::GetSessionTokenOutput,
                crate::error::GetSessionTokenError,
                crate::input::GetSessionTokenInputOperationRetryAlias,
            >,
        {
            let input = self.inner.build().map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            let op = input.make_operation(&self.handle.conf).map_err(|err| {
                aws_smithy_http::result::SdkError::ConstructionFailure(err.into())
            })?;
            self.handle.client.call(op).await
        }
        /// <p>The duration, in seconds, that the credentials should remain valid. Acceptable
        /// durations for IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds
        /// (36 hours), with 43,200 seconds (12 hours) as the default. Sessions for Amazon Web Services account
        /// owners are restricted to a maximum of 3,600 seconds (one hour). If the duration is
        /// longer than one hour, the session for Amazon Web Services account owners defaults to one hour.</p>
        pub fn duration_seconds(mut self, inp: i32) -> Self {
            self.inner = self.inner.duration_seconds(inp);
            self
        }
        /// <p>The duration, in seconds, that the credentials should remain valid. Acceptable
        /// durations for IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds
        /// (36 hours), with 43,200 seconds (12 hours) as the default. Sessions for Amazon Web Services account
        /// owners are restricted to a maximum of 3,600 seconds (one hour). If the duration is
        /// longer than one hour, the session for Amazon Web Services account owners defaults to one hour.</p>
        pub fn set_duration_seconds(mut self, input: std::option::Option<i32>) -> Self {
            self.inner = self.inner.set_duration_seconds(input);
            self
        }
        /// <p>The identification number of the MFA device that is associated with the IAM user who
        /// is making the <code>GetSessionToken</code> call. Specify this value if the IAM user
        /// has a policy that requires MFA authentication. The value is either the serial number for
        /// a hardware device (such as <code>GAHT12345678</code>) or an Amazon Resource Name (ARN)
        /// for a virtual device (such as <code>arn:aws:iam::123456789012:mfa/user</code>). You can
        /// find the device for an IAM user by going to the Management Console and viewing the user's
        /// security credentials. </p>
        /// <p>The regex used to validate this parameter is a string of
        /// characters consisting of upper- and lower-case alphanumeric characters with no spaces.
        /// You can also include underscores or any of the following characters: =,.@:/-</p>
        pub fn serial_number(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.serial_number(inp);
            self
        }
        /// <p>The identification number of the MFA device that is associated with the IAM user who
        /// is making the <code>GetSessionToken</code> call. Specify this value if the IAM user
        /// has a policy that requires MFA authentication. The value is either the serial number for
        /// a hardware device (such as <code>GAHT12345678</code>) or an Amazon Resource Name (ARN)
        /// for a virtual device (such as <code>arn:aws:iam::123456789012:mfa/user</code>). You can
        /// find the device for an IAM user by going to the Management Console and viewing the user's
        /// security credentials. </p>
        /// <p>The regex used to validate this parameter is a string of
        /// characters consisting of upper- and lower-case alphanumeric characters with no spaces.
        /// You can also include underscores or any of the following characters: =,.@:/-</p>
        pub fn set_serial_number(
            mut self,
            input: std::option::Option<std::string::String>,
        ) -> Self {
            self.inner = self.inner.set_serial_number(input);
            self
        }
        /// <p>The value provided by the MFA device, if MFA is required. If any policy requires the
        /// IAM user to submit an MFA code, specify this value. If MFA authentication is required,
        /// the user must provide a code when requesting a set of temporary security credentials. A
        /// user who fails to provide the code receives an "access denied" response when requesting
        /// resources that require MFA authentication.</p>
        /// <p>The format for this parameter, as described by its regex pattern, is a sequence of six
        /// numeric digits.</p>
        pub fn token_code(mut self, inp: impl Into<std::string::String>) -> Self {
            self.inner = self.inner.token_code(inp);
            self
        }
        /// <p>The value provided by the MFA device, if MFA is required. If any policy requires the
        /// IAM user to submit an MFA code, specify this value. If MFA authentication is required,
        /// the user must provide a code when requesting a set of temporary security credentials. A
        /// user who fails to provide the code receives an "access denied" response when requesting
        /// resources that require MFA authentication.</p>
        /// <p>The format for this parameter, as described by its regex pattern, is a sequence of six
        /// numeric digits.</p>
        pub fn set_token_code(mut self, input: std::option::Option<std::string::String>) -> Self {
            self.inner = self.inner.set_token_code(input);
            self
        }
    }
}
impl<C> Client<C, aws_hyper::AwsMiddleware, aws_smithy_client::retry::Standard> {
    /// Creates a client with the given service config and connector override.
    pub fn from_conf_conn(conf: crate::Config, conn: C) -> Self {
        let retry_config = conf.retry_config.as_ref().cloned().unwrap_or_default();
        let client = aws_hyper::Client::new(conn).with_retry_config(retry_config.into());
        Self {
            handle: std::sync::Arc::new(Handle { client, conf }),
        }
    }
}
impl
    Client<
        aws_smithy_client::erase::DynConnector,
        aws_hyper::AwsMiddleware,
        aws_smithy_client::retry::Standard,
    >
{
    /// Creates a new client from a shared config.
    #[cfg(any(feature = "rustls", feature = "native-tls"))]
    pub fn new(config: &aws_types::config::Config) -> Self {
        Self::from_conf(config.into())
    }

    /// Creates a new client from the service [`Config`](crate::Config).
    #[cfg(any(feature = "rustls", feature = "native-tls"))]
    pub fn from_conf(conf: crate::Config) -> Self {
        let retry_config = conf.retry_config.as_ref().cloned().unwrap_or_default();
        let client = aws_hyper::Client::https().with_retry_config(retry_config.into());
        Self {
            handle: std::sync::Arc::new(Handle { client, conf }),
        }
    }
}