Chris Lu f9dfc0ea37 feat(iam): STS web-identity AWS-fidelity polish ...

- OIDC discovery via .well-known/openid-configuration; falls back to
  /.well-known/jwks.json when discovery is absent. Reject discovery docs
  whose issuer claim does not match the configured issuer to defend
  against issuer-substitution.
- ComputeParentUser derives a stable per-identity hash from (sub, iss).
  Surface as aws:userid in the request context and as a parent_user
  claim in the session JWT so per-user state survives token rotation.
- Per-role MaxSessionDuration (3600..43200) clamps requested
  DurationSeconds before the STS service applies its own caps.
- Tighten RoleSessionName to the AWS contract: 2..64 chars from
  [\w+=,.@-].
- Populate PackedPolicySize in AssumeRole / AssumeRoleWithWebIdentity /
  AssumeRoleWithLDAPIdentity responses as a percentage of the 2048-byte
  inline session policy budget.

2026-05-04 22:06:19 -07:00

..

constants.go

feat(s3): add STS GetFederationToken support (#8891)

2026-04-02 17:37:05 -07:00

credential_prefix_test.go

Fix STS temporary credentials to use ASIA prefix instead of AKIA (#8326)

2026-02-12 14:47:20 -08:00

parent_user_test.go

feat(iam): STS web-identity AWS-fidelity polish

2026-05-04 22:06:19 -07:00

provider_factory.go

chore: remove ~50k lines of unreachable dead code (#8913)

2026-04-03 16:04:27 -07:00

session_claims_test.go

Add session policy support to IAM (#8338)

2026-02-13 13:58:22 -08:00

session_claims.go

feat(iam): STS web-identity AWS-fidelity polish

2026-05-04 22:06:19 -07:00

session_policy.go

Add session policy support to IAM (#8338)

2026-02-13 13:58:22 -08:00

sts_service.go

feat(iam): STS web-identity AWS-fidelity polish

2026-05-04 22:06:19 -07:00

test_utils.go

chore: remove ~50k lines of unreachable dead code (#8913)

2026-04-03 16:04:27 -07:00

token_utils.go

STS: Fallback to Caller Identity when RoleArn is missing in AssumeRole (#8345)

2026-02-14 22:00:59 -08:00