AWS/IAM Policy - Revision history

Pio2pio: /* AWS policies, in my own words.. */

2020-07-12T17:08:11Z

AWS policies, in my own words..

@@ Line 1: / Line 1: @@
 <div class="titlepage"><div><div>
 = AWS policies, in my own words.. =
 ;resource policy: attached to a resource directly, evaluate whether a user can access/denied to the resource
 ;capability policies: (IAM docs refer to user-based permissions) also known 'user policy or group policies' defines what actions a user/group/role is allowed or denied. These policies can override 'resource policies' by explicitly deny actions
 ;IAM policies: eg. can restrict access to IP range, based on day and time
 = IAM Policy Elements Reference =

Pio2pio: Pio2pio moved page AWS IAM Policy to AWS/IAM Policy without leaving a redirect

2018-12-20T19:29:20Z

Pio2pio moved page AWS IAM Policy to AWS/IAM Policy without leaving a redirect

← Older revision	Revision as of 21:29, 20 December 2018
(No difference)

Pio2pio: /* IAM Policy Elements Reference */

2017-11-25T20:01:15Z

IAM Policy Elements Reference

← Older revision		Revision as of 22:01, 25 November 2017
Line 1:		Line 1:
	<div class="titlepage"><div><div>		<div class="titlepage"><div><div>
			= AWS policies, in my own words.. =
			;resource policy: attached to a resource directly, evaluate whether a user can access/denied to the resource
			;capability policies: (IAM docs refer to user-based permissions) also known 'user policy or group policies' defines what actions a user/group/role is allowed or denied. These policies can override 'resource policies' by explicitly deny actions
			;IAM policies: eg. can restrict access to IP range, based on day and time

	= IAM Policy Elements Reference =		= IAM Policy Elements Reference =
	</div></div></div>		</div></div></div>

Pio2pio: /* Supported Data Types */

2014-04-18T06:37:31Z

Supported Data Types

← Older revision		Revision as of 08:37, 18 April 2014
Line 963:		Line 963:

	\|}		\|}

			= References =
			*[http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html IAM Policy Elements Reference]

Pio2pio: /* Condition Types */

2014-04-18T06:33:55Z

Condition Types

← Older revision		Revision as of 08:33, 18 April 2014
Line 466:		Line 466:
	These are the types of conditions you can specify:		These are the types of conditions you can specify:
	<div class="itemizedlist">		<div class="itemizedlist">
	*		* String
	String		* Numeric
			* Date and time
	*		* Boolean
	Numeric		* Binary
			* IP address
	*		* Amazon Resource Name (ARN). (This value is available for only some services.)
	Date and time		* ...IfExists
			* Existence of condition keys
	*
	Boolean

	*
	Binary

	*
	IP address

	*
	Amazon Resource Name (ARN). (This value is available for only some services.)

	*
	...IfExists

	*
	Existence of condition keys
	</div><div class="section"><div class="titlepage"><div><div>		</div><div class="section"><div class="titlepage"><div><div>
	==== String Conditions ====		==== String Conditions ====
Line 898:		Line 881:
	]		]
	}</pre></div></div></div>		}</pre></div></div></div>

	== Supported Data Types ==		== Supported Data Types ==

Pio2pio: /* Available Keys for SAML-Based Federation */

2014-04-18T06:33:22Z

Available Keys for SAML-Based Federation

← Older revision		Revision as of 08:33, 18 April 2014
Line 394:		Line 394:
	In the trust policy of a role, you can include the following keys, which help you establish whether the caller is allowed to assume the role. Except for <code class="code">saml:doc</code>, all the values are derived from the SAML assertion. Items in the list that are marked with an asterisk (*) are available in the console UI to create conditions.		In the trust policy of a role, you can include the following keys, which help you establish whether the caller is allowed to assume the role. Except for <code class="code">saml:doc</code>, all the values are derived from the SAML assertion. Items in the list that are marked with an asterisk (*) are available in the console UI to create conditions.
	<div class="itemizedlist">		<div class="itemizedlist">
	*		* <code class="code">saml:aud</code> (URL). An endpoint to which SAML assertions are presented.
	<code class="code">saml:aud</code> (URL). An endpoint to which SAML assertions are presented.

	*		* <code class="code">saml:cn</code> (list). This is an <code class="code">eduOrg</code> attribute.
	<code class="code">saml:cn</code> (list). This is an <code class="code">eduOrg</code> attribute.

	*		* <code class="code">saml:doc</code> (string).* This represents the principal that was used to assume the role. The format is ''<code>account-ID</code>''/''<code>document-friendly-name</code>'', such as <code class="code">123456789012/Metadata_Document</code>. The <span class="italic">account-ID</span> value refers to the account that owns the [http://docs.aws.amazon.com/IAM/latest/UserGuide/idp-managing-identityproviders.html SAML provider].
	<code class="code">saml:doc</code> (string).* This represents the principal that was used to assume the role. The format is ''<code>account-ID</code>''/''<code>document-friendly-name</code>'', such as <code class="code">123456789012/Metadata_Document</code>. The <span class="italic">account-ID</span> value refers to the account that owns the [http://docs.aws.amazon.com/IAM/latest/UserGuide/idp-managing-identityproviders.html SAML provider].

	*		* <code class="code">saml:edupersonaffiliation</code> (list). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonaffiliation</code> (list). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonassurance</code> (list). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonassurance</code> (list). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonentitlement</code> (list).* This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonentitlement</code> (list).* This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonnickname</code> (list). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonnickname</code> (list). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonorgdn</code> (string).* This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonorgdn</code> (string).* This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonorgunitdn</code> (list). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonorgunitdn</code> (list). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonprimaryaffiliation</code> (string). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonprimaryaffiliation</code> (string). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonprimaryorgunitdn</code> (string). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonprimaryorgunitdn</code> (string). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonprincipalname</code> (string). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonprincipalname</code> (string). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersonscopedaffiliation</code> (list). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersonscopedaffiliation</code> (list). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:edupersontargetedid</code> (list). This is an <code class="code">eduPerson</code> attribute.
	<code class="code">saml:edupersontargetedid</code> (list). This is an <code class="code">eduPerson</code> attribute.

	*		* <code class="code">saml:eduorghomepageuri</code> (list). This is an <code class="code">eduOrg</code> attribute.
	<code class="code">saml:eduorghomepageuri</code> (list). This is an <code class="code">eduOrg</code> attribute.

	*		* <code class="code">saml:eduorgidentityauthnpolicyuri</code> (list). This is an <code class="code">eduOrg</code> attribute.
	<code class="code">saml:eduorgidentityauthnpolicyuri</code> (list). This is an <code class="code">eduOrg</code> attribute.

	*		* <code class="code">saml:eduorglegalname</code> (list). This is an <code class="code">eduOrg</code> attribute.
	<code class="code">saml:eduorglegalname</code> (list). This is an <code class="code">eduOrg</code> attribute.

	*		* <code class="code">saml:eduorgsuperioruri</code> (list). This is an <code class="code">eduOrg</code> attribute.
	<code class="code">saml:eduorgsuperioruri</code> (list). This is an <code class="code">eduOrg</code> attribute.

	*		* <code class="code">saml:eduorgwhitepagesuri</code> (list). This is an <code class="code">eduOrg</code> attribute.
	<code class="code">saml:eduorgwhitepagesuri</code> (list). This is an <code class="code">eduOrg</code> attribute.

	*		* <code class="code">saml:iss</code> (string).* The issuer, which is represented by a URN.
	<code class="code">saml:iss</code> (string).* The issuer, which is represented by a URN.

	*		* <code class="code">saml:sub</code> (string).* This is the subject of the claim, which includes a value that uniquely identifies an individual user within an organization (for example, <code class="code">_cbb88bf52c2510eabe00c1642d4643f41430fe25e3</code>).
	<code class="code">saml:sub</code> (string).* This is the subject of the claim, which includes a value that uniquely identifies an individual user within an organization (for example, <code class="code">_cbb88bf52c2510eabe00c1642d4643f41430fe25e3</code>).

	*		* <code class="code">saml:sub_type</code> (string).* This key can be "persistent" or "transient". A value of "persistent" indicates that the value in <code class="code">saml:sub</code> is the same for a user between sessions. If the value is "transient", the user has a different <code class="code">saml:sub</code> value for each session.
	<code class="code">saml:sub_type</code> (string).* This key can be "persistent" or "transient". A value of "persistent" indicates that the value in <code class="code">saml:sub</code> is the same for a user between sessions. If the value is "transient", the user has a different <code class="code">saml:sub</code> value for each session.
	</div>		</div>
	For general information about <code class="code">eduPerson</code> and <code class="code">eduOrg</code> attributes, see the [https://www.internet2.edu/products-services/trust-identity-middleware/eduperson-eduorg/eduperson-eduorg-documentation/ Internet2 website]. For a list of <code class="code">eduPerson</code> attributes, see [https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html eduPerson Object Class Specification (201203)].		For general information about <code class="code">eduPerson</code> and <code class="code">eduOrg</code> attributes, see the [https://www.internet2.edu/products-services/trust-identity-middleware/eduperson-eduorg/eduperson-eduorg-documentation/ Internet2 website]. For a list of <code class="code">eduPerson</code> attributes, see [https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html eduPerson Object Class Specification (201203)].

Pio2pio: /* Available Keys for Conditions */

2014-04-18T06:32:25Z

Available Keys for Conditions

← Older revision		Revision as of 08:32, 18 April 2014
Line 329:		Line 329:
	Keys in a condition represent values that are part of the request sent by a user. AWS provides the following predefined keys for all AWS services that support IAM for access control:		Keys in a condition represent values that are part of the request sent by a user. AWS provides the following predefined keys for all AWS services that support IAM for access control:
	<div class="itemizedlist">		<div class="itemizedlist">
	*		* <code class="code">aws:CurrentTime—</code>To check for date/time conditions (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Date Date Conditions]).
	<code class="code">aws:CurrentTime—</code>To check for date/time conditions (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Date Date Conditions]).

	*		* <code class="code">aws:EpochTime—</code>To check for date/time conditions using a date in epoch or UNIX time (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Date Date Conditions]).
	<code class="code">aws:EpochTime—</code>To check for date/time conditions using a date in epoch or UNIX time (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Date Date Conditions]).

	*		* <code class="code">aws:MultiFactorAuthAge—</code>To check how long ago (in seconds) the MFA-validated security credentials making the request were issued using multi-factor authentication (MFA). Unlike other keys, if MFA is not used, this key is not present (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Null Existence of Condition Keys], [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Numeric Numeric Conditions] and [http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_ManagingMFA.html Using Multi-Factor Authentication (MFA) Devices with AWS].
	<code class="code">aws:MultiFactorAuthAge—</code>To check how long ago (in seconds) the MFA-validated security credentials making the request were issued using multi-factor authentication (MFA). Unlike other keys, if MFA is not used, this key is not present (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Null Existence of Condition Keys], [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Numeric Numeric Conditions] and [http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_ManagingMFA.html Using Multi-Factor Authentication (MFA) Devices with AWS].

	*		* <code class="code">aws:principaltype—</code>To check the type of principal (user, account, federated user, etc.) for the current request (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_String String Conditions]).
	<code class="code">aws:principaltype—</code>To check the type of principal (user, account, federated user, etc.) for the current request (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_String String Conditions]).

	*		* <code class="code">aws:SecureTransport—</code>To check whether the request was sent using SSL (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Boolean Boolean Conditions]).
	<code class="code">aws:SecureTransport—</code>To check whether the request was sent using SSL (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_Boolean Boolean Conditions]).

	*		* <code class="code">aws:SourceArn—</code>To check the source of the request, using the Amazon Resource Name (ARN) of the source. (This value is available for only some services. For more information, see [http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_ARN Amazon Resource Name (ARN)] under "Element Descriptions" in the <span class="emphasis">''Amazon Simple Queue Service Developer Guide''</span>.)
	<code class="code">aws:SourceArn—</code>To check the source of the request, using the Amazon Resource Name (ARN) of the source. (This value is available for only some services. For more information, see [http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_ARN Amazon Resource Name (ARN)] under "Element Descriptions" in the <span class="emphasis">''Amazon Simple Queue Service Developer Guide''</span>.)

	*		* <code class="code">aws:SourceIp—</code>To check the requester's IP address (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_IPAddress IP Address ]).
	<code class="code">aws:SourceIp—</code>To check the requester's IP address (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_IPAddress IP Address ]).

	*		* <code class="code">aws:UserAgent—</code>To check the requester's client application (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_String String Conditions]).
	<code class="code">aws:UserAgent—</code>To check the requester's client application (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_String String Conditions]).

	*		* <code class="code">aws:userid—</code>To check the requester's user ID (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_String String Conditions]).
	<code class="code">aws:userid—</code>To check the requester's user ID (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_String String Conditions]).

	*		* <code class="code">aws:username—</code>To check the requester's user name (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_String String Conditions]).
	<code class="code">aws:username—</code>To check the requester's user name (see [http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Conditions_String String Conditions]).
	</div><div class="aws-note">		</div><div class="aws-note">
	Note		Note
Line 493:		Line 483:
	For more information about using these keys, see [http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingSAML.html Creating Temporary Security Credentials for SAML Federation] in the <span class="emphasis">''Using Temporary Security Credentials''</span> guide.		For more information about using these keys, see [http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingSAML.html Creating Temporary Security Credentials for SAML Federation] in the <span class="emphasis">''Using Temporary Security Credentials''</span> guide.
	</div></div><div class="section"><div class="titlepage"><div><div>		</div></div><div class="section"><div class="titlepage"><div><div>

	=== Condition Types ===		=== Condition Types ===
	</div></div></div>		</div></div></div>

Pio2pio: /* Multiple Values in a Condition */

2014-04-18T06:31:41Z

Multiple Values in a Condition

← Older revision		Revision as of 08:31, 18 April 2014
Line 304:		Line 304:
	As an example, let's say you want to let user John access your Amazon SQS queue under the following conditions:		As an example, let's say you want to let user John access your Amazon SQS queue under the following conditions:
	<div class="itemizedlist">		<div class="itemizedlist">
	*		* The time is after 12:00 noon on 8/16/2013
	The time is after 12:00 noon on 8/16/2013		* The time is before 3:00 p.m. on 8/16/2013
			* The request (IAM or SQS) or message (SNS) comes from an IP address within the range 192.0.2.0 to 192.0.2.255 <span class="emphasis">''or''</span> 203.0.113.0 to 203.0.113.255.
	*
	The time is before 3:00 p.m. on 8/16/2013

	*
	The request (IAM or SQS) or message (SNS) comes from an IP address within the range 192.0.2.0 to 192.0.2.255 <span class="emphasis">''or''</span> 203.0.113.0 to 203.0.113.255.
	</div>		</div>
	Your condition block has three separate conditions, and all three of them must be met for John to have access to your queue, topic, or resource.		Your condition block has three separate conditions, and all three of them must be met for John to have access to your queue, topic, or resource.
Line 329:		Line 324:
	Finally, under some circumstances, individual keys in a policy can contain multiple values, and you can use set operators to test these multi-valued keys against one or more values listed in the policy. For more information, see [http://docs.aws.amazon.com/IAM/latest/UserGuide/conditions-setoperators.html Creating a Condition That Tests Multiple Key Values (Set Operations)].		Finally, under some circumstances, individual keys in a policy can contain multiple values, and you can use set operators to test these multi-valued keys against one or more values listed in the policy. For more information, see [http://docs.aws.amazon.com/IAM/latest/UserGuide/conditions-setoperators.html Creating a Condition That Tests Multiple Key Values (Set Operations)].
	</div></div><div class="section"><div class="titlepage"><div><div>		</div></div><div class="section"><div class="titlepage"><div><div>

	=== Available Keys for Conditions ===		=== Available Keys for Conditions ===
	</div></div></div>		</div></div></div>

Pio2pio: /* NotPrincipal */

2014-04-18T06:31:17Z

NotPrincipal

← Older revision		Revision as of 08:31, 18 April 2014
Line 175:		Line 175:

	== NotPrincipal ==		== NotPrincipal ==
	~~</div></div></div>~~
	The <code class="code">NotPrincipal</code> element lets you specify an exception to a list of principals. For example, you can use this to prevent all AWS accounts <span class="emphasis">''except''</span> a specific account from accessing a resource. Conversely, you can deny access to all principals except the one named in the <code class="code">NotPrincipal</code> element. As with <code class="code">Principal</code>, you specify the user or account that should be allowed or denied permission; the difference is that <code class="code">NotPrincipal</code> translates to everyone <span class="emphasis">''except''</span> that person or account.		The <code class="code">NotPrincipal</code> element lets you specify an exception to a list of principals. For example, you can use this to prevent all AWS accounts <span class="emphasis">''except''</span> a specific account from accessing a resource. Conversely, you can deny access to all principals except the one named in the <code class="code">NotPrincipal</code> element. As with <code class="code">Principal</code>, you specify the user or account that should be allowed or denied permission; the difference is that <code class="code">NotPrincipal</code> translates to everyone <span class="emphasis">''except''</span> that person or account.

Line 182:		Line 182:
	"NotPrincipal": {		"NotPrincipal": {
	"AWS":"arn:aws:iam::123456789012:user/Bob"		"AWS":"arn:aws:iam::123456789012:user/Bob"
	}</pre></div><div class="section"><div class="titlepage">~~<div><div>~~		}</pre></div><div class="section"><div class="titlepage">

	== Action ==		== Action ==
	</div></div></div>		</div></div></div>

Pio2pio: /* More Information */

2014-04-18T06:31:00Z

More Information

← Older revision		Revision as of 08:31, 18 April 2014
Line 167:		Line 167:
	</div></div></div>		</div></div></div>
	For more information, see the following:		For more information, see the following:
	~~<div class="itemizedlist">~~
	*
	~~[http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingIAMPolicies.html Using IAM Policies] in the <span class="emphasis">''Amazon Simple Storage Service Developer Guide''</span>~~

	*		* [http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingIAMPolicies.html Using IAM Policies] in the <span class="emphasis">''Amazon Simple Storage Service Developer Guide''</span>
	[http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html Example Cases for Amazon S3 Bucket Policies] in the <span class="emphasis">''Amazon Simple Storage Service Developer Guide''</span>		* [http://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html Example Cases for Amazon S3 Bucket Policies] in the <span class="emphasis">''Amazon Simple Storage Service Developer Guide''</span>
			* [http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/SQSExamples.html Amazon SQS Policy Examples] in the <span class="emphasis">''Amazon Simple Queue Service Developer Guide''</span>
	*		* [http://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html Account Identifiers] in the ''AWS General Reference''
	[http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/SQSExamples.html Amazon SQS Policy Examples] in the <span class="emphasis">''Amazon Simple Queue Service Developer Guide''</span>		* [http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingWIF.html Creating Temporary Security Credentials for Mobile Apps Using Third-Party Identity Providers] in the <span class="emphasis">''Using Temporary Security Credentials''</span> guide.

	*
	[http://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html Account Identifiers] in the ''AWS General Reference''

	*
	[http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingWIF.html Creating Temporary Security Credentials for Mobile Apps Using Third-Party Identity Providers] in the <span class="emphasis">''Using Temporary Security Credentials''</span> guide.
	~~</div></div></div><div class="section"><div class="titlepage"><div><div>~~

	== NotPrincipal ==		== NotPrincipal ==