swagger.yaml

openapi: "3.0.0"
info:
  title: AWS Credentials API
  version: "1.0.0"
  description: Provide temporary AWS access credentials for a given OAuth identity
  x-audience: component-internal
  x-api-id: cc1e478c-710b-4ff0-911b-88f7d53b566f
security:
  - oauth2: [uid]
paths:
  /aws-account-roles/{user_id}:
   get:
    summary: Get my AWS accounts and roles
    operationId: app.get_account_roles
    parameters:
      - name: user_id
        in: path
        required: true
        schema:
          type: string
          pattern: "^[a-zA-Z0-9-]+$"
    responses:
      "200":
        description: List of account roles
        content:
          application/json:
            schema:
              type: object
              properties:
                account_roles:
                  type: object
                  properties:
                    account_id:
                      type: string
                    account_name:
                      type: string
                    role_name:
                      type: string
  /aws-accounts/{account_id}/roles/{role_name}/credentials:
   get:
    summary: Get temporary AWS credentials for given account and role.
    operationId: app.get_credentials
    parameters:
      - name: account_id
        in: path
        required: true
        schema:
          type: string
          pattern: "^[0-9]{12}$"
      - name: role_name
        in: path
        required: true
        schema:
          type: string
          pattern: "^[a-zA-Z0-9-]+$"
    responses:
      "200":
        description: Return temporary AWS credentials
        content:
          application/json:
            schema:
              type: object
              properties:
                access_key_id:
                  type: string
                secret_access_key:
                  type: string
                session_token:
                  type: string
                expiration:
                  type: string
                  format: date-time
      "401":
        description: Unauthenticated
      "403":
        description: Access to given AWS account and role was forbidden.
components:
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        implicit:
          authorizationUrl: https://example.org/notused
          scopes:
            uid: Unique identifier of the user accessing the service