{
  "description": "STSSessionToken uses the GetSessionToken API to retrieve an authorization token.\nThe authorization token is valid for 12 hours.\nThe authorizationToken returned is a base64 encoded string that can be decoded.\nFor more information, see GetSessionToken (https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html).",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "STSSessionTokenSpec defines the desired state to generate an AWS STS session token.",
      "properties": {
        "auth": {
          "description": "Auth defines how to authenticate with AWS",
          "properties": {
            "jwt": {
              "description": "AWSJWTAuth provides configuration to authenticate against AWS using service account tokens.",
              "properties": {
                "serviceAccountRef": {
                  "description": "ServiceAccountSelector is a reference to a ServiceAccount resource.",
                  "properties": {
                    "audiences": {
                      "description": "Audience specifies the `aud` claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    },
                    "name": {
                      "description": "The name of the ServiceAccount resource being referred to.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
                      "type": "string"
                    },
                    "namespace": {
                      "description": "Namespace of the resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
                      "maxLength": 63,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
                      "type": "string"
                    }
                  },
                  "required": [
                    "name"
                  ],
                  "type": "object",
                  "additionalProperties": false
                }
              },
              "type": "object",
              "additionalProperties": false
            },
            "secretRef": {
              "description": "AWSAuthSecretRef holds secret references for AWS credentials\nboth AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.",
              "properties": {
                "accessKeyIDSecretRef": {
                  "description": "The AccessKeyID is used for authentication",
                  "properties": {
                    "key": {
                      "description": "A key in the referenced Secret.\nSome instances of this field may be defaulted, in others it may be required.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[-._a-zA-Z0-9]+$",
                      "type": "string"
                    },
                    "name": {
                      "description": "The name of the Secret resource being referred to.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
                      "type": "string"
                    },
                    "namespace": {
                      "description": "The namespace of the Secret resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
                      "maxLength": 63,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                },
                "secretAccessKeySecretRef": {
                  "description": "The SecretAccessKey is used for authentication",
                  "properties": {
                    "key": {
                      "description": "A key in the referenced Secret.\nSome instances of this field may be defaulted, in others it may be required.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[-._a-zA-Z0-9]+$",
                      "type": "string"
                    },
                    "name": {
                      "description": "The name of the Secret resource being referred to.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
                      "type": "string"
                    },
                    "namespace": {
                      "description": "The namespace of the Secret resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
                      "maxLength": 63,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                },
                "sessionTokenSecretRef": {
                  "description": "The SessionToken used for authentication\nThis must be defined if AccessKeyID and SecretAccessKey are temporary credentials\nsee: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html",
                  "properties": {
                    "key": {
                      "description": "A key in the referenced Secret.\nSome instances of this field may be defaulted, in others it may be required.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[-._a-zA-Z0-9]+$",
                      "type": "string"
                    },
                    "name": {
                      "description": "The name of the Secret resource being referred to.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
                      "type": "string"
                    },
                    "namespace": {
                      "description": "The namespace of the Secret resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
                      "maxLength": 63,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                }
              },
              "type": "object",
              "additionalProperties": false
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "region": {
          "description": "Region specifies the region to operate in.",
          "type": "string"
        },
        "requestParameters": {
          "description": "RequestParameters contains parameters that can be passed to the STS service.",
          "properties": {
            "serialNumber": {
              "description": "SerialNumber is the identification number of the MFA device that is associated with the IAM user who is making\nthe GetSessionToken call.\nPossible values: hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device\n(such as arn:aws:iam::123456789012:mfa/user)",
              "type": "string"
            },
            "sessionDuration": {
              "format": "int32",
              "type": "integer"
            },
            "tokenCode": {
              "description": "TokenCode is the value provided by the MFA device, if MFA is required.",
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "role": {
          "description": "You can assume a role before making calls to the\ndesired AWS service.",
          "type": "string"
        }
      },
      "required": [
        "region"
      ],
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}