def get_credentials_for_identity(IdentityId=None, Logins=None,
    CustomRoleArn=None):
    """
    Returns credentials for the provided identity ID. Any provided logins will be validated against supported login providers. If the token is for cognito-identity.amazonaws.com, it will be passed through to AWS Security Token Service with the appropriate role for the token.
    This is a public API. You do not need any credentials to call this API.
    See also: AWS API Documentation
    
    
    :example: response = client.get_credentials_for_identity(
        IdentityId='string',
        Logins={
            'string': 'string'
        },
        CustomRoleArn='string'
    )
    
    
    :type IdentityId: string
    :param IdentityId: [REQUIRED]
            A unique identifier in the format REGION:GUID.
            

    :type Logins: dict
    :param Logins: A set of optional name-value pairs that map provider names to provider tokens.
            (string) --
            (string) --
            

    :type CustomRoleArn: string
    :param CustomRoleArn: The Amazon Resource Name (ARN) of the role to be assumed when multiple roles were received in the token from the identity provider. For example, a SAML-based identity provider. This parameter is optional for identity providers that do not support role customization.

    :rtype: dict
    :return: {
        'IdentityId': 'string',
        'Credentials': {
            'AccessKeyId': 'string',
            'SecretKey': 'string',
            'SessionToken': 'string',
            'Expiration': datetime(2015, 1, 1)
        }
    }
    
    
    """
    pass
