STS即Secure Token Service 是一種安全憑證服務，可以使用STS來完成對于臨時用戶的訪問授權。對于跨用戶短期訪問對象存儲資源時，可以使用STS服務。這樣就不需要透露主賬號AK/SK，只需要生成一個短期訪問憑證給需要的用戶使用即可，避免主賬號AK/SK泄露帶來的安全風險。

初始化STS服務

String accessKey = "<your-access-key>";
String secretKey = "<your-secret-access-key>";
String endPoint = "<your-endpoint>";
BasicAWSCredentials credentials = new BasicAWSCredentials(accessKey, secretKey);
        AwsClientBuilder.EndpointConfiguration endpointConfiguration =
                new AwsClientBuilder.EndpointConfiguration(endPoint, Regions.DEFAULT_REGION.getName());
        return AWSSecurityTokenServiceClientBuilder.standard()
                .withCredentials(new AWSStaticCredentialsProvider(credentials))
                .withEndpointConfiguration(endpointConfiguration)
                .build();

獲取臨時token

private static final String DEFAULT_BUCKET = "<your-bucket-name>";
private static final String ROLE_SESSION_NAME = "<your-session-name>";
private static final String ARN = "arn:aws:iam:::role/xxxxxx";
private static final String POLICY = "{\"Version\":\"2012-10-17\"," + "\"Statement\":" + "{\"Effect\":\"Allow\","
        + "\"Action\":[\"s3:*\"]," // 允許進行 S3 的所有操作。如果僅需要上傳，這里可以設置為 PutObject
        + "\"Resource\":[\"arn:aws:s3:::" + DEFAULT_BUCKET + "\",\"arn:aws:s3:::" + DEFAULT_BUCKET + "/*\"]"// 允許操作默認桶中的所有文件，可以修改此處來保證操作的文件
            + "}}";
            
public static void assumeRole() {
    try {
        AWSSecurityTokenService stsClient = buildSTSClient();
        AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest();
        assumeRoleRequest.setRoleArn(ARN);
        assumeRoleRequest.setPolicy(POLICY);
        assumeRoleRequest.setRoleSessionName(ROLE_SESSION_NAME);
        assumeRoleRequest.setDurationSeconds(60*60*2);      // 單位秒，有效時間，默認1小時，最長12小時
?
        System.out.println("policy=" + POLICY);
        AssumeRoleResult assumeRoleRes = stsClient.assumeRole(assumeRoleRequest);
        Credentials stsCredentials = assumeRoleRes.getCredentials();
        System.out.println("ak=" + stsCredentials.getAccessKeyId());
        System.out.println("sk=" + stsCredentials.getSecretAccessKey());
        System.out.println("token=" + stsCredentials.getSessionToken());
    } catch (Exception e) {
        e.printStackTrace();
    }
}

請求參數

Policy設置例子

• 允許所有的操作

{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:*"],"Resource":["arn:aws:s3:::<your-bucket-name>","arn:aws:s3:::<your-bucket-name>/*"]}}

• 限制只能上傳和下載

{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:PutObject","s3:GetObject"],"Resource":["arn:aws:s3:::<your-bucket-name>","arn:aws:s3:::<your-bucket-name>/*"]}}

• 使用分片上傳

{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:PutObject","s3:AbortMultipartUpload","s3:ListBucketMultipartUploads","s3:ListMultipartUploadParts"],"Resource":["arn:aws:s3:::<your-bucket-name>","arn:aws:s3:::<your-bucket-name>/*"]}}

• 其他常見操作權限：

  • 上傳權限：s3:PutObject

  • 下載權限：s3:GetObject

  • 刪除權限：s3:DeleteObject

  • 獲取列表權限：s3:ListBucket

更多權限可參考：桶策略。

使用臨時token

• 實現一個CredentialsProvider，支持更新ak/sk和token。

public class MyCredentialsProvider implements AWSCredentialsProvider {
    private AWSCredentials credentials;
?
    public MyCredentialsProvider(String ak, String sk, String token) {
        this.credentials = new BasicSessionCredentials(ak, sk, token);
    }
?
    public synchronized AWSCredentials getCredentials() {
        return credentials;
    }
?
    public synchronized void refresh() {
    }
?
    // 更新ak,sk,token
    public synchronized void updateCred(String ak, String sk, String token) {
        this.credentials = new BasicSessionCredentials(ak, sk, token);
    }
}

• 使用臨時token

String secretKey = "<your-secret-access-key>";
String endPoint = "<your-endpoint>";
String sessionToken = "<your-session-token>";
MyCredentialsProvider credProvider = new MyCredentialsProvider(accessKey, secretKey, sessionToken);
ClientConfiguration clientConfiguration = new ClientConfiguration();
AwsClientBuilder.EndpointConfiguration endpointConfiguration = new AwsClientBuilder.EndpointConfiguration(
        endPoint, Regions.DEFAULT_REGION.getName());
return AmazonS3ClientBuilder.standard()
        .withCredentials(credProvider)
        .withClientConfiguration(clientConfiguration)
        .withEndpointConfiguration(endpointConfiguration)
        .build();