STS即Secure Token Service 是一種安全憑證服務，可以使用STS來完成對于臨時用戶的訪問授權。對于跨用戶短期訪問對象存儲資源時，可以使用STS服務。這樣就不需要透露主賬號AK/SK，只需要生成一個短期訪問憑證給需要的用戶使用即可，避免主賬號AK/SK泄露帶來的安全風險。

初始化STS服務

var config = {
    accessKeyId: "<your-access-key>",
    secretAccessKey: "<your-secret-access-key>",
    endpoint: "<your-endpoint>",
    region: "ctyun",// region固定填ctyun
};
var stsClient = new AWS.STS(config);

獲取臨時token

var params = {
    Policy: `{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:*"],"Resource":["arn:aws:s3:::<your-bucket>","arn:aws:s3:::<your-bucket>/*"]}}`,
    RoleArn: "arn:aws:iam:::role/<your-role>",
    RoleSessionName: "<your-role-session-name>",
    DurationSeconds: 900, // 過期時間
}
stsClient.assumeRole(params, function (err, data) {
    if (err) {
        console.log("Error", err);
    } else {
        console.log("Success", data);
    }
});

請求參數

Policy設置例子

• 允許所有的操作

{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:*"],"Resource":["arn:aws:s3:::<your-bucket-name>","arn:aws:s3:::<your-bucket-name>/*"]}}

• 限制只能上傳和下載

{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:PutObject","s3:GetObject"],"Resource":["arn:aws:s3:::<your-bucket-name>","arn:aws:s3:::<your-bucket-name>/*"]}}

• 使用分片上傳

{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:PutObject","s3:AbortMultipartUpload","s3:ListBucketMultipartUploads","s3:ListMultipartUploadParts"],"Resource":["arn:aws:s3:::<your-bucket-name>","arn:aws:s3:::<your-bucket-name>/*"]}}

• 其他常見操作權限：

  • 上傳權限：s3:PutObject

  • 下載權限：s3:GetObject

  • 刪除權限：s3:DeleteObject

  • 獲取列表權限：s3:ListBucket

更多權限可參考：桶策略。

使用臨時token

let S3Demo = {
    credentials: {
        accessKeyId: "<your-access-key>",
        secretAccessKey: "<your-secret-access-key>",
        sessionToken: "<your-session-token>",
    },
    s3Client: null,
?
    // 初始化s3Client
    init: function () {
        let config = {
            credentials: this.credentials,
            endpoint: "<your-endpoint>",
        };
        this.s3Client = new AWS.S3(config);
    },
}