764      阿裏雲  技術社區[雲棲]

使用入門__Java SDK_STS SDK使用手冊_訪問控製-阿裏雲

創建和管理角色

STS的AssumeRole接口的使用，需要在RAM中創建和管理角色，請參考RAM角色管理

使用maven創建項目

mvn archetype:generate -DgroupId=com.aliyun.sts.sample 
-DartifactId=sts-sdk-sample 
-Dpackage=com.aliyun.sts.sample 
-Dversion=1.0-SNAPSHOT

修改生成的pom.xml， 添加aliyun-java-sdk的相關依賴。以2.1.6版本為例，在 標簽內加入如下內容：

<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>aliyun-java-sdk-sts</artifactId>
  <version>2.1.6</version>
</dependency>
<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>aliyun-java-sdk-core</artifactId>
  <version>2.1.7</version>
</dependency>

aliyun-java-sdk已經加入到 https://maven-repository.com/artifact/com.aliyun

無需設置maven的settings.xml。

aliyun-java-sdk-sts使用的示例代碼

• 注意： 請修改accessKeyId和accessKeySecret為有效值。
• 在com/aliyun/sts/sample/目錄下創建Java源代碼StsServiceSample.java，內容如下：

package com.aliyun.sts.sample;
import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.http.MethodType;
import com.aliyuncs.http.ProtocolType;
import com.aliyuncs.profile.DefaultProfile;
import com.aliyuncs.profile.IClientProfile;
import com.aliyuncs.sts.model.v20150401.AssumeRoleRequest;
import com.aliyuncs.sts.model.v20150401.AssumeRoleResponse;
public class StsServiceSample {
  // 目前隻有"cn-hangzhou"這個region可用, 不要使用填寫其他region的值
  public static final String REGION_CN_HANGZHOU = "cn-hangzhou";
  // 當前 STS API 版本
  public static final String STS_API_VERSION = "2015-04-01";
  static AssumeRoleResponse assumeRole(String accessKeyId, String accessKeySecret,
                                       String roleArn, String roleSessionName, String policy,
                                       ProtocolType protocolType) throws ClientException {
    try {
      // 創建一個 Aliyun Acs Client, 用於發起 OpenAPI 請求
      IClientProfile profile = DefaultProfile.getProfile(REGION_CN_HANGZHOU, accessKeyId, accessKeySecret);
      DefaultAcsClient client = new DefaultAcsClient(profile);
      // 創建一個 AssumeRoleRequest 並設置請求參數
      final AssumeRoleRequest request = new AssumeRoleRequest();
      request.setVersion(STS_API_VERSION);
      request.setMethod(MethodType.POST);
      request.setProtocol(protocolType);
      request.setRoleArn(roleArn);
      request.setRoleSessionName(roleSessionName);
      request.setPolicy(policy);
      // 發起請求，並得到response
      final AssumeRoleResponse response = client.getAcsResponse(request);
      return response;
    } catch (ClientException e) {
      throw e;
    }
  }
  public static void main(String[] args) {
    // 隻有 RAM用戶（子賬號）才能調用 AssumeRole 接口
    // 阿裏雲主賬號的AccessKeys不能用於發起AssumeRole請求
    // 請首先在RAM控製台創建一個RAM用戶，並為這個用戶創建AccessKeys
    String accessKeyId = "o************F";
    String accessKeySecret = "y*******************U";
    // AssumeRole API 請求參數: RoleArn, RoleSessionName, Policy, and DurationSeconds
    // RoleArn 需要在 RAM 控製台上獲取
    String roleArn = "acs:ram::145883****900618:role/ossadminrole";
    // RoleSessionName 是臨時Token的會話名稱，自己指定用於標識你的用戶，主要用於審計，或者用於區分Token頒發給誰
    // 但是注意RoleSessionName的長度和規則，不要有空格，隻能有'-' '_' 字母和數字等字符
    // 具體規則請參考API文檔中的格式要求
    String roleSessionName = "alice-001";
    // 如何定製你的policy?
    String policy = "{n" +
            "    "Version": "1", n" +
            "    "Statement": [n" +
            "        {n" +
            "            "Action": [n" +
            "                "oss:GetBucket", n" +
            "                "oss:GetObject" n" +
            "            ], n" +
            "            "Resource": [n" +
            "                "acs:oss:*:*:*"n" +
            "            ], n" +
            "            "Effect": "Allow"n" +
            "        }n" +
            "    ]n" +
            "}";
    // 此處必須為 HTTPS
    ProtocolType protocolType = ProtocolType.HTTPS;
    try {
      final AssumeRoleResponse response = assumeRole(accessKeyId, accessKeySecret,
              roleArn, roleSessionName, policy, protocolType);
      System.out.println("Expiration: " + response.getCredentials().getExpiration());
      System.out.println("Access Key Id: " + response.getCredentials().getAccessKeyId());
      System.out.println("Access Key Secret: " + response.getCredentials().getAccessKeySecret());
      System.out.println("Security Token: " + response.getCredentials().getSecurityToken());
    } catch (ClientException e) {
      System.out.println("Failed to get a token.");
      System.out.println("Error code: " + e.getErrCode());
      System.out.println("Error message: " + e.getErrMsg());
    }
  }
}

mvn install

mvn -q exec:java -Dexec.mainClass=com.aliyun.sts.sample.StsServiceSample