示例代码:使用多重验证请求凭证 - Amazon Identity and Access Management
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅 中国的 Amazon Web Services 服务入门 (PDF)

示例代码:使用多重验证请求凭证

以下示例说明如何调用 GetSessionTokenAssumeRole 操作并传递 MFA 身份验证参数。无需任何权限即可调用 GetSessionToken,但您必须拥有允许您调用 AssumeRole 的策略。随后,返回的凭证将用于列出账户中的所有 S3 存储桶。

使用 MFA 身份验证调用 GetSessionToken

以下示例说明了如何调用 GetSessionToken 并传递 MFA 身份验证信息。然后使用 GetSessionToken 操作返回的临时安全凭证来列出账户中的所有 S3 存储桶。

附加到运行此代码的用户(或用户所在的组)的策略提供了返回的临时凭证的权限。对于此示例代码,该策略必须向用户授予请求 Amazon S3 ListBuckets 操作的权限。

以下代码示例演示了如何获取具有 Amazon STS 的会话令牌,并将其用于执行需要 MFA 令牌的服务操作。

CLI
Amazon CLI

要获取 IAM 身份的一组短期凭证

以下 get-session-token 命令将检索进行调用的 IAM 身份的一组短期凭证。生成的凭证可用于策略要求多重身份验证(MFA)的请求。凭证在生成 15 分钟后过期。

aws sts get-session-token \ --duration-seconds 900 \ --serial-number "YourMFADeviceSerialNumber" \ --token-code 123456

输出:

{ "Credentials": { "AccessKeyId": "ASIAIOSFODNN7EXAMPLE", "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY", "SessionToken": "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE", "Expiration": "2020-05-19T18:06:10+00:00" } }

有关更多信息,请参阅《Amazon IAM 用户指南》中的请求临时安全凭证

  • 有关 API 详细信息,请参阅《Amazon CLI 命令参考》中的 GetSessionToken

Python
SDK for Python (Boto3)
注意

查看 GitHub,了解更多信息。在 Amazon 代码示例存储库中查找完整示例,了解如何进行设置和运行。

通过传递 MFA 令牌获取会话令牌,然后使用令牌列出账户的 Amazon S3 存储桶。

def list_buckets_with_session_token_with_mfa(mfa_serial_number, mfa_totp, sts_client): """ Gets a session token with MFA credentials and uses the temporary session credentials to list Amazon S3 buckets. Requires an MFA device serial number and token. :param mfa_serial_number: The serial number of the MFA device. For a virtual MFA device, this is an Amazon Resource Name (ARN). :param mfa_totp: A time-based, one-time password issued by the MFA device. :param sts_client: A Boto3 STS instance that has permission to assume the role. """ if mfa_serial_number is not None: response = sts_client.get_session_token( SerialNumber=mfa_serial_number, TokenCode=mfa_totp ) else: response = sts_client.get_session_token() temp_credentials = response["Credentials"] s3_resource = boto3.resource( "s3", aws_access_key_id=temp_credentials["AccessKeyId"], aws_secret_access_key=temp_credentials["SecretAccessKey"], aws_session_token=temp_credentials["SessionToken"], ) print(f"Buckets for the account:") for bucket in s3_resource.buckets.all(): print(bucket.name)
  • 有关 API 详细信息,请参阅《Amazon SDK for Python (Boto3) API 参考》中的 GetSessionToken

使用 MFA 身份验证调用 AssumeRole

下面的示例说明了如何调用 AssumeRole 并传递 MFA 身份验证信息。然后使用 AssumeRole 返回的临时安全证书列出账户中的所有 Amazon S3 存储桶。

有关此方案的更多信息,请参阅方案:跨账户委派的 MFA 保护

以下代码示例演示了如何代入具有 Amazon STS 的角色。

.NET
Amazon SDK for .NET
注意

在 GitHub 上查看更多内容。查找完整示例,了解如何在 Amazon 代码示例存储库中进行设置和运行。

using System; using System.Threading.Tasks; using Amazon; using Amazon.SecurityToken; using Amazon.SecurityToken.Model; namespace AssumeRoleExample { class AssumeRole { /// <summary> /// This example shows how to use the AWS Security Token /// Service (AWS STS) to assume an IAM role. /// /// NOTE: It is important that the role that will be assumed has a /// trust relationship with the account that will assume the role. /// /// Before you run the example, you need to create the role you want to /// assume and have it trust the IAM account that will assume that role. /// /// See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html /// for help in working with roles. /// </summary> private static readonly RegionEndpoint REGION = RegionEndpoint.USWest2; static async Task Main() { // Create the SecurityToken client and then display the identity of the // default user. var roleArnToAssume = "arn:aws:iam::123456789012:role/testAssumeRole"; var client = new Amazon.SecurityToken.AmazonSecurityTokenServiceClient(REGION); // Get and display the information about the identity of the default user. var callerIdRequest = new GetCallerIdentityRequest(); var caller = await client.GetCallerIdentityAsync(callerIdRequest); Console.WriteLine($"Original Caller: {caller.Arn}"); // Create the request to use with the AssumeRoleAsync call. var assumeRoleReq = new AssumeRoleRequest() { DurationSeconds = 1600, RoleSessionName = "Session1", RoleArn = roleArnToAssume }; var assumeRoleRes = await client.AssumeRoleAsync(assumeRoleReq); // Now create a new client based on the credentials of the caller assuming the role. var client2 = new AmazonSecurityTokenServiceClient(credentials: assumeRoleRes.Credentials); // Get and display information about the caller that has assumed the defined role. var caller2 = await client2.GetCallerIdentityAsync(callerIdRequest); Console.WriteLine($"AssumedRole Caller: {caller2.Arn}"); } } }
  • 有关 API 详细信息,请参阅《Amazon SDK for .NET API 参考》中的 AssumeRole

Bash
Amazon CLI 及 Bash 脚本
注意

查看 GitHub,了解更多信息。在 Amazon 代码示例存储库中查找完整示例,了解如何进行设置和运行。

############################################################################### # function iecho # # This function enables the script to display the specified text only if # the global variable $VERBOSE is set to true. ############################################################################### function iecho() { if [[ $VERBOSE == true ]]; then echo "$@" fi } ############################################################################### # function errecho # # This function outputs everything sent to it to STDERR (standard error output). ############################################################################### function errecho() { printf "%s\n" "$*" 1>&2 } ############################################################################### # function sts_assume_role # # This function assumes a role in the AWS account and returns the temporary # credentials. # # Parameters: # -n role_session_name -- The name of the session. # -r role_arn -- The ARN of the role to assume. # # Returns: # [access_key_id, secret_access_key, session_token] # And: # 0 - If successful. # 1 - If an error occurred. ############################################################################### function sts_assume_role() { local role_session_name role_arn response local option OPTARG # Required to use getopts command in a function. # bashsupport disable=BP5008 function usage() { echo "function sts_assume_role" echo "Assumes a role in the AWS account and returns the temporary credentials:" echo " -n role_session_name -- The name of the session." echo " -r role_arn -- The ARN of the role to assume." echo "" } while getopts n:r:h option; do case "${option}" in n) role_session_name=${OPTARG} ;; r) role_arn=${OPTARG} ;; h) usage return 0 ;; \?) ech o"Invalid parameter" usage return 1 ;; esac done response=$(aws sts assume-role \ --role-session-name "$role_session_name" \ --role-arn "$role_arn" \ --output text \ --query "Credentials.[AccessKeyId, SecretAccessKey, SessionToken]") local error_code=${?} if [[ $error_code -ne 0 ]]; then aws_cli_error_log $error_code errecho "ERROR: AWS reports create-role operation failed.\n$response" return 1 fi echo "$response" return 0 }
  • 有关 API 详细信息,请参阅《Amazon CLI Command Reference》中的 AssumeRole

C++
SDK for C++
注意

查看 GitHub,了解更多信息。查找完整示例,学习如何在 Amazon 代码示例存储库中进行设置和运行。

bool AwsDoc::STS::assumeRole(const Aws::String &roleArn, const Aws::String &roleSessionName, const Aws::String &externalId, Aws::Auth::AWSCredentials &credentials, const Aws::Client::ClientConfiguration &clientConfig) { Aws::STS::STSClient sts(clientConfig); Aws::STS::Model::AssumeRoleRequest sts_req; sts_req.SetRoleArn(roleArn); sts_req.SetRoleSessionName(roleSessionName); sts_req.SetExternalId(externalId); const Aws::STS::Model::AssumeRoleOutcome outcome = sts.AssumeRole(sts_req); if (!outcome.IsSuccess()) { std::cerr << "Error assuming IAM role. " << outcome.GetError().GetMessage() << std::endl; } else { std::cout << "Credentials successfully retrieved." << std::endl; const Aws::STS::Model::AssumeRoleResult result = outcome.GetResult(); const Aws::STS::Model::Credentials &temp_credentials = result.GetCredentials(); // Store temporary credentials in return argument. // Note: The credentials object returned by assumeRole differs // from the AWSCredentials object used in most situations. credentials.SetAWSAccessKeyId(temp_credentials.GetAccessKeyId()); credentials.SetAWSSecretKey(temp_credentials.GetSecretAccessKey()); credentials.SetSessionToken(temp_credentials.GetSessionToken()); } return outcome.IsSuccess(); }
  • 有关 API 详细信息,请参阅《Amazon SDK for C++ API 参考》中的 AssumeRole

CLI
Amazon CLI

要代入角色

以下 assume-role 命令将检索 IAM 角色 s3-access-example 的一组短期凭证。

aws sts assume-role \ --role-arn arn:aws:iam::123456789012:role/xaccounts3access \ --role-session-name s3-access-example

输出:

{ "AssumedRoleUser": { "AssumedRoleId": "AROA3XFRBF535PLBIFPI4:s3-access-example", "Arn": "arn:aws:sts::123456789012:assumed-role/xaccounts3access/s3-access-example" }, "Credentials": { "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI", "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=", "Expiration": "2016-03-15T00:05:07Z", "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA" } }

该命令的输出包含访问密钥、私有密钥和会话令牌,您可以使用它们对 Amazon 进行身份验证。

要使用 Amazon CLI,则可以设置与角色关联的命名配置文件。使用配置文件时,Amazon CLI 将调用 assume-role 并为您管理凭证。有关更多信息,请参阅《Amazon CLI 用户指南》中的在 Amazon CLI 中使用 IAM 角色

  • 有关 API 详细信息,请参阅《Amazon CLI Command Reference》中的 AssumeRole

Java
SDK for Java 2.x
注意

查看 GitHub,了解更多信息。在 Amazon 代码示例存储库中查找完整示例,了解如何进行设置和运行。

import software.amazon.awssdk.regions.Region; import software.amazon.awssdk.services.sts.StsClient; import software.amazon.awssdk.services.sts.model.AssumeRoleRequest; import software.amazon.awssdk.services.sts.model.StsException; import software.amazon.awssdk.services.sts.model.AssumeRoleResponse; import software.amazon.awssdk.services.sts.model.Credentials; import java.time.Instant; import java.time.ZoneId; import java.time.format.DateTimeFormatter; import java.time.format.FormatStyle; import java.util.Locale; /** * To make this code example work, create a Role that you want to assume. * Then define a Trust Relationship in the AWS Console. You can use this as an * example: * * { * "Version": "2012-10-17", * "Statement": [ * { * "Effect": "Allow", * "Principal": { * "AWS": "<Specify the ARN of your IAM user you are using in this code * example>" * }, * "Action": "sts:AssumeRole" * } * ] * } * * For more information, see "Editing the Trust Relationship for an Existing * Role" in the AWS Directory Service guide. * * Also, set up your development environment, including your credentials. * * For information, see this documentation topic: * * https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html */ public class AssumeRole { public static void main(String[] args) { final String usage = """ Usage: <roleArn> <roleSessionName>\s Where: roleArn - The Amazon Resource Name (ARN) of the role to assume (for example, rn:aws:iam::000008047983:role/s3role).\s roleSessionName - An identifier for the assumed role session (for example, mysession).\s """; if (args.length != 2) { System.out.println(usage); System.exit(1); } String roleArn = args[0]; String roleSessionName = args[1]; Region region = Region.US_EAST_1; StsClient stsClient = StsClient.builder() .region(region) .build(); assumeGivenRole(stsClient, roleArn, roleSessionName); stsClient.close(); } public static void assumeGivenRole(StsClient stsClient, String roleArn, String roleSessionName) { try { AssumeRoleRequest roleRequest = AssumeRoleRequest.builder() .roleArn(roleArn) .roleSessionName(roleSessionName) .build(); AssumeRoleResponse roleResponse = stsClient.assumeRole(roleRequest); Credentials myCreds = roleResponse.credentials(); // Display the time when the temp creds expire. Instant exTime = myCreds.expiration(); String tokenInfo = myCreds.sessionToken(); // Convert the Instant to readable date. DateTimeFormatter formatter = DateTimeFormatter.ofLocalizedDateTime(FormatStyle.SHORT) .withLocale(Locale.US) .withZone(ZoneId.systemDefault()); formatter.format(exTime); System.out.println("The token " + tokenInfo + " expires on " + exTime); } catch (StsException e) { System.err.println(e.getMessage()); System.exit(1); } } }
  • 有关 API 详细信息,请参阅《Amazon SDK for Java 2.x API 参考》中的 AssumeRole

JavaScript
SDK for JavaScript (v3)
注意

查看 GitHub,了解更多信息。查找完整示例,了解如何在 Amazon 代码示例存储库中进行设置和运行。

创建客户端。

import { STSClient } from "@aws-sdk/client-sts"; // Set the AWS Region. const REGION = "us-east-1"; // Create an AWS STS service client object. export const client = new STSClient({ region: REGION });

代入 IAM 角色。

import { AssumeRoleCommand } from "@aws-sdk/client-sts"; import { client } from "../libs/client.js"; export const main = async () => { try { // Returns a set of temporary security credentials that you can use to // access Amazon Web Services resources that you might not normally // have access to. const command = new AssumeRoleCommand({ // The Amazon Resource Name (ARN) of the role to assume. RoleArn: "ROLE_ARN", // An identifier for the assumed role session. RoleSessionName: "session1", // The duration, in seconds, of the role session. The value specified // can range from 900 seconds (15 minutes) up to the maximum session // duration set for the role. DurationSeconds: 900, }); const response = await client.send(command); console.log(response); } catch (err) { console.error(err); } };
  • 有关 API 详细信息,请参阅《Amazon SDK for JavaScript API 参考》中的 AssumeRole

SDK for JavaScript (v2)
注意

查看 GitHub,了解更多信息。查找完整示例,了解如何在 Amazon 代码示例存储库中进行设置和运行。

// Load the AWS SDK for Node.js const AWS = require("aws-sdk"); // Set the region AWS.config.update({ region: "REGION" }); var roleToAssume = { RoleArn: "arn:aws:iam::123456789012:role/RoleName", RoleSessionName: "session1", DurationSeconds: 900, }; var roleCreds; // Create the STS service object var sts = new AWS.STS({ apiVersion: "2011-06-15" }); //Assume Role sts.assumeRole(roleToAssume, function (err, data) { if (err) console.log(err, err.stack); else { roleCreds = { accessKeyId: data.Credentials.AccessKeyId, secretAccessKey: data.Credentials.SecretAccessKey, sessionToken: data.Credentials.SessionToken, }; stsGetCallerIdentity(roleCreds); } }); //Get Arn of current identity function stsGetCallerIdentity(creds) { var stsParams = { credentials: creds }; // Create STS service object var sts = new AWS.STS(stsParams); sts.getCallerIdentity({}, function (err, data) { if (err) { console.log(err, err.stack); } else { console.log(data.Arn); } }); }
  • 有关 API 详细信息,请参阅《Amazon SDK for JavaScript API 参考》中的 AssumeRole

Python
SDK for Python (Boto3)
注意

查看 GitHub,了解更多信息。在 Amazon 代码示例存储库中查找完整示例,了解如何进行设置和运行。

代入需要 MFA 令牌的 IAM 角色并使用临时凭证列出该账户的 Amazon S3 存储桶。

def list_buckets_from_assumed_role_with_mfa( assume_role_arn, session_name, mfa_serial_number, mfa_totp, sts_client ): """ Assumes a role from another account and uses the temporary credentials from that role to list the Amazon S3 buckets that are owned by the other account. Requires an MFA device serial number and token. The assumed role must grant permission to list the buckets in the other account. :param assume_role_arn: The Amazon Resource Name (ARN) of the role that grants access to list the other account's buckets. :param session_name: The name of the STS session. :param mfa_serial_number: The serial number of the MFA device. For a virtual MFA device, this is an ARN. :param mfa_totp: A time-based, one-time password issued by the MFA device. :param sts_client: A Boto3 STS instance that has permission to assume the role. """ response = sts_client.assume_role( RoleArn=assume_role_arn, RoleSessionName=session_name, SerialNumber=mfa_serial_number, TokenCode=mfa_totp, ) temp_credentials = response["Credentials"] print(f"Assumed role {assume_role_arn} and got temporary credentials.") s3_resource = boto3.resource( "s3", aws_access_key_id=temp_credentials["AccessKeyId"], aws_secret_access_key=temp_credentials["SecretAccessKey"], aws_session_token=temp_credentials["SessionToken"], ) print(f"Listing buckets for the assumed role's account:") for bucket in s3_resource.buckets.all(): print(bucket.name)
  • 有关 API 详细信息,请参阅《Amazon SDK for Python(Boto3)API 参考》中的 AssumeRole

Ruby
适用于 Ruby 的 SDK
注意

查看 GitHub,了解更多信息。在 Amazon 代码示例存储库中查找完整示例,了解如何进行设置和运行。

# Creates an AWS Security Token Service (AWS STS) client with specified credentials. # This is separated into a factory function so that it can be mocked for unit testing. # # @param key_id [String] The ID of the access key used by the STS client. # @param key_secret [String] The secret part of the access key used by the STS client. def create_sts_client(key_id, key_secret) Aws::STS::Client.new(access_key_id: key_id, secret_access_key: key_secret) end # Gets temporary credentials that can be used to assume a role. # # @param role_arn [String] The ARN of the role that is assumed when these credentials # are used. # @param sts_client [AWS::STS::Client] An AWS STS client. # @return [Aws::AssumeRoleCredentials] The credentials that can be used to assume the role. def assume_role(role_arn, sts_client) credentials = Aws::AssumeRoleCredentials.new( client: sts_client, role_arn: role_arn, role_session_name: "create-use-assume-role-scenario" ) @logger.info("Assumed role '#{role_arn}', got temporary credentials.") credentials end
  • 有关 API 详细信息,请参阅《Amazon SDK for Ruby API 参考》中的 AssumeRole

Rust
适用于 Rust 的 SDK
注意

查看 GitHub,了解更多信息。在 Amazon 代码示例存储库中查找完整示例,了解如何进行设置和运行。

async fn assume_role(config: &SdkConfig, role_name: String, session_name: Option<String>) { let provider = aws_config::sts::AssumeRoleProvider::builder(role_name) .session_name(session_name.unwrap_or("rust_sdk_example_session".into())) .configure(config) .build() .await; let local_config = aws_config::from_env() .credentials_provider(provider) .load() .await; let client = Client::new(&local_config); let req = client.get_caller_identity(); let resp = req.send().await; match resp { Ok(e) => { println!("UserID : {}", e.user_id().unwrap_or_default()); println!("Account: {}", e.account().unwrap_or_default()); println!("Arn : {}", e.arn().unwrap_or_default()); } Err(e) => println!("{:?}", e), } }
  • 有关 API 详细信息,请参阅《Amazon SDK for Rust API 参考》中的 AssumeRole

Swift
SDK for Swift
注意

这是预览版 SDK 的预发布文档。本文档随时可能更改。

注意

查看 GitHub,了解更多信息。在 Amazon 代码示例存储库中查找完整示例,了解如何进行设置和运行。

public func assumeRole(role: IAMClientTypes.Role, sessionName: String) async throws -> STSClientTypes.Credentials { let input = AssumeRoleInput( roleArn: role.arn, roleSessionName: sessionName ) do { let output = try await stsClient.assumeRole(input: input) guard let credentials = output.credentials else { throw ServiceHandlerError.authError } return credentials } catch { throw error } }
  • 有关 API 详细信息,请参阅《Amazon SDK for Swift API 参考》中的 AssumeRole