适用于 Java 的 Amazon SDK 1.x于2025年12月31日达到支撑终止状态。我们建议您迁移到 [Amazon SDK for Java 2.x](https://docs.amazonaws.cn/sdk-for-java/latest/developer-guide/home.html) 以继续获得新功能、可用性改进和安全更新。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 管理 IAM 访问密钥
<a name="examples-iam-access-keys"></a>

## 创建访问密钥
<a name="creating-an-access-key"></a>

要创建 IAM 访问密钥，请使用 [CreateAccessKeyRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/CreateAccessKeyRequest.html) 对象调用 AmazonIdentityManagementClient 的 `createAccessKey` 方法。

 `CreateAccessKeyRequest` 有两个构造函数，一个需要用户名，另一个不带参数。如果您使用不带参数的版本，则必须使用 `withUserName` setter 设置用户名，然后再将其传递给 `createAccessKey` 方法。

 **导入**。

```
import com.amazonaws.services.identitymanagement.AmazonIdentityManagement;
import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder;
import com.amazonaws.services.identitymanagement.model.CreateAccessKeyRequest;
import com.amazonaws.services.identitymanagement.model.CreateAccessKeyResult;
```

 **代码** 

```
final AmazonIdentityManagement iam =
    AmazonIdentityManagementClientBuilder.defaultClient();

CreateAccessKeyRequest request = new CreateAccessKeyRequest()
    .withUserName(user);

CreateAccessKeyResult response = iam.createAccessKey(request);
```

请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/CreateAccessKey.java)。

## 列出访问密钥
<a name="listing-access-keys"></a>

要列出指定用户的访问密钥，请创建一个 [ListAccessKeysRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/ListAccessKeysRequest.html) 对象，其中包含要列出其密钥的用户名，并将该对象传递给 AmazonIdentityManagementClient 的 `listAccessKeys` 方法。

**注意**  
如果您未向 `listAccessKeys` 提供用户名，则它将尝试列出与签署该请求的 Amazon Web Services 账户相关联的访问密钥。

 **导入**。

```
import com.amazonaws.services.identitymanagement.AmazonIdentityManagement;
import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder;
import com.amazonaws.services.identitymanagement.model.AccessKeyMetadata;
import com.amazonaws.services.identitymanagement.model.ListAccessKeysRequest;
import com.amazonaws.services.identitymanagement.model.ListAccessKeysResult;
```

 **代码** 

```
final AmazonIdentityManagement iam =
    AmazonIdentityManagementClientBuilder.defaultClient();

boolean done = false;
ListAccessKeysRequest request = new ListAccessKeysRequest()
        .withUserName(username);

while (!done) {

    ListAccessKeysResult response = iam.listAccessKeys(request);

    for (AccessKeyMetadata metadata :
            response.getAccessKeyMetadata()) {
        System.out.format("Retrieved access key %s",
                metadata.getAccessKeyId());
    }

    request.setMarker(response.getMarker());

    if (!response.getIsTruncated()) {
        done = true;
    }
}
```

`listAccessKeys` 的结果分页显示 (默认情况下，每个调用最多返回 100 个记录)。您可以调用返回的 [ListAccessKeysResult](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/ListAccessKeysResult.html) 对象中的 `getIsTruncated`，以查看该查询返回的结果是否少于可用结果。如果是这样，则在 `setMarker` 上调用 `ListAccessKeysRequest` 并将其传递回 `listAccessKeys` 的后续调用。

请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/ListAccessKeys.java)。

## 检索上次使用访问密钥的时间
<a name="retrieving-an-access-key-s-last-used-time"></a>

要获取上次使用访问密钥的时间，请使用访问密钥 ID（可使用 [GetAccessKeyLastUsedRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/GetAccessKeyLastUsedRequest.html) 对象传入，也可直接传给直接接收访问密钥 ID 的重载）调用 AmazonIdentityManagementClient 的 `getAccessKeyLastUsed` 方法。

然后，您可以使用返回的 [GetAccessKeyLastUsedResult](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/GetAccessKeyLastUsedResult.html) 对象检索上次使用密钥的时间。

 **导入**。

```
import com.amazonaws.services.identitymanagement.AmazonIdentityManagement;
import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder;
import com.amazonaws.services.identitymanagement.model.GetAccessKeyLastUsedRequest;
import com.amazonaws.services.identitymanagement.model.GetAccessKeyLastUsedResult;
```

 **代码** 

```
final AmazonIdentityManagement iam =
    AmazonIdentityManagementClientBuilder.defaultClient();

GetAccessKeyLastUsedRequest request = new GetAccessKeyLastUsedRequest()
    .withAccessKeyId(access_id);

GetAccessKeyLastUsedResult response = iam.getAccessKeyLastUsed(request);

System.out.println("Access key was last used at: " +
        response.getAccessKeyLastUsed().getLastUsedDate());
```

请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/AccessKeyLastUsed.java)。

## 激活或停用访问密钥
<a name="iam-access-keys-update"></a>

您可以激活或停用访问密钥，方式是创建 [UpdateAccessKeyRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/UpdateAccessKeyRequest.html) 对象，提供访问密钥 ID、用户名（可选）和所需[状态](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/StatusType.html)，然后将请求对象传递给 AmazonIdentityManagementClient 的 `updateAccessKey` 方法。

 **导入**。

```
import com.amazonaws.services.identitymanagement.AmazonIdentityManagement;
import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder;
import com.amazonaws.services.identitymanagement.model.UpdateAccessKeyRequest;
import com.amazonaws.services.identitymanagement.model.UpdateAccessKeyResult;
```

 **代码** 

```
final AmazonIdentityManagement iam =
    AmazonIdentityManagementClientBuilder.defaultClient();

UpdateAccessKeyRequest request = new UpdateAccessKeyRequest()
    .withAccessKeyId(access_id)
    .withUserName(username)
    .withStatus(status);

UpdateAccessKeyResult response = iam.updateAccessKey(request);
```

请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/UpdateAccessKey.java)。

## 删除访问密钥
<a name="deleting-an-access-key"></a>

要永久删除访问密钥，请调用 AmazonIdentityManagementClient 的 `deleteKey` 方法，并为它提供 [DeleteAccessKeyRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/DeleteAccessKeyRequest.html)，其中包含访问密钥的 ID 和用户名。

**注意**  
密钥在删除后无法再检索或使用。要临时停用密钥，使其可以稍后再次激活，请改用 [updateAccessKey](#iam-access-keys-update) 方法。

 **导入**。

```
import com.amazonaws.services.identitymanagement.AmazonIdentityManagement;
import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder;
import com.amazonaws.services.identitymanagement.model.DeleteAccessKeyRequest;
import com.amazonaws.services.identitymanagement.model.DeleteAccessKeyResult;
```

 **代码** 

```
final AmazonIdentityManagement iam =
    AmazonIdentityManagementClientBuilder.defaultClient();

DeleteAccessKeyRequest request = new DeleteAccessKeyRequest()
    .withAccessKeyId(access_key)
    .withUserName(username);

DeleteAccessKeyResult response = iam.deleteAccessKey(request);
```

请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/DeleteAccessKey.java)。

## 更多信息
<a name="more-information"></a>
+  《IAM API Reference》中的 [CreateAccessKey](https://docs.amazonaws.cn/IAM/latest/APIReference/API_CreateAccessKey.html)
+  《IAM API Reference》中的 [ListAccessKeys](https://docs.amazonaws.cn/IAM/latest/APIReference/API_ListAccessKeys.html)
+  《IAM API Reference》中的 [GetAccessKeyLastUsed](https://docs.amazonaws.cn/IAM/latest/APIReference/API_GetAccessKeyLastUsed.html)
+  《IAM API Reference》中的 [UpdateAccessKey](https://docs.amazonaws.cn/IAM/latest/APIReference/API_UpdateAccessKey.html)
+  《IAM API Reference》中的 [DeleteAccessKey](https://docs.amazonaws.cn/IAM/latest/APIReference/API_DeleteAccessKey.html)