亚马逊会话令牌

Question

我正在使用 Java 将图像上传到 Amazon S3

AwsSessionCredentials awsCreds = AwsSessionCredentials.create(ACCESS_KEY, SECRET_KEY, SESSION_TOKEN);

S3Client s3main = S3Client.builder()
        .credentialsProvider(StaticCredentialsProvider.create(awsCreds))
        .endpointOverride(URI.create(MAIN_END_POINT)).region(main_region).build();

  s3main.putObject(PutObjectRequest.builder().bucket(bucketName).key(img1Name).build(),  RequestBody.fromBytes(bytesMain));

以上代码有效。我将空白字符串“”作为 SESSION_TOKEN 传递。只是想知道 Session Token 在这里有什么用？我应该在这里传递什么值？

Answer 1

您正在使用 IAM 用户凭据，因此您没有会话令牌，您的代码应使用 AwsBasicCredentials. Session tokens are associated with short-term credentials from an assumed IAM role, in which case your code would use AwsSessionCredentials。

背景

引用 AWS documentation:

You must provide your AWS access keys to make programmatic calls to AWS. When you create your access keys, you create the access key ID (for example, AKIAIOSFODNN7EXAMPLE) and secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY) as a set.

例如，IAM 用户使用访问密钥 ID 和秘密访问密钥进行身份验证。这些是 long-lived 个凭据。

但是，也可以使用 short-term 凭据：

You can also create and use temporary access keys, known as temporary security credentials. In addition to the access key ID and secret access key, temporary security credentials include a security token that you must send to AWS when you use temporary security credentials. The advantage of temporary security credentials is that they are short term. After they expire, they're no longer valid.

当 IAM 用户或联合用户担任 IAM 角色时，他们将获得一组凭证，其中包括访问密钥 ID、秘密访问密钥和安全令牌。这些是 short-lived 个凭据。

亚马逊会话令牌

Amazon session token

amazon-s3

背景