阿里云基于STS获取临时访问权限使用示例

Step By Step

主要操作步骤

1、创建RAM角色

2、为子账户授予：AliyunSTSAssumeRoleAccess权限，允许其扮演角色；

3、为子账户创建AK，SK

4、使用子账户AK，SK以及角色获取STS认证信息

• 4.1 pom.xml

<dependency>
            <groupId>com.aliyun</groupId>
            <artifactId>aliyun-java-sdk-sts</artifactId>
            <version>3.0.0</version>
        </dependency>
        <dependency>
            <groupId>com.aliyun</groupId>
            <artifactId>aliyun-java-sdk-core</artifactId>
            <version>4.4.6</version>
        </dependency>

• 4.2 Code Sample

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.exceptions.ServerException;
import com.aliyuncs.profile.DefaultProfile;
import com.google.gson.Gson;
import com.aliyuncs.sts.model.v20150401.*;

public class AssumeRole {

    public static void main(String[] args) {
        //构建一个阿里云客户端，用于发起请求。
        //构建阿里云客户端时需要设置AccessKey ID和AccessKey Secret。
        DefaultProfile profile = DefaultProfile.getProfile("cn-hangzhou", "LTAI4Fyx******", "aOZ7l4JQni5jXQ******");
        IAcsClient client = new DefaultAcsClient(profile);

        //构造请求，设置参数。
        AssumeRoleRequest request = new AssumeRoleRequest();
        request.setRoleArn("acs:ram::16034373********:role/datahubrole");
        request.setRoleSessionName("datahubrole");
        request.setDurationSeconds(3600L); //过期时间，单位为秒,过期时间最小值为900秒，最大值为MaxSessionDuration设置的时间。默认值为3600秒。

        //发起请求，并得到响应。
        try {
            AssumeRoleResponse response = client.getAcsResponse(request);
            System.out.println(new Gson().toJson(response));
        } catch (ServerException e) {
            e.printStackTrace();
        } catch (ClientException e) {
            System.out.println("ErrCode:" + e.getErrCode());
            System.out.println("ErrMsg:" + e.getErrMsg());
            System.out.println("RequestId:" + e.getRequestId());
        }
    }
}

• 4.3 The Result

{"requestId":"5013A1FF-7D50-46FC-8D4F-FAB644462896","credentials":{"securityToken":"CAIS9QF1q6Ft5B2yfSjIr5WBJteMmIUS8pimMXPlr0ViOuh4nrLj1Dz2IHBNfHRtBuses/wwn2hT6PwYlqJ/QoNMRVHOd8x048zoWcN80cyT1fau5Jko1beHewHKeTOZsebWZ+LmNqC/Ht6md1HDkAJq3LL+bk/Mdle5MJqP+/UFB5ZtKWveVzddA8pMLQZPsdITMWCrVcygKRn3mGHdfiEK00he8Tohsf/jmZLHtEWG3QWklrcvyt6vcsT+Xa5FJ4xiVtq55utye5fa3TRYgxowr/cv1PEZpmyf44nCWAEKvU/cKYnY+8FmLBJzfK8+Fr78fy1BaF/80BqAATa5HBtPaTjc8qe3oQyaLlTzJ/5FZgcfc534fO+cuE5a1111111111sPh2eect/Tj+P/tEM7Zm929Sc6R1deZKqbUwscixkUhghYSu6H6HlmtvvT9vbr+fYgXnzm8MO8fFEXp3fFm37rOaMo45YaBqM6lUSYDm386jCa+vf2A","accessKeySecret":"9LkRtLFLJMMRouC17B111111FR9aZ2EAAfFvcn2QBd","accessKeyId":"STS.N11118uZ3EZM3UTKE76gTqwH6","expiration":"2020-11-08T07:02:48Z"},"assumedRoleUser":{"arn":"acs:ram::1603437367******:role/datahubrole/datahubrole","assumedRoleId":"381055730507303622:datahubrole"}}

5、使用获取的认证信息进行认证

• 5.1 pom.xml

<dependency>
            <groupId>com.aliyun.datahub</groupId>
            <artifactId>aliyun-sdk-datahub</artifactId>
            <version>2.17.1-public</version>
        </dependency>

• 5.2 Code Sample

import com.aliyun.datahub.client.DatahubClient;
import com.aliyun.datahub.client.DatahubClientBuilder;
import com.aliyun.datahub.client.auth.AliyunAccount;
import com.aliyun.datahub.client.common.DatahubConfig;
import com.aliyun.datahub.client.http.HttpConfig;
import com.aliyun.datahub.client.model.ListProjectResult;

public class ListDatahubProject {

    public static void main(String[] args) {

        // Endpoint以Region: 华东1为例，其他Region请按实际情况填写
        // 注意：此处的ak，sk以及accessToken均为AssumeRole临时获取
        String endpoint = "http://dh-cn-shanghai.aliyuncs.com";
        String accessId = "STS.NV4mm8uZ3EZ*******";
        String accessKey = "9LkRtLFLJMMRouC17BJ*******";
//        String accessToken = "CAIS9QF1q6Ft5B2***********vRxPShjQGS716i6eShjz2IH5IeHNsBOAXtvU2nm1R6fkdlqJ/QoNMRVHOd8x048ylPeV90cyT1fau5Jko1beHewHKeTOZsebWZ+LmNqC/Ht6md1HDkAJq3LL+bk/Mdle5MJqP+/UFB5ZtKWveVzddA8pMLQZPsdITMWCrVcygKRn3mGHdfiEK00he8Togs/3jnpXGtEuO1QWqk7Ivyt6vcsT+Xa5FJ4xiVtq55utye5fa3TRYgxowr/kq0PYYpGeW5oDEWQQIvErZKYnY+8FmLBJzfK8+Fr78fy1BaF/80BqAAQDkMzJi7+1iTBjm0T+x2CwrCOBdR/+XfMb3zazJcOEQnIbpbr3RYOGVg8++/ruxXsFityNEQW2X/fwRs0kDT6MJg3TdYlPG6D5xqxiv3nqAx/vaHPVAP8Pu61SiCwqRrs41XhHdUejim/RR/R6D3CwRusk7OwtSGL5kCIFHdaY9";
        String accessToken = "CAIS9QF1q6Ft5B2yfSjIr5WBJteMmIUS8pimMXPlr0ViOuh4nrLj1Dz2IHBNfHRtBuses/wwn2hT6PwYlqJ/QoNMRVHOd8x048zoWcN80cyT1fau5Jko1beHewHKeTOZsebWZ+LmNqC/Ht6md1HDkAJq3LL+bk/Mdle5MJqP+/UFB5ZtKWveVzddA8pMLQZPsdITMWCrVcygKRn3mGHdfiEK00he8Tohsf/jmZLHtEWG3QWklrcvyt6vcsT+Xa5FJ4xiVtq55utye5fa3TRYgxowr/cv1PEZpmyf44nCWAEKvU/cKYnY+8FmLBJzfK8+Fr78fy1BaF/80BqAATa5HBtPaTjc8qe3oQyaLlTzJ/5FZgcfc534fO+cuE5aUeHybms5JhbOqsPh2eect/Tj+P/tEM7Zm929Sc6R1deZKqbUwscixkUhghYSu6H6HlmtvvT9vbr+fYgXnzm8MO8fFEXp3fFm37rOaMo45YaBqM6lUSYDm386jCa+vf2A";
        // 创建DataHubClient实例
        DatahubClient datahubClient = DatahubClientBuilder.newBuilder()
                .setDatahubConfig(
                        new DatahubConfig(endpoint,
                                // 是否开启二进制传输，服务端2.12版本开始支持
                                new AliyunAccount(accessId, accessKey,accessToken), true))
                //专有云使用出错尝试将参数设置为           false
                // HttpConfig可不设置，不设置时采用默认值
                .setHttpConfig(new HttpConfig()
                        .setCompressType(HttpConfig.CompressType.LZ4) // 读写数据推荐打开网络传输 LZ4压缩
                        .setConnTimeout(10000))
                .build();

        // 获取对应区域project 名称列表
        ListProjectResult listProjectResult = datahubClient.listProject();
        for (String listName:listProjectResult.getProjectNames()
             ) {
            System.out.println("Project Name：" + listName);
        }
    }
}

• 5.3 The Result

更多参考

什么是STS
Java示例
DataHub Java SDK
阿里云常见参数获取位置