AWS S3存储桶临时证书下载文件.Net

Question

I have a bucket on Amazon S3 and I have created IAM user Now I want to download private bucket file using temporary credential.

This is my bucket policy

{
    "Id": "Policy1509026195925",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1509026179419",
            "Action": [
                "s3:GetObject"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::test-folder/*",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::461567291450:user/john"
                ]
            }
        }
    ]
}

this is my c# .Net code

ServicePointManager.Expect100Continue = false;
            ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

            try
            {

                // In real applications, the following code is part of your trusted code. It has 
                // your security credentials you use to obtain temporary security credentials.
                AmazonSecurityTokenServiceConfig config = new AmazonSecurityTokenServiceConfig();
                AmazonSecurityTokenServiceClient stsClient =
                       new AmazonSecurityTokenServiceClient(config);

                GetFederationTokenRequest federationTokenRequest =
                                                     new GetFederationTokenRequest();
                federationTokenRequest.Name = "testuser";
               // federationTokenRequest.Policy = "Policy1509026195925";
                federationTokenRequest.DurationSeconds = 7200;

                GetFederationTokenResponse federationTokenResponse = stsClient.GetFederationToken(federationTokenRequest);
                //FederatedUser federationTokenResult = federationTokenResponse.;
                Credentials credentials = federationTokenResponse.Credentials;


                SessionAWSCredentials sessionCredentials =
                                 new SessionAWSCredentials(credentials.AccessKeyId,
                                                          credentials.SecretAccessKey,
                                                          credentials.SessionToken);

                // The following will be part of your less trusted code. You provide temporary security
                // credentials so it can send authenticated requests to Amazon S3. 
                // Create Amazon S3 client by passing in the basicSessionCredentials object.
                AmazonS3Client s3Client = new AmazonS3Client(sessionCredentials, Amazon.RegionEndpoint.USEast1);
                // Test. For example, send list object keys in a bucket.
                ListObjectsRequest listObjectRequest = new ListObjectsRequest();
                listObjectRequest.BucketName = bucketName;
                ListObjectsResponse response = s3Client.ListObjects(listObjectRequest);
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex.Message);
            }

Every time when I run the code I got Access denied message. Why? How to download the bucket file using Temporary credential?

Answer 1

You can try something like :

assumeRoleResult = AssumeRole(role-arn);
tempCredentials = new SessionAWSCredentials(
   assumeRoleResult.AccessKeyId, 
   assumeRoleResult.SecretAccessKey, 
   assumeRoleResult.SessionToken);
s3Request = CreateAmazonS3Client(tempCredentials);

You need to to call AssumeRole to get temporary security credentials, and then use those credentials to make a call to Amazon S3, see Switching to an IAM Role (API).

Refer : Using Temporary Security Credentials with the AWS SDKs