如何使用 java sdk 创建具有权限的 aws 角色？

Question

I'm trying without success to create a role with a specific permission:

This is my permission:

    String jsonRole = "{" + 
            "    \"Version\": \"2012-10-17\"," + 
            "    \"Statement\": [" + 
            "        {" + 
            "            \"Effect\": \"Allow\"," + 
            "            \"Action\": [" + 
            "                \"s3:PutObject\"," + 
            "                \"s3:GetObject\"," + 
            "                \"s3:GetObjectVersion\"," + 
            "                \"s3:DeleteObject\"," + 
            "                \"s3:DeleteObjectVersion\"" + 
            "            ]," + 
            "            \"Resource\": \"arn:aws:s3:::"+artifactsBucket+"/"+company.getCompanyId()+"/*\"" + 
            "        }" + 
            "    ]" + 
            "}";

and the command to create the role:

AmazonIdentityManagement client = AmazonIdentityManagementClientBuilder.standard().build();
CreateRoleRequest request = new CreateRoleRequest().withPath("/companies-bucket-roles/").withRoleName(company.getName()+"-"+consoleUser.getConsoleUserId());

But I don't know how to add the permission to the role. I found nothing in the documentation. Any idea?

Thanks in advance

Answer 1

This is the complete code if you want to create a role and add policy:

        String jsonPolicyDocument = "{" + 
                "    \"Version\": \"2012-10-17\"," + 
                "    \"Statement\": [" + 
                "        {" + 
                "            \"Effect\": \"Allow\"," + 
                "            \"Action\": [" + 
                "                \"s3:PutObject\"," + 
                "                \"s3:GetObject\"," + 
                "                \"s3:GetObjectVersion\"," + 
                "                \"s3:DeleteObject\"," + 
                "                \"s3:DeleteObjectVersion\"" + 
                "            ]," + 
                "            \"Resource\": \"arn:aws:s3:::"+artifactsBucket+"/"+company.getCompanyId()+"/*\"" + 
                "        }" + 
                "    ]" + 
                "}";

        String assumeRolePolicyDocument = "{" + 
                "  \"Version\": \"2012-10-17\"," + 
                "  \"Statement\": [" + 
                "    {" + 
                "      \"Effect\": \"Allow\"," + 
                "      \"Principal\": {" + 
                "        \"Federated\": \"cognito-identity.amazonaws.com\"" + 
                "      }," + 
                "      \"Action\": \"sts:AssumeRoleWithWebIdentity\"," + 
                "      \"Condition\": {" + 
                "        \"StringEquals\": {" + 
                "          \"cognito-identity.amazonaws.com:aud\": \""+poolId+"\"" + 
                "        }," + 
                "        \"ForAnyValue:StringLike\": {" + 
                "          \"cognito-identity.amazonaws.com:amr\": \"authenticated\"" + 
                "        }" + 
                "      }" + 
                "    }" + 
                "  ]" + 
                "}";
        
        
        AmazonIdentityManagement client = AmazonIdentityManagementClientBuilder.standard().build();
        // First create a policy
        CreatePolicyRequest policyRequest = new CreatePolicyRequest()
                .withPolicyName("company_" + company.getCompanyId() + "_s3bucket" + "_policy")
                .withPolicyDocument(jsonPolicyDocument)
                .withDescription("Policy created for the company "+company.getCompanyId()+". This policy give access to S3 bucket for this company");

        CreatePolicyResult policyResponse = client.createPolicy(policyRequest);

        String roleName = "company_" + company.getCompanyId() +  "_role";
        CreateRoleRequest request = new CreateRoleRequest()
                .withPath("/"+rolesFolder+"/")
                .withRoleName(roleName)
                .withAssumeRolePolicyDocument(assumeRolePolicyDocument)
                .withDescription("Role created for the company "+company.getCompanyId()+". This Role has for example policy for S3 bucket");
        CreateRoleResult response = client.createRole(request);

        // Attach the policy to the role
        AttachRolePolicyRequest attachRequest =  new AttachRolePolicyRequest()
                .withRoleName(roleName)
                .withPolicyArn(policyResponse.getPolicy().getArn());

        AttachRolePolicyResult attachRolePolicyResult = client.attachRolePolicy(attachRequest);


        logger.info(attachRolePolicyResult);