AWS S3存儲桶臨時證書下載文件.Net

Question

我在Amazon S3上有一個存儲桶，並且已經創建了IAM用戶。現在，我想使用臨時憑證下載私有存儲桶文件。

這是我的水桶政策

{
    "Id": "Policy1509026195925",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1509026179419",
            "Action": [
                "s3:GetObject"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::test-folder/*",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::461567291450:user/john"
                ]
            }
        }
    ]
}

這是我的C＃.Net代碼

ServicePointManager.Expect100Continue = false;
            ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

            try
            {

                // In real applications, the following code is part of your trusted code. It has 
                // your security credentials you use to obtain temporary security credentials.
                AmazonSecurityTokenServiceConfig config = new AmazonSecurityTokenServiceConfig();
                AmazonSecurityTokenServiceClient stsClient =
                       new AmazonSecurityTokenServiceClient(config);

                GetFederationTokenRequest federationTokenRequest =
                                                     new GetFederationTokenRequest();
                federationTokenRequest.Name = "testuser";
               // federationTokenRequest.Policy = "Policy1509026195925";
                federationTokenRequest.DurationSeconds = 7200;

                GetFederationTokenResponse federationTokenResponse = stsClient.GetFederationToken(federationTokenRequest);
                //FederatedUser federationTokenResult = federationTokenResponse.;
                Credentials credentials = federationTokenResponse.Credentials;


                SessionAWSCredentials sessionCredentials =
                                 new SessionAWSCredentials(credentials.AccessKeyId,
                                                          credentials.SecretAccessKey,
                                                          credentials.SessionToken);

                // The following will be part of your less trusted code. You provide temporary security
                // credentials so it can send authenticated requests to Amazon S3. 
                // Create Amazon S3 client by passing in the basicSessionCredentials object.
                AmazonS3Client s3Client = new AmazonS3Client(sessionCredentials, Amazon.RegionEndpoint.USEast1);
                // Test. For example, send list object keys in a bucket.
                ListObjectsRequest listObjectRequest = new ListObjectsRequest();
                listObjectRequest.BucketName = bucketName;
                ListObjectsResponse response = s3Client.ListObjects(listObjectRequest);
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex.Message);
            }

每次我運行代碼時，都會收到“訪問被拒絕”消息。 為什么？ 如何使用臨時憑證下載存儲桶文件？

Answer 1

您可以嘗試類似：

assumeRoleResult = AssumeRole(role-arn);
tempCredentials = new SessionAWSCredentials(
   assumeRoleResult.AccessKeyId, 
   assumeRoleResult.SecretAccessKey, 
   assumeRoleResult.SessionToken);
s3Request = CreateAmazonS3Client(tempCredentials);

您需要調用AssumeRole來獲取臨時安全憑證，然后使用這些憑證來調用Amazon S3，請參閱切換到IAM角色（API）。

請參閱：結合使用臨時安全憑證和AWS開發工具包