如何在Spring Boot服务中用AWS SDK for Java V2创建IAM Roles Anywhere会话访问S3

1. 添加必要的依赖 #

确保你的项目依赖中包含AWS Roles Anywhere和S3的SDK，以及处理PEM格式证书的工具包：

Maven示例（pom.xml）：

<dependencies>
    <!-- AWS Roles Anywhere SDK -->
    <dependency>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>rolesanywhere</artifactId>
        <version>2.20.0</version> <!-- 使用最新稳定版本 -->
    </dependency>
    <!-- AWS S3 SDK -->
    <dependency>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>s3</artifactId>
        <version>2.20.0</version>
    </dependency>
    <!-- 解析PEM格式证书/私钥 -->
    <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcpkix-jdk15on</artifactId>
        <version>1.70</version>
    </dependency>
</dependencies>

2. 加载本地证书和私钥 #

将你的PEM格式证书和私钥加载为Java可识别的加密对象：

import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
import java.io.FileReader;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;

public class CredentialLoader {
    public static X509Certificate loadCertificate(String certPath) throws Exception {
        try (PEMParser parser = new PEMParser(new FileReader(certPath))) {
            Object obj = parser.readObject();
            return (X509Certificate) new JcaPEMKeyConverter().getCertificate(obj);
        }
    }

    public static PrivateKey loadPrivateKey(String privateKeyPath) throws Exception {
        try (PEMParser parser = new PEMParser(new FileReader(privateKeyPath))) {
            Object obj = parser.readObject();
            return new JcaPEMKeyConverter().getPrivateKey(obj);
        }
    }
}

3. 创建Roles Anywhere会话获取临时凭证 #

调用RolesAnywhereClient的createSession接口，传入你的ARN参数和加密对象，获取AWS临时会话凭证：

import software.amazon.awssdk.auth.credentials.AwsSessionCredentials;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.rolesanywhere.RolesAnywhereClient;
import software.amazon.awssdk.services.rolesanywhere.model.CreateSessionRequest;
import software.amazon.awssdk.services.rolesanywhere.model.CreateSessionResponse;
import software.amazon.awssdk.services.rolesanywhere.model.CredentialSet;

public class RolesAnywhereSessionCreator {
    public static AwsSessionCredentials createSession(String profileArn, String trustAnchorArn, String roleArn,
                                                     X509Certificate cert, PrivateKey privateKey) {
        try (RolesAnywhereClient client = RolesAnywhereClient.builder()
                .region(Region.US_EAST_1) // 替换为你的Roles Anywhere所在区域
                .build()) {

            CreateSessionRequest request = CreateSessionRequest.builder()
                    .profileArn(profileArn)
                    .trustAnchorArn(trustAnchorArn)
                    .roleArn(roleArn)
                    .certificate(cert.getEncoded())
                    .privateKey(privateKey.getEncoded())
                    .build();

            CreateSessionResponse response = client.createSession(request);
            CredentialSet credentialSet = response.credentials();

            return AwsSessionCredentials.create(
                    credentialSet.accessKeyId(),
                    credentialSet.secretAccessKey(),
                    credentialSet.sessionToken()
            );
        }
    }
}

4. 用临时凭证访问S3存储桶 #

通过临时凭证初始化S3客户端，执行你需要的S3操作：

import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.s3.S3Client;
import software.amazon.awssdk.services.s3.model.ListObjectsV2Request;
import software.amazon.awssdk.services.s3.model.ListObjectsV2Response;

public class S3AccessExample {
    public static void main(String[] args) throws Exception {
        // 替换为你的实际参数
        String certPath = "/path/to/your/certificate.pem";
        String privateKeyPath = "/path/to/your/private-key.pem";
        String profileArn = "arn:aws:rolesanywhere:us-east-1:123456789012:profile/your-profile";
        String trustAnchorArn = "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/your-trust-anchor";
        String roleArn = "arn:aws:iam::123456789012:role/your-role";
        String bucketName = "your-target-bucket";

        // 加载凭证
        X509Certificate cert = CredentialLoader.loadCertificate(certPath);
        PrivateKey privateKey = CredentialLoader.loadPrivateKey(privateKeyPath);

        // 获取临时会话凭证
        AwsSessionCredentials sessionCredentials = RolesAnywhereSessionCreator.createSession(
                profileArn, trustAnchorArn, roleArn, cert, privateKey);

        // 初始化S3客户端
        AwsCredentialsProvider credentialsProvider = StaticCredentialsProvider.create(sessionCredentials);
        try (S3Client s3Client = S3Client.builder()
                .region(Region.US_EAST_1) // 替换为你的S3桶所在区域
                .credentialsProvider(credentialsProvider)
                .build()) {

            // 示例：列出桶内对象
            ListObjectsV2Request listRequest = ListObjectsV2Request.builder()
                    .bucket(bucketName)
                    .build();
            ListObjectsV2Response listResponse = s3Client.listObjectsV2(listRequest);

            listResponse.contents().forEach(s3Object -> {
                System.out.println("对象名称: " + s3Object.key());
            });
        }
    }
}

关键注意事项 #

• 确保你的IAM Roles Anywhere角色已配置目标S3桶的访问权限策略。
• 临时凭证有有效期，到期后需重新创建会话获取新凭证。
• 生产环境中，避免硬编码凭证和ARN，建议通过Spring配置或环境变量注入。
• 务必处理IO异常、AWS服务异常等，保证代码健壮性。

内容的提问来源于stack exchange，提问作者Romstar