Java调用AWS STS AssumeRole遇roleArn为空验证错误的解决求助

错误核心原因 #

你遇到的roleArn为null的错误，本质有两个问题：

1. API使用方向错误：创建S3存储桶不需要调用STS的AssumeRole接口——这是用来获取临时凭证扮演IAM角色的接口，和直接创建桶的需求不匹配。
2. ARN格式错误：你传入的arn:aws:s3:::test是S3桶的ARN，而非IAM角色的ARN，即使代码中字符串不为null，STS也无法识别为有效角色ARN，甚至可能因格式非法被判定为null。

快速修复：直接创建S3桶（无需STS） #

如果只是单纯创建S3桶，用S3客户端直接操作即可，步骤如下：

1. 配置IAM用户权限 #

给你的IAM用户添加s3:CreateBucket权限，可通过附加AmazonS3FullAccess策略（测试用），或自定义精细策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:CreateBucket",
      "Resource": "arn:aws:s3:::*"
    }
  ]
}

2. 正确的Java代码 #

import com.amazonaws.auth.AWSStaticCredentialsProvider;
import com.amazonaws.auth.BasicAWSCredentials;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;
import com.amazonaws.services.s3.model.CreateBucketRequest;

public class S3BucketCreator {
    public static void main(String[] args) {
        // 替换为你的IAM用户密钥
        String accessKey = "YOUR_ACCESS_KEY";
        String secretKey = "YOUR_SECRET_KEY";
        // 替换为目标区域，比如us-east-1、cn-north-1
        Regions region = Regions.CN_NORTH_1;
        // 桶名需全局唯一
        String bucketName = "test-unique-name";

        // 初始化S3客户端
        AmazonS3 s3Client = AmazonS3ClientBuilder.standard()
                .withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials(accessKey, secretKey)))
                .withRegion(region)
                .build();

        // 创建存储桶
        CreateBucketRequest request = new CreateBucketRequest(bucketName);
        s3Client.createBucket(request);
        System.out.println("Bucket " + bucketName + " created successfully");
    }
}

若需通过角色扮演创建桶（进阶场景） #

如果确实需要通过扮演IAM角色来创建桶，需完成以下配置和代码修正：

1. 前置配置 #

• 创建一个IAM角色，给角色添加s3:CreateBucket权限（同上述策略）
• 给你的IAM用户添加sts:AssumeRole权限，允许其扮演该角色，示例策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::你的AWS账户ID:role/你的角色名"
    }
  ]
}

2. 修正后的STS+S3代码 #

import com.amazonaws.auth.AWSStaticCredentialsProvider;
import com.amazonaws.auth.BasicAWSCredentials;
import com.amazonaws.auth.BasicSessionCredentials;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;
import com.amazonaws.services.securitytoken.AWSSecurityTokenService;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder;
import com.amazonaws.services.securitytoken.model.AssumeRoleRequest;
import com.amazonaws.services.securitytoken.model.AssumeRoleResult;
import com.amazonaws.services.securitytoken.model.Credentials;

public class S3BucketCreatorWithRole {
    public static void main(String[] args) {
        String accessKey = "YOUR_ACCESS_KEY";
        String secretKey = "YOUR_SECRET_KEY";
        Regions region = Regions.CN_NORTH_1;
        // 替换为你的IAM角色ARN，格式：arn:aws:iam::账户ID:role/角色名
        String roleArn = "arn:aws:iam::123456789012:role/MyS3CreationRole";
        String bucketName = "test-unique-name";

        // 初始化STS客户端
        AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder.standard()
                .withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials(accessKey, secretKey)))
                .withRegion(region)
                .build();

        // 构建角色扮演请求
        AssumeRoleRequest assumeRequest = new AssumeRoleRequest()
                .withRoleArn(roleArn)
                .withRoleSessionName("s3-bucket-creation-session"); // 会话名自定义

        // 获取临时凭证
        AssumeRoleResult assumeResult = stsClient.assumeRole(assumeRequest);
        Credentials tempCredentials = assumeResult.getCredentials();

        // 用临时凭证初始化S3客户端
        AmazonS3 s3Client = AmazonS3ClientBuilder.standard()
                .withCredentials(new AWSStaticCredentialsProvider(new BasicSessionCredentials(
                        tempCredentials.getAccessKeyId(),
                        tempCredentials.getSecretAccessKey(),
                        tempCredentials.getSessionToken()
                )))
                .withRegion(region)
                .build();

        // 创建桶
        s3Client.createBucket(bucketName);
        System.out.println("Bucket " + bucketName + " created via role successfully");
    }
}

内容的提问来源于stack exchange，提问作者Peter Penzov