如何通过HTTP API使用临时凭证访问跨账号AWS S3存储桶

我拥有AWS账号A的AKIA开头accessKeyId和SecretAccessKey，客户已授予我访问其AWS账号B S3存储桶的IAM角色。我可生成账号B的ASIA开头临时accessKeyId、SecretAccessKey及sessionToken，且无法使用SDK，需通过HTTP API访问账号B的S3桶。我按照AWS SigV4文档生成Authorization请求头，该头可正常访问账号A，但使用临时密钥访问账号B时失败。尝试添加x-amz-security-token请求头后，仍收到InvalidToken错误响应。

角色策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::##########:user/#####"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "sts:ExternalId": "#########"
                }
            }
        }
    ]
}

初始请求头 #

Host: s3.us-east-2.amazonaws.com
x-amz-date: 20230516T212805Z
x-amz-content-sha256:###################
Authorization: AWS4-HMAC-SHA256 Credential=ASIA##############/20230516/us-east-2/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=##############################

添加安全令牌后的请求头 #

X-Amz-Content-Sha256: 44ce7dd67c959e0d3524ffac1771dfbba87d2b6b4b4e99e42034a8b803f8b072
Host: s3.us-east-2.amazonaws.com
X-Amz-Security-Token: FwoGZXIvYXdzEDcaDCnx1E****************
X-Amz-Date: 20230517T214836Z
Authorization: AWS4-HMAC-SHA256 Credential=ASIA######/20230517/us-east-2/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token, Signature=368ceac########
Content-Type: text/plain
User-Agent: PostmanRuntime/7.32.2
Accept: */*
Postman-Token: 3114d46a-9ecb-4aa7-8824-4fbaf4b6d534
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 21

错误响应 #

<Error><Code>InvalidToken</Code><Message>The provided token is malformed or otherwise invalid.</Message><Token-0>FwoGZXIv*******</Token-0>

内容的提问来源于stack exchange，提问作者Nabz C