如何将aws-sdk-sts的AssumeRole凭证导入Rust的aws_config

核心实现步骤 #

要把STS AssumeRole获取的凭证注入aws_config，只需用StaticCredentialsProvider包装凭证，替换默认的凭证提供者即可，具体代码示例如下：

use aws_config;
use aws_sdk_codepipeline::Client as CodePipelineClient;
use aws_sdk_sts::Client as StsClient;
use aws_types::credentials::{Credentials, StaticCredentialsProvider};
use aws_types::region::Region;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // 1. 用默认环境凭证初始化STS客户端
    let sts_client = StsClient::new(&aws_config::load_from_env().await);

    // 2. 调用AssumeRole获取目标账号的临时凭证
    let assume_role_response = sts_client
        .assume_role()
        .role_arn("arn:aws:iam::TARGET_ACCOUNT_ID:role/YOUR_ASSUME_ROLE_NAME")
        .role_session_name("cross-account-codepipeline-session")
        .send()
        .await?;

    let credentials = assume_role_response.credentials().unwrap();
    // 把STS返回的凭证转为SDK可识别的Credentials结构
    let static_creds = Credentials::new(
        credentials.access_key_id(),
        credentials.secret_access_key(),
        credentials.session_token().map(|s| s.to_string()),
        credentials.expiration(),
        "sts-assume-role",
    );

    // 3. 用静态凭证构建自定义配置
    let creds_provider = StaticCredentialsProvider::new(static_creds);
    let config = aws_config::from_env()
        .credentials_provider(creds_provider)
        .region(Region::new("us-east-1")) // 替换为目标账号CodePipeline所在区域
        .load()
        .await;

    // 4. 创建跨账号的CodePipeline客户端
    let cp_client = CodePipelineClient::new(&config);

    // 5. 调用接口验证
    let pipelines = cp_client.list_pipelines().send().await?;
    println!("Pipelines: {:?}", pipelines.pipelines());

    Ok(())
}

关键细节说明 #

• StaticCredentialsProvider是AWS SDK提供的静态凭证载体，专门用来传入手动获取的临时凭证（比如STS AssumeRole的结果）
• 必须显式指定区域：AssumeRole返回的凭证不包含区域信息，需要手动设置目标账号CodePipeline所在的AWS区域
• 注意凭证有效期：STS角色凭证默认有效期1小时，过期后需重新调用AssumeRole获取新凭证

内容的提问来源于stack exchange，提问作者Devin Stewart