如何通过Cognito Identity Pool在C/C++中获取AWS临时凭证？

前提依赖 #

• 项目中需提前集成aws-sdk-cpp的两个核心组件：aws-cpp-sdk-core、aws-cpp-sdk-cognito-identity
• 提前准备好对应区域的Cognito Identity Pool ID，若使用未认证身份获取凭证，需先在AWS控制台的身份池配置中开启未认证身份访问权限

核心实现流程 #

1. 初始化AWS SDK核心配置
2. 实例化Cognito Identity客户端
3. 调用GetId接口获取当前用户的唯一身份ID
4. 调用GetCredentialsForIdentity接口，使用上一步得到的身份ID换取临时访问密钥、秘密密钥和会话令牌
5. 资源释放与异常处理

完整示例代码 #

#include <aws/core/Aws.h>
#include <aws/core/utils/Outcome.h>
#include <aws/cognito-identity/CognitoIdentityClient.h>
#include <aws/cognito-identity/model/GetIdRequest.h>
#include <aws/cognito-identity/model/GetCredentialsForIdentityRequest.h>

int main(int argc, char** argv)
{
    // 初始化SDK
    Aws::SDKOptions options;
    Aws::InitAPI(options);
    {
        // 配置客户端参数：替换为你自己的区域和身份池ID
        Aws::Client::ClientConfiguration clientConfig;
        clientConfig.region = "cn-north-1"; // 替换为实际区域
        const char* IDENTITY_POOL_ID = "cn-north-1:xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"; // 替换为实际身份池ID

        // 实例化Cognito Identity客户端
        Aws::CognitoIdentity::CognitoIdentityClient cognitoClient(clientConfig);

        // 构造GetId请求
        Aws::CognitoIdentity::Model::GetIdRequest getIdReq;
        getIdReq.SetIdentityPoolId(IDENTITY_POOL_ID);
        auto getIdOutcome = cognitoClient.GetId(getIdReq);

        if (!getIdOutcome.IsSuccess())
        {
            printf("获取身份ID失败: %s\n", getIdOutcome.GetError().GetMessage().c_str());
            Aws::ShutdownAPI(options);
            return -1;
        }

        Aws::String identityId = getIdOutcome.GetResult().GetIdentityId();
        printf("获取到身份ID: %s\n", identityId.c_str());

        // 构造获取凭证请求
        Aws::CognitoIdentity::Model::GetCredentialsForIdentityRequest getCredReq;
        getCredReq.SetIdentityId(identityId);
        auto getCredOutcome = cognitoClient.GetCredentialsForIdentity(getCredReq);

        if (!getCredOutcome.IsSuccess())
        {
            printf("获取临时凭证失败: %s\n", getCredOutcome.GetError().GetMessage().c_str());
            Aws::ShutdownAPI(options);
            return -1;
        }

        auto credentials = getCredOutcome.GetResult().GetCredentials();
        printf("临时访问密钥AK: %s\n", credentials.GetAccessKeyId().c_str());
        printf("临时秘密密钥SK: %s\n", credentials.GetSecretKey().c_str());
        printf("会话令牌: %s\n", credentials.GetSessionToken().c_str());
        printf("凭证过期时间: %lld\n", credentials.GetExpiration().Seconds());

        // 后续可使用上述凭证初始化其他AWS服务的客户端
    }
    // 关闭SDK
    Aws::ShutdownAPI(options);
    return 0;
}

注意事项 #

• 如果使用用户认证后的身份获取凭证，需要在GetId请求中额外传入登录提供商对应的token参数，对应SetLogins方法传入键值对，键为登录提供商的标识，值为用户登录后获取的id token
• 临时凭证默认有效期为1小时，过期前需要重新调用接口获取新的凭证
• 身份池关联的IAM角色必须配置对应需要访问的AWS服务权限，否则拿到的凭证无法正常调用其他AWS接口

内容的提问来源于stack exchange，提问作者jeff